target-arm/helper.c

   1 #include <stdio.h>
   2 #include <stdlib.h>
   3 #include <string.h>
   4
   5 #include "cpu.h"
   6 #include "exec-all.h"
   7 #include "gdbstub.h"
   8 #include "helpers.h"
   9 #include "qemu-common.h"
  10
  11 static uint32_t cortexa8_cp15_c0_c1[8] =
  12 { 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
  13
  14 static uint32_t cortexa8_cp15_c0_c2[8] =
  15 { 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
  16
  17 static uint32_t mpcore_cp15_c0_c1[8] =
  18 { 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
  19
  20 static uint32_t mpcore_cp15_c0_c2[8] =
  21 { 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
  22
  23 static uint32_t arm1136_cp15_c0_c1[8] =
  24 { 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
  25
  26 static uint32_t arm1136_cp15_c0_c2[8] =
  27 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
  28
  29 static uint32_t cpu_arm_find_by_name(const char *name);
  30
  31 static inline void set_feature(CPUARMState *env, int feature)
  32 {
  33     env->features |= 1u << feature;
  34 }
  35
  36 static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
  37 {
  38     env->cp15.c0_cpuid = id;
  39     switch (id) {
  40     case ARM_CPUID_ARM926:
  41         set_feature(env, ARM_FEATURE_VFP);
  42         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
  43         env->cp15.c0_cachetype = 0x1dd20d2;
  44         env->cp15.c1_sys = 0x00090078;
  45         break;
  46     case ARM_CPUID_ARM946:
  47         set_feature(env, ARM_FEATURE_MPU);
  48         env->cp15.c0_cachetype = 0x0f004006;
  49         env->cp15.c1_sys = 0x00000078;
  50         break;
  51     case ARM_CPUID_ARM1026:
  52         set_feature(env, ARM_FEATURE_VFP);
  53         set_feature(env, ARM_FEATURE_AUXCR);
  54         env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
  55         env->cp15.c0_cachetype = 0x1dd20d2;
  56         env->cp15.c1_sys = 0x00090078;
  57         break;
  58     case ARM_CPUID_ARM1136_R2:
  59     case ARM_CPUID_ARM1136:
  60         set_feature(env, ARM_FEATURE_V6);
  61         set_feature(env, ARM_FEATURE_VFP);
  62         set_feature(env, ARM_FEATURE_AUXCR);
  63         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  64         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  65         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  66         memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
  67         memcpy(env->cp15.c0_c2, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
  68         env->cp15.c0_cachetype = 0x1dd20d2;
  69         break;
  70     case ARM_CPUID_ARM11MPCORE:
  71         set_feature(env, ARM_FEATURE_V6);
  72         set_feature(env, ARM_FEATURE_V6K);
  73         set_feature(env, ARM_FEATURE_VFP);
  74         set_feature(env, ARM_FEATURE_AUXCR);
  75         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  76         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  77         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  78         memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
  79         memcpy(env->cp15.c0_c2, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
  80         env->cp15.c0_cachetype = 0x1dd20d2;
  81         break;
  82     case ARM_CPUID_CORTEXA8:
  83         set_feature(env, ARM_FEATURE_V6);
  84         set_feature(env, ARM_FEATURE_V6K);
  85         set_feature(env, ARM_FEATURE_V7);
  86         set_feature(env, ARM_FEATURE_AUXCR);
  87         set_feature(env, ARM_FEATURE_THUMB2);
  88         set_feature(env, ARM_FEATURE_VFP);
  89         set_feature(env, ARM_FEATURE_VFP3);
  90         set_feature(env, ARM_FEATURE_NEON);
  91         env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
  92         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
  93         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
  94         memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
  95         memcpy(env->cp15.c0_c2, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
  96         env->cp15.c0_cachetype = 0x1dd20d2;
  97         break;
  98     case ARM_CPUID_CORTEXM3:
  99         set_feature(env, ARM_FEATURE_V6);
 100         set_feature(env, ARM_FEATURE_THUMB2);
 101         set_feature(env, ARM_FEATURE_V7);
 102         set_feature(env, ARM_FEATURE_M);
 103         set_feature(env, ARM_FEATURE_DIV);
 104         break;
 105     case ARM_CPUID_ANY: /* For userspace emulation.  */
 106         set_feature(env, ARM_FEATURE_V6);
 107         set_feature(env, ARM_FEATURE_V6K);
 108         set_feature(env, ARM_FEATURE_V7);
 109         set_feature(env, ARM_FEATURE_THUMB2);
 110         set_feature(env, ARM_FEATURE_VFP);
 111         set_feature(env, ARM_FEATURE_VFP3);
 112         set_feature(env, ARM_FEATURE_NEON);
 113         set_feature(env, ARM_FEATURE_DIV);
 114         break;
 115     case ARM_CPUID_TI915T:
 116     case ARM_CPUID_TI925T:
 117         set_feature(env, ARM_FEATURE_OMAPCP);
 118         env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
 119         env->cp15.c0_cachetype = 0x5109149;
 120         env->cp15.c1_sys = 0x00000070;
 121         env->cp15.c15_i_max = 0x000;
 122         env->cp15.c15_i_min = 0xff0;
 123         break;
 124     case ARM_CPUID_PXA250:
 125     case ARM_CPUID_PXA255:
 126     case ARM_CPUID_PXA260:
 127     case ARM_CPUID_PXA261:
 128     case ARM_CPUID_PXA262:
 129         set_feature(env, ARM_FEATURE_XSCALE);
 130         /* JTAG_ID is ((id << 28) | 0x09265013) */
 131         env->cp15.c0_cachetype = 0xd172172;
 132         env->cp15.c1_sys = 0x00000078;
 133         break;
 134     case ARM_CPUID_PXA270_A0:
 135     case ARM_CPUID_PXA270_A1:
 136     case ARM_CPUID_PXA270_B0:
 137     case ARM_CPUID_PXA270_B1:
 138     case ARM_CPUID_PXA270_C0:
 139     case ARM_CPUID_PXA270_C5:
 140         set_feature(env, ARM_FEATURE_XSCALE);
 141         /* JTAG_ID is ((id << 28) | 0x09265013) */
 142         set_feature(env, ARM_FEATURE_IWMMXT);
 143         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
 144         env->cp15.c0_cachetype = 0xd172172;
 145         env->cp15.c1_sys = 0x00000078;
 146         break;
 147     default:
 148         cpu_abort(env, "Bad CPU ID: %x\n", id);
 149         break;
 150     }
 151 }
 152
 153 void cpu_reset(CPUARMState *env)
 154 {
 155     uint32_t id;
 156     id = env->cp15.c0_cpuid;
 157     memset(env, 0, offsetof(CPUARMState, breakpoints));
 158     if (id)
 159         cpu_reset_model_id(env, id);
 160 #if defined (CONFIG_USER_ONLY)
 161     env->uncached_cpsr = ARM_CPU_MODE_USR;
 162     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
 163 #else
 164     /* SVC mode with interrupts disabled.  */
 165     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
 166     /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
 167        clear at reset.  */
 168     if (IS_M(env))
 169         env->uncached_cpsr &= ~CPSR_I;
 170     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 171     env->cp15.c2_base_mask = 0xffffc000u;
 172 #endif
 173     env->regs[15] = 0;
 174     tlb_flush(env, 1);
 175 }
 176
 177 static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
 178 {
 179     int nregs;
 180
 181     /* VFP data registers are always little-endian.  */
 182     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 183     if (reg < nregs) {
 184         stfq_le_p(buf, env->vfp.regs[reg]);
 185         return 8;
 186     }
 187     if (arm_feature(env, ARM_FEATURE_NEON)) {
 188         /* Aliases for Q regs.  */
 189         nregs += 16;
 190         if (reg < nregs) {
 191             stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 192             stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 193             return 16;
 194         }
 195     }
 196     switch (reg - nregs) {
 197     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
 198     case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
 199     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
 200     }
 201     return 0;
 202 }
 203
 204 static int vfp_gdb_set_reg(CPUState *env, uint8_t *buf, int reg)
 205 {
 206     int nregs;
 207
 208     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 209     if (reg < nregs) {
 210         env->vfp.regs[reg] = ldfq_le_p(buf);
 211         return 8;
 212     }
 213     if (arm_feature(env, ARM_FEATURE_NEON)) {
 214         nregs += 16;
 215         if (reg < nregs) {
 216             env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
 217             env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
 218             return 16;
 219         }
 220     }
 221     switch (reg - nregs) {
 222     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
 223     case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
 224     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf); return 4;
 225     }
 226     return 0;
 227 }
 228
 229 CPUARMState *cpu_arm_init(const char *cpu_model)
 230 {
 231     CPUARMState *env;
 232     uint32_t id;
 233     static int inited = 0;
 234
 235     id = cpu_arm_find_by_name(cpu_model);
 236     if (id == 0)
 237         return NULL;
 238     env = qemu_mallocz(sizeof(CPUARMState));
 239     if (!env)
 240         return NULL;
 241     cpu_exec_init(env);
 242     if (!inited) {
 243         inited = 1;
 244         arm_translate_init();
 245     }
 246
 247     env->cpu_model_str = cpu_model;
 248     env->cp15.c0_cpuid = id;
 249     cpu_reset(env);
 250     if (arm_feature(env, ARM_FEATURE_NEON)) {
 251         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 252                                  51, "arm-neon.xml", 0);
 253     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
 254         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 255                                  35, "arm-vfp3.xml", 0);
 256     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 257         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 258                                  19, "arm-vfp.xml", 0);
 259     }
 260     return env;
 261 }
 262
 263 struct arm_cpu_t {
 264     uint32_t id;
 265     const char *name;
 266 };
 267
 268 static const struct arm_cpu_t arm_cpu_names[] = {
 269     { ARM_CPUID_ARM926, "arm926"},
 270     { ARM_CPUID_ARM946, "arm946"},
 271     { ARM_CPUID_ARM1026, "arm1026"},
 272     { ARM_CPUID_ARM1136, "arm1136"},
 273     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
 274     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
 275     { ARM_CPUID_CORTEXM3, "cortex-m3"},
 276     { ARM_CPUID_CORTEXA8, "cortex-a8"},
 277     { ARM_CPUID_TI925T, "ti925t" },
 278     { ARM_CPUID_PXA250, "pxa250" },
 279     { ARM_CPUID_PXA255, "pxa255" },
 280     { ARM_CPUID_PXA260, "pxa260" },
 281     { ARM_CPUID_PXA261, "pxa261" },
 282     { ARM_CPUID_PXA262, "pxa262" },
 283     { ARM_CPUID_PXA270, "pxa270" },
 284     { ARM_CPUID_PXA270_A0, "pxa270-a0" },
 285     { ARM_CPUID_PXA270_A1, "pxa270-a1" },
 286     { ARM_CPUID_PXA270_B0, "pxa270-b0" },
 287     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
 288     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
 289     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
 290     { ARM_CPUID_ANY, "any"},
 291     { 0, NULL}
 292 };
 293
 294 void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 295 {
 296     int i;
 297
 298     (*cpu_fprintf)(f, "Available CPUs:\n");
 299     for (i = 0; arm_cpu_names[i].name; i++) {
 300         (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
 301     }
 302 }
 303
 304 /* return 0 if not found */
 305 static uint32_t cpu_arm_find_by_name(const char *name)
 306 {
 307     int i;
 308     uint32_t id;
 309
 310     id = 0;
 311     for (i = 0; arm_cpu_names[i].name; i++) {
 312         if (strcmp(name, arm_cpu_names[i].name) == 0) {
 313             id = arm_cpu_names[i].id;
 314             break;
 315         }
 316     }
 317     return id;
 318 }
 319
 320 void cpu_arm_close(CPUARMState *env)
 321 {
 322     free(env);
 323 }
 324
 325 uint32_t cpsr_read(CPUARMState *env)
 326 {
 327     int ZF;
 328     ZF = (env->ZF == 0);
 329     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
 330         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
 331         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
 332         | ((env->condexec_bits & 0xfc) << 8)
 333         | (env->GE << 16);
 334 }
 335
 336 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 337 {
 338     if (mask & CPSR_NZCV) {
 339         env->ZF = (~val) & CPSR_Z;
 340         env->NF = val;
 341         env->CF = (val >> 29) & 1;
 342         env->VF = (val << 3) & 0x80000000;
 343     }
 344     if (mask & CPSR_Q)
 345         env->QF = ((val & CPSR_Q) != 0);
 346     if (mask & CPSR_T)
 347         env->thumb = ((val & CPSR_T) != 0);
 348     if (mask & CPSR_IT_0_1) {
 349         env->condexec_bits &= ~3;
 350         env->condexec_bits |= (val >> 25) & 3;
 351     }
 352     if (mask & CPSR_IT_2_7) {
 353         env->condexec_bits &= 3;
 354         env->condexec_bits |= (val >> 8) & 0xfc;
 355     }
 356     if (mask & CPSR_GE) {
 357         env->GE = (val >> 16) & 0xf;
 358     }
 359
 360     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
 361         switch_mode(env, val & CPSR_M);
 362     }
 363     mask &= ~CACHED_CPSR_BITS;
 364     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 365 }
 366
 367 /* Sign/zero extend */
 368 uint32_t HELPER(sxtb16)(uint32_t x)
 369 {
 370     uint32_t res;
 371     res = (uint16_t)(int8_t)x;
 372     res |= (uint32_t)(int8_t)(x >> 16) << 16;
 373     return res;
 374 }
 375
 376 uint32_t HELPER(uxtb16)(uint32_t x)
 377 {
 378     uint32_t res;
 379     res = (uint16_t)(uint8_t)x;
 380     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
 381     return res;
 382 }
 383
 384 uint32_t HELPER(clz)(uint32_t x)
 385 {
 386     int count;
 387     for (count = 32; x; count--)
 388         x >>= 1;
 389     return count;
 390 }
 391
 392 int32_t HELPER(sdiv)(int32_t num, int32_t den)
 393 {
 394     if (den == 0)
 395       return 0;
 396     return num / den;
 397 }
 398
 399 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
 400 {
 401     if (den == 0)
 402       return 0;
 403     return num / den;
 404 }
 405
 406 uint32_t HELPER(rbit)(uint32_t x)
 407 {
 408     x =  ((x & 0xff000000) >> 24)
 409        | ((x & 0x00ff0000) >> 8)
 410        | ((x & 0x0000ff00) << 8)
 411        | ((x & 0x000000ff) << 24);
 412     x =  ((x & 0xf0f0f0f0) >> 4)
 413        | ((x & 0x0f0f0f0f) << 4);
 414     x =  ((x & 0x88888888) >> 3)
 415        | ((x & 0x44444444) >> 1)
 416        | ((x & 0x22222222) << 1)
 417        | ((x & 0x11111111) << 3);
 418     return x;
 419 }
 420
 421 uint32_t HELPER(abs)(uint32_t x)
 422 {
 423     return ((int32_t)x < 0) ? -x : x;
 424 }
 425
 426 #if defined(CONFIG_USER_ONLY)
 427
 428 void do_interrupt (CPUState *env)
 429 {
 430     env->exception_index = -1;
 431 }
 432
 433 /* Structure used to record exclusive memory locations.  */
 434 typedef struct mmon_state {
 435     struct mmon_state *next;
 436     CPUARMState *cpu_env;
 437     uint32_t addr;
 438 } mmon_state;
 439
 440 /* Chain of current locks.  */
 441 static mmon_state* mmon_head = NULL;
 442
 443 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 444                               int mmu_idx, int is_softmmu)
 445 {
 446     if (rw == 2) {
 447         env->exception_index = EXCP_PREFETCH_ABORT;
 448         env->cp15.c6_insn = address;
 449     } else {
 450         env->exception_index = EXCP_DATA_ABORT;
 451         env->cp15.c6_data = address;
 452     }
 453     return 1;
 454 }
 455
 456 static void allocate_mmon_state(CPUState *env)
 457 {
 458     env->mmon_entry = malloc(sizeof (mmon_state));
 459     if (!env->mmon_entry)
 460         abort();
 461     memset (env->mmon_entry, 0, sizeof (mmon_state));
 462     env->mmon_entry->cpu_env = env;
 463     mmon_head = env->mmon_entry;
 464 }
 465
 466 /* Flush any monitor locks for the specified address.  */
 467 static void flush_mmon(uint32_t addr)
 468 {
 469     mmon_state *mon;
 470
 471     for (mon = mmon_head; mon; mon = mon->next)
 472       {
 473         if (mon->addr != addr)
 474           continue;
 475
 476         mon->addr = 0;
 477         break;
 478       }
 479 }
 480
 481 /* Mark an address for exclusive access.  */
 482 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
 483 {
 484     if (!env->mmon_entry)
 485         allocate_mmon_state(env);
 486     /* Clear any previous locks.  */
 487     flush_mmon(addr);
 488     env->mmon_entry->addr = addr;
 489 }
 490
 491 /* Test if an exclusive address is still exclusive.  Returns zero
 492    if the address is still exclusive.   */
 493 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
 494 {
 495     int res;
 496
 497     if (!env->mmon_entry)
 498         return 1;
 499     if (env->mmon_entry->addr == addr)
 500         res = 0;
 501     else
 502         res = 1;
 503     flush_mmon(addr);
 504     return res;
 505 }
 506
 507 void HELPER(clrex)(CPUState *env)
 508 {
 509     if (!(env->mmon_entry && env->mmon_entry->addr))
 510         return;
 511     flush_mmon(env->mmon_entry->addr);
 512 }
 513
 514 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 515 {
 516     return addr;
 517 }
 518
 519 /* These should probably raise undefined insn exceptions.  */
 520 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
 521 {
 522     int op1 = (insn >> 8) & 0xf;
 523     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 524     return;
 525 }
 526
 527 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
 528 {
 529     int op1 = (insn >> 8) & 0xf;
 530     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 531     return 0;
 532 }
 533
 534 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
 535 {
 536     cpu_abort(env, "cp15 insn %08x\n", insn);
 537 }
 538
 539 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 540 {
 541     cpu_abort(env, "cp15 insn %08x\n", insn);
 542     return 0;
 543 }
 544
 545 /* These should probably raise undefined insn exceptions.  */
 546 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
 547 {
 548     cpu_abort(env, "v7m_mrs %d\n", reg);
 549 }
 550
 551 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
 552 {
 553     cpu_abort(env, "v7m_mrs %d\n", reg);
 554     return 0;
 555 }
 556
 557 void switch_mode(CPUState *env, int mode)
 558 {
 559     if (mode != ARM_CPU_MODE_USR)
 560         cpu_abort(env, "Tried to switch out of user mode\n");
 561 }
 562
 563 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
 564 {
 565     cpu_abort(env, "banked r13 write\n");
 566 }
 567
 568 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
 569 {
 570     cpu_abort(env, "banked r13 read\n");
 571     return 0;
 572 }
 573
 574 #else
 575
 576 extern int semihosting_enabled;
 577
 578 /* Map CPU modes onto saved register banks.  */
 579 static inline int bank_number (int mode)
 580 {
 581     switch (mode) {
 582     case ARM_CPU_MODE_USR:
 583     case ARM_CPU_MODE_SYS:
 584         return 0;
 585     case ARM_CPU_MODE_SVC:
 586         return 1;
 587     case ARM_CPU_MODE_ABT:
 588         return 2;
 589     case ARM_CPU_MODE_UND:
 590         return 3;
 591     case ARM_CPU_MODE_IRQ:
 592         return 4;
 593     case ARM_CPU_MODE_FIQ:
 594         return 5;
 595     }
 596     cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
 597     return -1;
 598 }
 599
 600 void switch_mode(CPUState *env, int mode)
 601 {
 602     int old_mode;
 603     int i;
 604
 605     old_mode = env->uncached_cpsr & CPSR_M;
 606     if (mode == old_mode)
 607         return;
 608
 609     if (old_mode == ARM_CPU_MODE_FIQ) {
 610         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
 611         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
 612     } else if (mode == ARM_CPU_MODE_FIQ) {
 613         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
 614         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
 615     }
 616
 617     i = bank_number(old_mode);
 618     env->banked_r13[i] = env->regs[13];
 619     env->banked_r14[i] = env->regs[14];
 620     env->banked_spsr[i] = env->spsr;
 621
 622     i = bank_number(mode);
 623     env->regs[13] = env->banked_r13[i];
 624     env->regs[14] = env->banked_r14[i];
 625     env->spsr = env->banked_spsr[i];
 626 }
 627
 628 static void v7m_push(CPUARMState *env, uint32_t val)
 629 {
 630     env->regs[13] -= 4;
 631     stl_phys(env->regs[13], val);
 632 }
 633
 634 static uint32_t v7m_pop(CPUARMState *env)
 635 {
 636     uint32_t val;
 637     val = ldl_phys(env->regs[13]);
 638     env->regs[13] += 4;
 639     return val;
 640 }
 641
 642 /* Switch to V7M main or process stack pointer.  */
 643 static void switch_v7m_sp(CPUARMState *env, int process)
 644 {
 645     uint32_t tmp;
 646     if (env->v7m.current_sp != process) {
 647         tmp = env->v7m.other_sp;
 648         env->v7m.other_sp = env->regs[13];
 649         env->regs[13] = tmp;
 650         env->v7m.current_sp = process;
 651     }
 652 }
 653
 654 static void do_v7m_exception_exit(CPUARMState *env)
 655 {
 656     uint32_t type;
 657     uint32_t xpsr;
 658
 659     type = env->regs[15];
 660     if (env->v7m.exception != 0)
 661         armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
 662
 663     /* Switch to the target stack.  */
 664     switch_v7m_sp(env, (type & 4) != 0);
 665     /* Pop registers.  */
 666     env->regs[0] = v7m_pop(env);
 667     env->regs[1] = v7m_pop(env);
 668     env->regs[2] = v7m_pop(env);
 669     env->regs[3] = v7m_pop(env);
 670     env->regs[12] = v7m_pop(env);
 671     env->regs[14] = v7m_pop(env);
 672     env->regs[15] = v7m_pop(env);
 673     xpsr = v7m_pop(env);
 674     xpsr_write(env, xpsr, 0xfffffdff);
 675     /* Undo stack alignment.  */
 676     if (xpsr & 0x200)
 677         env->regs[13] |= 4;
 678     /* ??? The exception return type specifies Thread/Handler mode.  However
 679        this is also implied by the xPSR value. Not sure what to do
 680        if there is a mismatch.  */
 681     /* ??? Likewise for mismatches between the CONTROL register and the stack
 682        pointer.  */
 683 }
 684
 685 void do_interrupt_v7m(CPUARMState *env)
 686 {
 687     uint32_t xpsr = xpsr_read(env);
 688     uint32_t lr;
 689     uint32_t addr;
 690
 691     lr = 0xfffffff1;
 692     if (env->v7m.current_sp)
 693         lr |= 4;
 694     if (env->v7m.exception == 0)
 695         lr |= 8;
 696
 697     /* For exceptions we just mark as pending on the NVIC, and let that
 698        handle it.  */
 699     /* TODO: Need to escalate if the current priority is higher than the
 700        one we're raising.  */
 701     switch (env->exception_index) {
 702     case EXCP_UDEF:
 703         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
 704         return;
 705     case EXCP_SWI:
 706         env->regs[15] += 2;
 707         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
 708         return;
 709     case EXCP_PREFETCH_ABORT:
 710     case EXCP_DATA_ABORT:
 711         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
 712         return;
 713     case EXCP_BKPT:
 714         if (semihosting_enabled) {
 715             int nr;
 716             nr = lduw_code(env->regs[15]) & 0xff;
 717             if (nr == 0xab) {
 718                 env->regs[15] += 2;
 719                 env->regs[0] = do_arm_semihosting(env);
 720                 return;
 721             }
 722         }
 723         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
 724         return;
 725     case EXCP_IRQ:
 726         env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
 727         break;
 728     case EXCP_EXCEPTION_EXIT:
 729         do_v7m_exception_exit(env);
 730         return;
 731     default:
 732         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 733         return; /* Never happens.  Keep compiler happy.  */
 734     }
 735
 736     /* Align stack pointer.  */
 737     /* ??? Should only do this if Configuration Control Register
 738        STACKALIGN bit is set.  */
 739     if (env->regs[13] & 4) {
 740         env->regs[13] -= 4;
 741         xpsr |= 0x200;
 742     }
 743     /* Switch to the handler mode.  */
 744     v7m_push(env, xpsr);
 745     v7m_push(env, env->regs[15]);
 746     v7m_push(env, env->regs[14]);
 747     v7m_push(env, env->regs[12]);
 748     v7m_push(env, env->regs[3]);
 749     v7m_push(env, env->regs[2]);
 750     v7m_push(env, env->regs[1]);
 751     v7m_push(env, env->regs[0]);
 752     switch_v7m_sp(env, 0);
 753     env->uncached_cpsr &= ~CPSR_IT;
 754     env->regs[14] = lr;
 755     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
 756     env->regs[15] = addr & 0xfffffffe;
 757     env->thumb = addr & 1;
 758 }
 759
 760 /* Handle a CPU exception.  */
 761 void do_interrupt(CPUARMState *env)
 762 {
 763     uint32_t addr;
 764     uint32_t mask;
 765     int new_mode;
 766     uint32_t offset;
 767
 768     if (IS_M(env)) {
 769         do_interrupt_v7m(env);
 770         return;
 771     }
 772     /* TODO: Vectored interrupt controller.  */
 773     switch (env->exception_index) {
 774     case EXCP_UDEF:
 775         new_mode = ARM_CPU_MODE_UND;
 776         addr = 0x04;
 777         mask = CPSR_I;
 778         if (env->thumb)
 779             offset = 2;
 780         else
 781             offset = 4;
 782         break;
 783     case EXCP_SWI:
 784         if (semihosting_enabled) {
 785             /* Check for semihosting interrupt.  */
 786             if (env->thumb) {
 787                 mask = lduw_code(env->regs[15] - 2) & 0xff;
 788             } else {
 789                 mask = ldl_code(env->regs[15] - 4) & 0xffffff;
 790             }
 791             /* Only intercept calls from privileged modes, to provide some
 792                semblance of security.  */
 793             if (((mask == 0x123456 && !env->thumb)
 794                     || (mask == 0xab && env->thumb))
 795                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 796                 env->regs[0] = do_arm_semihosting(env);
 797                 return;
 798             }
 799         }
 800         new_mode = ARM_CPU_MODE_SVC;
 801         addr = 0x08;
 802         mask = CPSR_I;
 803         /* The PC already points to the next instruction.  */
 804         offset = 0;
 805         break;
 806     case EXCP_BKPT:
 807         /* See if this is a semihosting syscall.  */
 808         if (env->thumb && semihosting_enabled) {
 809             mask = lduw_code(env->regs[15]) & 0xff;
 810             if (mask == 0xab
 811                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 812                 env->regs[15] += 2;
 813                 env->regs[0] = do_arm_semihosting(env);
 814                 return;
 815             }
 816         }
 817         /* Fall through to prefetch abort.  */
 818     case EXCP_PREFETCH_ABORT:
 819         new_mode = ARM_CPU_MODE_ABT;
 820         addr = 0x0c;
 821         mask = CPSR_A | CPSR_I;
 822         offset = 4;
 823         break;
 824     case EXCP_DATA_ABORT:
 825         new_mode = ARM_CPU_MODE_ABT;
 826         addr = 0x10;
 827         mask = CPSR_A | CPSR_I;
 828         offset = 8;
 829         break;
 830     case EXCP_IRQ:
 831         new_mode = ARM_CPU_MODE_IRQ;
 832         addr = 0x18;
 833         /* Disable IRQ and imprecise data aborts.  */
 834         mask = CPSR_A | CPSR_I;
 835         offset = 4;
 836         break;
 837     case EXCP_FIQ:
 838         new_mode = ARM_CPU_MODE_FIQ;
 839         addr = 0x1c;
 840         /* Disable FIQ, IRQ and imprecise data aborts.  */
 841         mask = CPSR_A | CPSR_I | CPSR_F;
 842         offset = 4;
 843         break;
 844     default:
 845         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 846         return; /* Never happens.  Keep compiler happy.  */
 847     }
 848     /* High vectors.  */
 849     if (env->cp15.c1_sys & (1 << 13)) {
 850         addr += 0xffff0000;
 851     }
 852     switch_mode (env, new_mode);
 853     env->spsr = cpsr_read(env);
 854     /* Clear IT bits.  */
 855     env->condexec_bits = 0;
 856     /* Switch to the new mode, and switch to Arm mode.  */
 857     /* ??? Thumb interrupt handlers not implemented.  */
 858     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
 859     env->uncached_cpsr |= mask;
 860     env->thumb = 0;
 861     env->regs[14] = env->regs[15] + offset;
 862     env->regs[15] = addr;
 863     env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 864 }
 865
 866 /* Check section/page access permissions.
 867    Returns the page protection flags, or zero if the access is not
 868    permitted.  */
 869 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
 870                            int is_user)
 871 {
 872   int prot_ro;
 873
 874   if (domain == 3)
 875     return PAGE_READ | PAGE_WRITE;
 876
 877   if (access_type == 1)
 878       prot_ro = 0;
 879   else
 880       prot_ro = PAGE_READ;
 881
 882   switch (ap) {
 883   case 0:
 884       if (access_type == 1)
 885           return 0;
 886       switch ((env->cp15.c1_sys >> 8) & 3) {
 887       case 1:
 888           return is_user ? 0 : PAGE_READ;
 889       case 2:
 890           return PAGE_READ;
 891       default:
 892           return 0;
 893       }
 894   case 1:
 895       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
 896   case 2:
 897       if (is_user)
 898           return prot_ro;
 899       else
 900           return PAGE_READ | PAGE_WRITE;
 901   case 3:
 902       return PAGE_READ | PAGE_WRITE;
 903   case 4: case 7: /* Reserved.  */
 904       return 0;
 905   case 5:
 906       return is_user ? 0 : prot_ro;
 907   case 6:
 908       return prot_ro;
 909   default:
 910       abort();
 911   }
 912 }
 913
 914 static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
 915 {
 916     uint32_t table;
 917
 918     if (address & env->cp15.c2_mask)
 919         table = env->cp15.c2_base1 & 0xffffc000;
 920     else
 921         table = env->cp15.c2_base0 & env->cp15.c2_base_mask;
 922
 923     table |= (address >> 18) & 0x3ffc;
 924     return table;
 925 }
 926
 927 static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
 928                             int is_user, uint32_t *phys_ptr, int *prot)
 929 {
 930     int code;
 931     uint32_t table;
 932     uint32_t desc;
 933     int type;
 934     int ap;
 935     int domain;
 936     uint32_t phys_addr;
 937
 938     /* Pagetable walk.  */
 939     /* Lookup l1 descriptor.  */
 940     table = get_level1_table_address(env, address);
 941     desc = ldl_phys(table);
 942     type = (desc & 3);
 943     domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
 944     if (type == 0) {
 945         /* Section translation fault.  */
 946         code = 5;
 947         goto do_fault;
 948     }
 949     if (domain == 0 || domain == 2) {
 950         if (type == 2)
 951             code = 9; /* Section domain fault.  */
 952         else
 953             code = 11; /* Page domain fault.  */
 954         goto do_fault;
 955     }
 956     if (type == 2) {
 957         /* 1Mb section.  */
 958         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
 959         ap = (desc >> 10) & 3;
 960         code = 13;
 961     } else {
 962         /* Lookup l2 entry.  */
 963         if (type == 1) {
 964             /* Coarse pagetable.  */
 965             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
 966         } else {
 967             /* Fine pagetable.  */
 968             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
 969         }
 970         desc = ldl_phys(table);
 971         switch (desc & 3) {
 972         case 0: /* Page translation fault.  */
 973             code = 7;
 974             goto do_fault;
 975         case 1: /* 64k page.  */
 976             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
 977             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 978             break;
 979         case 2: /* 4k page.  */
 980             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 981             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 982             break;
 983         case 3: /* 1k page.  */
 984             if (type == 1) {
 985                 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
 986                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 987                 } else {
 988                     /* Page translation fault.  */
 989                     code = 7;
 990                     goto do_fault;
 991                 }
 992             } else {
 993                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
 994             }
 995             ap = (desc >> 4) & 3;
 996             break;
 997         default:
 998             /* Never happens, but compiler isn't smart enough to tell.  */
 999             abort();
1000         }
1001         code = 15;
1002     }
1003     *prot = check_ap(env, ap, domain, access_type, is_user);
1004     if (!*prot) {
1005         /* Access permission fault.  */
1006         goto do_fault;
1007     }
1008     *phys_ptr = phys_addr;
1009     return 0;
1010 do_fault:
1011     return code | (domain << 4);
1012 }
1013
1014 static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
1015                             int is_user, uint32_t *phys_ptr, int *prot)
1016 {
1017     int code;
1018     uint32_t table;
1019     uint32_t desc;
1020     uint32_t xn;
1021     int type;
1022     int ap;
1023     int domain;
1024     uint32_t phys_addr;
1025
1026     /* Pagetable walk.  */
1027     /* Lookup l1 descriptor.  */
1028     table = get_level1_table_address(env, address);
1029     desc = ldl_phys(table);
1030     type = (desc & 3);
1031     if (type == 0) {
1032         /* Section translation fault.  */
1033         code = 5;
1034         domain = 0;
1035         goto do_fault;
1036     } else if (type == 2 && (desc & (1 << 18))) {
1037         /* Supersection.  */
1038         domain = 0;
1039     } else {
1040         /* Section or page.  */
1041         domain = (desc >> 4) & 0x1e;
1042     }
1043     domain = (env->cp15.c3 >> domain) & 3;
1044     if (domain == 0 || domain == 2) {
1045         if (type == 2)
1046             code = 9; /* Section domain fault.  */
1047         else
1048             code = 11; /* Page domain fault.  */
1049         goto do_fault;
1050     }
1051     if (type == 2) {
1052         if (desc & (1 << 18)) {
1053             /* Supersection.  */
1054             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1055         } else {
1056             /* Section.  */
1057             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1058         }
1059         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1060         xn = desc & (1 << 4);
1061         code = 13;
1062     } else {
1063         /* Lookup l2 entry.  */
1064         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1065         desc = ldl_phys(table);
1066         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1067         switch (desc & 3) {
1068         case 0: /* Page translation fault.  */
1069             code = 7;
1070             goto do_fault;
1071         case 1: /* 64k page.  */
1072             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1073             xn = desc & (1 << 15);
1074             break;
1075         case 2: case 3: /* 4k page.  */
1076             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1077             xn = desc & 1;
1078             break;
1079         default:
1080             /* Never happens, but compiler isn't smart enough to tell.  */
1081             abort();
1082         }
1083         code = 15;
1084     }
1085     if (xn && access_type == 2)
1086         goto do_fault;
1087
1088     *prot = check_ap(env, ap, domain, access_type, is_user);
1089     if (!*prot) {
1090         /* Access permission fault.  */
1091         goto do_fault;
1092     }
1093     *phys_ptr = phys_addr;
1094     return 0;
1095 do_fault:
1096     return code | (domain << 4);
1097 }
1098
1099 static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
1100                              int is_user, uint32_t *phys_ptr, int *prot)
1101 {
1102     int n;
1103     uint32_t mask;
1104     uint32_t base;
1105
1106     *phys_ptr = address;
1107     for (n = 7; n >= 0; n--) {
1108         base = env->cp15.c6_region[n];
1109         if ((base & 1) == 0)
1110             continue;
1111         mask = 1 << ((base >> 1) & 0x1f);
1112         /* Keep this shift separate from the above to avoid an
1113            (undefined) << 32.  */
1114         mask = (mask << 1) - 1;
1115         if (((base ^ address) & ~mask) == 0)
1116             break;
1117     }
1118     if (n < 0)
1119         return 2;
1120
1121     if (access_type == 2) {
1122         mask = env->cp15.c5_insn;
1123     } else {
1124         mask = env->cp15.c5_data;
1125     }
1126     mask = (mask >> (n * 4)) & 0xf;
1127     switch (mask) {
1128     case 0:
1129         return 1;
1130     case 1:
1131         if (is_user)
1132           return 1;
1133         *prot = PAGE_READ | PAGE_WRITE;
1134         break;
1135     case 2:
1136         *prot = PAGE_READ;
1137         if (!is_user)
1138             *prot |= PAGE_WRITE;
1139         break;
1140     case 3:
1141         *prot = PAGE_READ | PAGE_WRITE;
1142         break;
1143     case 5:
1144         if (is_user)
1145             return 1;
1146         *prot = PAGE_READ;
1147         break;
1148     case 6:
1149         *prot = PAGE_READ;
1150         break;
1151     default:
1152         /* Bad permission.  */
1153         return 1;
1154     }
1155     return 0;
1156 }
1157
1158 static inline int get_phys_addr(CPUState *env, uint32_t address,
1159                                 int access_type, int is_user,
1160                                 uint32_t *phys_ptr, int *prot)
1161 {
1162     /* Fast Context Switch Extension.  */
1163     if (address < 0x02000000)
1164         address += env->cp15.c13_fcse;
1165
1166     if ((env->cp15.c1_sys & 1) == 0) {
1167         /* MMU/MPU disabled.  */
1168         *phys_ptr = address;
1169         *prot = PAGE_READ | PAGE_WRITE;
1170         return 0;
1171     } else if (arm_feature(env, ARM_FEATURE_MPU)) {
1172         return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
1173                                  prot);
1174     } else if (env->cp15.c1_sys & (1 << 23)) {
1175         return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
1176                                 prot);
1177     } else {
1178         return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
1179                                 prot);
1180     }
1181 }
1182
1183 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
1184                               int access_type, int mmu_idx, int is_softmmu)
1185 {
1186     uint32_t phys_addr;
1187     int prot;
1188     int ret, is_user;
1189
1190     is_user = mmu_idx == MMU_USER_IDX;
1191     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
1192     if (ret == 0) {
1193         /* Map a single [sub]page.  */
1194         phys_addr &= ~(uint32_t)0x3ff;
1195         address &= ~(uint32_t)0x3ff;
1196         return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
1197                              is_softmmu);
1198     }
1199
1200     if (access_type == 2) {
1201         env->cp15.c5_insn = ret;
1202         env->cp15.c6_insn = address;
1203         env->exception_index = EXCP_PREFETCH_ABORT;
1204     } else {
1205         env->cp15.c5_data = ret;
1206         if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
1207             env->cp15.c5_data |= (1 << 11);
1208         env->cp15.c6_data = address;
1209         env->exception_index = EXCP_DATA_ABORT;
1210     }
1211     return 1;
1212 }
1213
1214 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
1215 {
1216     uint32_t phys_addr;
1217     int prot;
1218     int ret;
1219
1220     ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
1221
1222     if (ret != 0)
1223         return -1;
1224
1225     return phys_addr;
1226 }
1227
1228 /* Not really implemented.  Need to figure out a sane way of doing this.
1229    Maybe add generic watchpoint support and use that.  */
1230
1231 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
1232 {
1233     env->mmon_addr = addr;
1234 }
1235
1236 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
1237 {
1238     return (env->mmon_addr != addr);
1239 }
1240
1241 void HELPER(clrex)(CPUState *env)
1242 {
1243     env->mmon_addr = -1;
1244 }
1245
1246 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
1247 {
1248     int cp_num = (insn >> 8) & 0xf;
1249     int cp_info = (insn >> 5) & 7;
1250     int src = (insn >> 16) & 0xf;
1251     int operand = insn & 0xf;
1252
1253     if (env->cp[cp_num].cp_write)
1254         env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
1255                                  cp_info, src, operand, val);
1256 }
1257
1258 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
1259 {
1260     int cp_num = (insn >> 8) & 0xf;
1261     int cp_info = (insn >> 5) & 7;
1262     int dest = (insn >> 16) & 0xf;
1263     int operand = insn & 0xf;
1264
1265     if (env->cp[cp_num].cp_read)
1266         return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
1267                                        cp_info, dest, operand);
1268     return 0;
1269 }
1270
1271 /* Return basic MPU access permission bits.  */
1272 static uint32_t simple_mpu_ap_bits(uint32_t val)
1273 {
1274     uint32_t ret;
1275     uint32_t mask;
1276     int i;
1277     ret = 0;
1278     mask = 3;
1279     for (i = 0; i < 16; i += 2) {
1280         ret |= (val >> i) & mask;
1281         mask <<= 2;
1282     }
1283     return ret;
1284 }
1285
1286 /* Pad basic MPU access permission bits to extended format.  */
1287 static uint32_t extended_mpu_ap_bits(uint32_t val)
1288 {
1289     uint32_t ret;
1290     uint32_t mask;
1291     int i;
1292     ret = 0;
1293     mask = 3;
1294     for (i = 0; i < 16; i += 2) {
1295         ret |= (val & mask) << i;
1296         mask <<= 2;
1297     }
1298     return ret;
1299 }
1300
1301 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
1302 {
1303     int op1;
1304     int op2;
1305     int crm;
1306
1307     op1 = (insn >> 21) & 7;
1308     op2 = (insn >> 5) & 7;
1309     crm = insn & 0xf;
1310     switch ((insn >> 16) & 0xf) {
1311     case 0:
1312         if (((insn >> 21) & 7) == 2) {
1313             /* ??? Select cache level.  Ignore.  */
1314             return;
1315         }
1316         /* ID codes.  */
1317         if (arm_feature(env, ARM_FEATURE_XSCALE))
1318             break;
1319         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1320             break;
1321         goto bad_reg;
1322     case 1: /* System configuration.  */
1323         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1324             op2 = 0;
1325         switch (op2) {
1326         case 0:
1327             if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
1328                 env->cp15.c1_sys = val;
1329             /* ??? Lots of these bits are not implemented.  */
1330             /* This may enable/disable the MMU, so do a TLB flush.  */
1331             tlb_flush(env, 1);
1332             break;
1333         case 1: /* Auxiliary cotrol register.  */
1334             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1335                 env->cp15.c1_xscaleauxcr = val;
1336                 break;
1337             }
1338             /* Not implemented.  */
1339             break;
1340         case 2:
1341             if (arm_feature(env, ARM_FEATURE_XSCALE))
1342                 goto bad_reg;
1343             if (env->cp15.c1_coproc != val) {
1344                 env->cp15.c1_coproc = val;
1345                 /* ??? Is this safe when called from within a TB?  */
1346                 tb_flush(env);
1347             }
1348             break;
1349         default:
1350             goto bad_reg;
1351         }
1352         break;
1353     case 2: /* MMU Page table control / MPU cache control.  */
1354         if (arm_feature(env, ARM_FEATURE_MPU)) {
1355             switch (op2) {
1356             case 0:
1357                 env->cp15.c2_data = val;
1358                 break;
1359             case 1:
1360                 env->cp15.c2_insn = val;
1361                 break;
1362             default:
1363                 goto bad_reg;
1364             }
1365         } else {
1366             switch (op2) {
1367             case 0:
1368                 env->cp15.c2_base0 = val;
1369                 break;
1370             case 1:
1371                 env->cp15.c2_base1 = val;
1372                 break;
1373             case 2:
1374                 val &= 7;
1375                 env->cp15.c2_control = val;
1376                 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
1377                 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> val);
1378                 break;
1379             default:
1380                 goto bad_reg;
1381             }
1382         }
1383         break;
1384     case 3: /* MMU Domain access control / MPU write buffer control.  */
1385         env->cp15.c3 = val;
1386         tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
1387         break;
1388     case 4: /* Reserved.  */
1389         goto bad_reg;
1390     case 5: /* MMU Fault status / MPU access permission.  */
1391         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1392             op2 = 0;
1393         switch (op2) {
1394         case 0:
1395             if (arm_feature(env, ARM_FEATURE_MPU))
1396                 val = extended_mpu_ap_bits(val);
1397             env->cp15.c5_data = val;
1398             break;
1399         case 1:
1400             if (arm_feature(env, ARM_FEATURE_MPU))
1401                 val = extended_mpu_ap_bits(val);
1402             env->cp15.c5_insn = val;
1403             break;
1404         case 2:
1405             if (!arm_feature(env, ARM_FEATURE_MPU))
1406                 goto bad_reg;
1407             env->cp15.c5_data = val;
1408             break;
1409         case 3:
1410             if (!arm_feature(env, ARM_FEATURE_MPU))
1411                 goto bad_reg;
1412             env->cp15.c5_insn = val;
1413             break;
1414         default:
1415             goto bad_reg;
1416         }
1417         break;
1418     case 6: /* MMU Fault address / MPU base/size.  */
1419         if (arm_feature(env, ARM_FEATURE_MPU)) {
1420             if (crm >= 8)
1421                 goto bad_reg;
1422             env->cp15.c6_region[crm] = val;
1423         } else {
1424             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1425                 op2 = 0;
1426             switch (op2) {
1427             case 0:
1428                 env->cp15.c6_data = val;
1429                 break;
1430             case 1: /* ??? This is WFAR on armv6 */
1431             case 2:
1432                 env->cp15.c6_insn = val;
1433                 break;
1434             default:
1435                 goto bad_reg;
1436             }
1437         }
1438         break;
1439     case 7: /* Cache control.  */
1440         env->cp15.c15_i_max = 0x000;
1441         env->cp15.c15_i_min = 0xff0;
1442         /* No cache, so nothing to do.  */
1443         /* ??? MPCore has VA to PA translation functions.  */
1444         break;
1445     case 8: /* MMU TLB control.  */
1446         switch (op2) {
1447         case 0: /* Invalidate all.  */
1448             tlb_flush(env, 0);
1449             break;
1450         case 1: /* Invalidate single TLB entry.  */
1451 #if 0
1452             /* ??? This is wrong for large pages and sections.  */
1453             /* As an ugly hack to make linux work we always flush a 4K
1454                pages.  */
1455             val &= 0xfffff000;
1456             tlb_flush_page(env, val);
1457             tlb_flush_page(env, val + 0x400);
1458             tlb_flush_page(env, val + 0x800);
1459             tlb_flush_page(env, val + 0xc00);
1460 #else
1461             tlb_flush(env, 1);
1462 #endif
1463             break;
1464         case 2: /* Invalidate on ASID.  */
1465             tlb_flush(env, val == 0);
1466             break;
1467         case 3: /* Invalidate single entry on MVA.  */
1468             /* ??? This is like case 1, but ignores ASID.  */
1469             tlb_flush(env, 1);
1470             break;
1471         default:
1472             goto bad_reg;
1473         }
1474         break;
1475     case 9:
1476         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1477             break;
1478         switch (crm) {
1479         case 0: /* Cache lockdown.  */
1480             switch (op1) {
1481             case 0: /* L1 cache.  */
1482                 switch (op2) {
1483                 case 0:
1484                     env->cp15.c9_data = val;
1485                     break;
1486                 case 1:
1487                     env->cp15.c9_insn = val;
1488                     break;
1489                 default:
1490                     goto bad_reg;
1491                 }
1492                 break;
1493             case 1: /* L2 cache.  */
1494                 /* Ignore writes to L2 lockdown/auxiliary registers.  */
1495                 break;
1496             default:
1497                 goto bad_reg;
1498             }
1499             break;
1500         case 1: /* TCM memory region registers.  */
1501             /* Not implemented.  */
1502             goto bad_reg;
1503         default:
1504             goto bad_reg;
1505         }
1506         break;
1507     case 10: /* MMU TLB lockdown.  */
1508         /* ??? TLB lockdown not implemented.  */
1509         break;
1510     case 12: /* Reserved.  */
1511         goto bad_reg;
1512     case 13: /* Process ID.  */
1513         switch (op2) {
1514         case 0:
1515             /* Unlike real hardware the qemu TLB uses virtual addresses,
1516                not modified virtual addresses, so this causes a TLB flush.
1517              */
1518             if (env->cp15.c13_fcse != val)
1519               tlb_flush(env, 1);
1520             env->cp15.c13_fcse = val;
1521             break;
1522         case 1:
1523             /* This changes the ASID, so do a TLB flush.  */
1524             if (env->cp15.c13_context != val
1525                 && !arm_feature(env, ARM_FEATURE_MPU))
1526               tlb_flush(env, 0);
1527             env->cp15.c13_context = val;
1528             break;
1529         case 2:
1530             env->cp15.c13_tls1 = val;
1531             break;
1532         case 3:
1533             env->cp15.c13_tls2 = val;
1534             break;
1535         case 4:
1536             env->cp15.c13_tls3 = val;
1537             break;
1538         default:
1539             goto bad_reg;
1540         }
1541         break;
1542     case 14: /* Reserved.  */
1543         goto bad_reg;
1544     case 15: /* Implementation specific.  */
1545         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1546             if (op2 == 0 && crm == 1) {
1547                 if (env->cp15.c15_cpar != (val & 0x3fff)) {
1548                     /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
1549                     tb_flush(env);
1550                     env->cp15.c15_cpar = val & 0x3fff;
1551                 }
1552                 break;
1553             }
1554             goto bad_reg;
1555         }
1556         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1557             switch (crm) {
1558             case 0:
1559                 break;
1560             case 1: /* Set TI925T configuration.  */
1561                 env->cp15.c15_ticonfig = val & 0xe7;
1562                 env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
1563                         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1564                 break;
1565             case 2: /* Set I_max.  */
1566                 env->cp15.c15_i_max = val;
1567                 break;
1568             case 3: /* Set I_min.  */
1569                 env->cp15.c15_i_min = val;
1570                 break;
1571             case 4: /* Set thread-ID.  */
1572                 env->cp15.c15_threadid = val & 0xffff;
1573                 break;
1574             case 8: /* Wait-for-interrupt (deprecated).  */
1575                 cpu_interrupt(env, CPU_INTERRUPT_HALT);
1576                 break;
1577             default:
1578                 goto bad_reg;
1579             }
1580         }
1581         break;
1582     }
1583     return;
1584 bad_reg:
1585     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1586     cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
1587               (insn >> 16) & 0xf, crm, op1, op2);
1588 }
1589
1590 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
1591 {
1592     int op1;
1593     int op2;
1594     int crm;
1595
1596     op1 = (insn >> 21) & 7;
1597     op2 = (insn >> 5) & 7;
1598     crm = insn & 0xf;
1599     switch ((insn >> 16) & 0xf) {
1600     case 0: /* ID codes.  */
1601         switch (op1) {
1602         case 0:
1603             switch (crm) {
1604             case 0:
1605                 switch (op2) {
1606                 case 0: /* Device ID.  */
1607                     return env->cp15.c0_cpuid;
1608                 case 1: /* Cache Type.  */
1609                     return env->cp15.c0_cachetype;
1610                 case 2: /* TCM status.  */
1611                     return 0;
1612                 case 3: /* TLB type register.  */
1613                     return 0; /* No lockable TLB entries.  */
1614                 case 5: /* CPU ID */
1615                     return env->cpu_index;
1616                 default:
1617                     goto bad_reg;
1618                 }
1619             case 1:
1620                 if (!arm_feature(env, ARM_FEATURE_V6))
1621                     goto bad_reg;
1622                 return env->cp15.c0_c1[op2];
1623             case 2:
1624                 if (!arm_feature(env, ARM_FEATURE_V6))
1625                     goto bad_reg;
1626                 return env->cp15.c0_c2[op2];
1627             case 3: case 4: case 5: case 6: case 7:
1628                 return 0;
1629             default:
1630                 goto bad_reg;
1631             }
1632         case 1:
1633             /* These registers aren't documented on arm11 cores.  However
1634                Linux looks at them anyway.  */
1635             if (!arm_feature(env, ARM_FEATURE_V6))
1636                 goto bad_reg;
1637             if (crm != 0)
1638                 goto bad_reg;
1639             if (arm_feature(env, ARM_FEATURE_XSCALE))
1640                 goto bad_reg;
1641             return 0;
1642         default:
1643             goto bad_reg;
1644         }
1645     case 1: /* System configuration.  */
1646         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1647             op2 = 0;
1648         switch (op2) {
1649         case 0: /* Control register.  */
1650             return env->cp15.c1_sys;
1651         case 1: /* Auxiliary control register.  */
1652             if (arm_feature(env, ARM_FEATURE_XSCALE))
1653                 return env->cp15.c1_xscaleauxcr;
1654             if (!arm_feature(env, ARM_FEATURE_AUXCR))
1655                 goto bad_reg;
1656             switch (ARM_CPUID(env)) {
1657             case ARM_CPUID_ARM1026:
1658                 return 1;
1659             case ARM_CPUID_ARM1136:
1660             case ARM_CPUID_ARM1136_R2:
1661                 return 7;
1662             case ARM_CPUID_ARM11MPCORE:
1663                 return 1;
1664             case ARM_CPUID_CORTEXA8:
1665                 return 0;
1666             default:
1667                 goto bad_reg;
1668             }
1669         case 2: /* Coprocessor access register.  */
1670             if (arm_feature(env, ARM_FEATURE_XSCALE))
1671                 goto bad_reg;
1672             return env->cp15.c1_coproc;
1673         default:
1674             goto bad_reg;
1675         }
1676     case 2: /* MMU Page table control / MPU cache control.  */
1677         if (arm_feature(env, ARM_FEATURE_MPU)) {
1678             switch (op2) {
1679             case 0:
1680                 return env->cp15.c2_data;
1681                 break;
1682             case 1:
1683                 return env->cp15.c2_insn;
1684                 break;
1685             default:
1686                 goto bad_reg;
1687             }
1688         } else {
1689             switch (op2) {
1690             case 0:
1691                 return env->cp15.c2_base0;
1692             case 1:
1693                 return env->cp15.c2_base1;
1694             case 2:
1695                 return env->cp15.c2_control;
1696             default:
1697                 goto bad_reg;
1698             }
1699         }
1700     case 3: /* MMU Domain access control / MPU write buffer control.  */
1701         return env->cp15.c3;
1702     case 4: /* Reserved.  */
1703         goto bad_reg;
1704     case 5: /* MMU Fault status / MPU access permission.  */
1705         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1706             op2 = 0;
1707         switch (op2) {
1708         case 0:
1709             if (arm_feature(env, ARM_FEATURE_MPU))
1710                 return simple_mpu_ap_bits(env->cp15.c5_data);
1711             return env->cp15.c5_data;
1712         case 1:
1713             if (arm_feature(env, ARM_FEATURE_MPU))
1714                 return simple_mpu_ap_bits(env->cp15.c5_data);
1715             return env->cp15.c5_insn;
1716         case 2:
1717             if (!arm_feature(env, ARM_FEATURE_MPU))
1718                 goto bad_reg;
1719             return env->cp15.c5_data;
1720         case 3:
1721             if (!arm_feature(env, ARM_FEATURE_MPU))
1722                 goto bad_reg;
1723             return env->cp15.c5_insn;
1724         default:
1725             goto bad_reg;
1726         }
1727     case 6: /* MMU Fault address.  */
1728         if (arm_feature(env, ARM_FEATURE_MPU)) {
1729             if (crm >= 8)
1730                 goto bad_reg;
1731             return env->cp15.c6_region[crm];
1732         } else {
1733             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1734                 op2 = 0;
1735             switch (op2) {
1736             case 0:
1737                 return env->cp15.c6_data;
1738             case 1:
1739                 if (arm_feature(env, ARM_FEATURE_V6)) {
1740                     /* Watchpoint Fault Adrress.  */
1741                     return 0; /* Not implemented.  */
1742                 } else {
1743                     /* Instruction Fault Adrress.  */
1744                     /* Arm9 doesn't have an IFAR, but implementing it anyway
1745                        shouldn't do any harm.  */
1746                     return env->cp15.c6_insn;
1747                 }
1748             case 2:
1749                 if (arm_feature(env, ARM_FEATURE_V6)) {
1750                     /* Instruction Fault Adrress.  */
1751                     return env->cp15.c6_insn;
1752                 } else {
1753                     goto bad_reg;
1754                 }
1755             default:
1756                 goto bad_reg;
1757             }
1758         }
1759     case 7: /* Cache control.  */
1760         /* FIXME: Should only clear Z flag if destination is r15.  */
1761         env->ZF = 0;
1762         return 0;
1763     case 8: /* MMU TLB control.  */
1764         goto bad_reg;
1765     case 9: /* Cache lockdown.  */
1766         switch (op1) {
1767         case 0: /* L1 cache.  */
1768             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1769                 return 0;
1770             switch (op2) {
1771             case 0:
1772                 return env->cp15.c9_data;
1773             case 1:
1774                 return env->cp15.c9_insn;
1775             default:
1776                 goto bad_reg;
1777             }
1778         case 1: /* L2 cache */
1779             if (crm != 0)
1780                 goto bad_reg;
1781             /* L2 Lockdown and Auxiliary control.  */
1782             return 0;
1783         default:
1784             goto bad_reg;
1785         }
1786     case 10: /* MMU TLB lockdown.  */
1787         /* ??? TLB lockdown not implemented.  */
1788         return 0;
1789     case 11: /* TCM DMA control.  */
1790     case 12: /* Reserved.  */
1791         goto bad_reg;
1792     case 13: /* Process ID.  */
1793         switch (op2) {
1794         case 0:
1795             return env->cp15.c13_fcse;
1796         case 1:
1797             return env->cp15.c13_context;
1798         case 2:
1799             return env->cp15.c13_tls1;
1800         case 3:
1801             return env->cp15.c13_tls2;
1802         case 4:
1803             return env->cp15.c13_tls3;
1804         default:
1805             goto bad_reg;
1806         }
1807     case 14: /* Reserved.  */
1808         goto bad_reg;
1809     case 15: /* Implementation specific.  */
1810         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1811             if (op2 == 0 && crm == 1)
1812                 return env->cp15.c15_cpar;
1813
1814             goto bad_reg;
1815         }
1816         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1817             switch (crm) {
1818             case 0:
1819                 return 0;
1820             case 1: /* Read TI925T configuration.  */
1821                 return env->cp15.c15_ticonfig;
1822             case 2: /* Read I_max.  */
1823                 return env->cp15.c15_i_max;
1824             case 3: /* Read I_min.  */
1825                 return env->cp15.c15_i_min;
1826             case 4: /* Read thread-ID.  */
1827                 return env->cp15.c15_threadid;
1828             case 8: /* TI925T_status */
1829                 return 0;
1830             }
1831             /* TODO: Peripheral port remap register:
1832              * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
1833              * controller base address at $rn & ~0xfff and map size of
1834              * 0x200 << ($rn & 0xfff), when MMU is off.  */
1835             goto bad_reg;
1836         }
1837         return 0;
1838     }
1839 bad_reg:
1840     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1841     cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
1842               (insn >> 16) & 0xf, crm, op1, op2);
1843     return 0;
1844 }
1845
1846 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
1847 {
1848     env->banked_r13[bank_number(mode)] = val;
1849 }
1850
1851 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
1852 {
1853     return env->banked_r13[bank_number(mode)];
1854 }
1855
1856 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
1857 {
1858     switch (reg) {
1859     case 0: /* APSR */
1860         return xpsr_read(env) & 0xf8000000;
1861     case 1: /* IAPSR */
1862         return xpsr_read(env) & 0xf80001ff;
1863     case 2: /* EAPSR */
1864         return xpsr_read(env) & 0xff00fc00;
1865     case 3: /* xPSR */
1866         return xpsr_read(env) & 0xff00fdff;
1867     case 5: /* IPSR */
1868         return xpsr_read(env) & 0x000001ff;
1869     case 6: /* EPSR */
1870         return xpsr_read(env) & 0x0700fc00;
1871     case 7: /* IEPSR */
1872         return xpsr_read(env) & 0x0700edff;
1873     case 8: /* MSP */
1874         return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
1875     case 9: /* PSP */
1876         return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
1877     case 16: /* PRIMASK */
1878         return (env->uncached_cpsr & CPSR_I) != 0;
1879     case 17: /* FAULTMASK */
1880         return (env->uncached_cpsr & CPSR_F) != 0;
1881     case 18: /* BASEPRI */
1882     case 19: /* BASEPRI_MAX */
1883         return env->v7m.basepri;
1884     case 20: /* CONTROL */
1885         return env->v7m.control;
1886     default:
1887         /* ??? For debugging only.  */
1888         cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
1889         return 0;
1890     }
1891 }
1892
1893 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
1894 {
1895     switch (reg) {
1896     case 0: /* APSR */
1897         xpsr_write(env, val, 0xf8000000);
1898         break;
1899     case 1: /* IAPSR */
1900         xpsr_write(env, val, 0xf8000000);
1901         break;
1902     case 2: /* EAPSR */
1903         xpsr_write(env, val, 0xfe00fc00);
1904         break;
1905     case 3: /* xPSR */
1906         xpsr_write(env, val, 0xfe00fc00);
1907         break;
1908     case 5: /* IPSR */
1909         /* IPSR bits are readonly.  */
1910         break;
1911     case 6: /* EPSR */
1912         xpsr_write(env, val, 0x0600fc00);
1913         break;
1914     case 7: /* IEPSR */
1915         xpsr_write(env, val, 0x0600fc00);
1916         break;
1917     case 8: /* MSP */
1918         if (env->v7m.current_sp)
1919             env->v7m.other_sp = val;
1920         else
1921             env->regs[13] = val;
1922         break;
1923     case 9: /* PSP */
1924         if (env->v7m.current_sp)
1925             env->regs[13] = val;
1926         else
1927             env->v7m.other_sp = val;
1928         break;
1929     case 16: /* PRIMASK */
1930         if (val & 1)
1931             env->uncached_cpsr |= CPSR_I;
1932         else
1933             env->uncached_cpsr &= ~CPSR_I;
1934         break;
1935     case 17: /* FAULTMASK */
1936         if (val & 1)
1937             env->uncached_cpsr |= CPSR_F;
1938         else
1939             env->uncached_cpsr &= ~CPSR_F;
1940         break;
1941     case 18: /* BASEPRI */
1942         env->v7m.basepri = val & 0xff;
1943         break;
1944     case 19: /* BASEPRI_MAX */
1945         val &= 0xff;
1946         if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
1947             env->v7m.basepri = val;
1948         break;
1949     case 20: /* CONTROL */
1950         env->v7m.control = val & 3;
1951         switch_v7m_sp(env, (val & 2) != 0);
1952         break;
1953     default:
1954         /* ??? For debugging only.  */
1955         cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
1956         return;
1957     }
1958 }
1959
1960 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
1961                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
1962                 void *opaque)
1963 {
1964     if (cpnum < 0 || cpnum > 14) {
1965         cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
1966         return;
1967     }
1968
1969     env->cp[cpnum].cp_read = cp_read;
1970     env->cp[cpnum].cp_write = cp_write;
1971     env->cp[cpnum].opaque = opaque;
1972 }
1973
1974 #endif
1975
1976 /* Note that signed overflow is undefined in C.  The following routines are
1977    careful to use unsigned types where modulo arithmetic is required.
1978    Failure to do so _will_ break on newer gcc.  */
1979
1980 /* Signed saturating arithmetic.  */
1981
1982 /* Perform 16-bit signed saturating addition.  */
1983 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
1984 {
1985     uint16_t res;
1986
1987     res = a + b;
1988     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
1989         if (a & 0x8000)
1990             res = 0x8000;
1991         else
1992             res = 0x7fff;
1993     }
1994     return res;
1995 }
1996
1997 /* Perform 8-bit signed saturating addition.  */
1998 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
1999 {
2000     uint8_t res;
2001
2002     res = a + b;
2003     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
2004         if (a & 0x80)
2005             res = 0x80;
2006         else
2007             res = 0x7f;
2008     }
2009     return res;
2010 }
2011
2012 /* Perform 16-bit signed saturating subtraction.  */
2013 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
2014 {
2015     uint16_t res;
2016
2017     res = a - b;
2018     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
2019         if (a & 0x8000)
2020             res = 0x8000;
2021         else
2022             res = 0x7fff;
2023     }
2024     return res;
2025 }
2026
2027 /* Perform 8-bit signed saturating subtraction.  */
2028 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
2029 {
2030     uint8_t res;
2031
2032     res = a - b;
2033     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
2034         if (a & 0x80)
2035             res = 0x80;
2036         else
2037             res = 0x7f;
2038     }
2039     return res;
2040 }
2041
2042 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
2043 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
2044 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
2045 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
2046 #define PFX q
2047
2048 #include "op_addsub.h"
2049
2050 /* Unsigned saturating arithmetic.  */
2051 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
2052 {
2053     uint16_t res;
2054     res = a + b;
2055     if (res < a)
2056         res = 0xffff;
2057     return res;
2058 }
2059
2060 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
2061 {
2062     if (a < b)
2063         return a - b;
2064     else
2065         return 0;
2066 }
2067
2068 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
2069 {
2070     uint8_t res;
2071     res = a + b;
2072     if (res < a)
2073         res = 0xff;
2074     return res;
2075 }
2076
2077 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
2078 {
2079     if (a < b)
2080         return a - b;
2081     else
2082         return 0;
2083 }
2084
2085 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
2086 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
2087 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
2088 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
2089 #define PFX uq
2090
2091 #include "op_addsub.h"
2092
2093 /* Signed modulo arithmetic.  */
2094 #define SARITH16(a, b, n, op) do { \
2095     int32_t sum; \
2096     sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
2097     RESULT(sum, n, 16); \
2098     if (sum >= 0) \
2099         ge |= 3 << (n * 2); \
2100     } while(0)
2101
2102 #define SARITH8(a, b, n, op) do { \
2103     int32_t sum; \
2104     sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
2105     RESULT(sum, n, 8); \
2106     if (sum >= 0) \
2107         ge |= 1 << n; \
2108     } while(0)
2109
2110
2111 #define ADD16(a, b, n) SARITH16(a, b, n, +)
2112 #define SUB16(a, b, n) SARITH16(a, b, n, -)
2113 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
2114 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
2115 #define PFX s
2116 #define ARITH_GE
2117
2118 #include "op_addsub.h"
2119
2120 /* Unsigned modulo arithmetic.  */
2121 #define ADD16(a, b, n) do { \
2122     uint32_t sum; \
2123     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
2124     RESULT(sum, n, 16); \
2125     if ((sum >> 16) == 1) \
2126         ge |= 3 << (n * 2); \
2127     } while(0)
2128
2129 #define ADD8(a, b, n) do { \
2130     uint32_t sum; \
2131     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
2132     RESULT(sum, n, 8); \
2133     if ((sum >> 8) == 1) \
2134         ge |= 1 << n; \
2135     } while(0)
2136
2137 #define SUB16(a, b, n) do { \
2138     uint32_t sum; \
2139     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
2140     RESULT(sum, n, 16); \
2141     if ((sum >> 16) == 0) \
2142         ge |= 3 << (n * 2); \
2143     } while(0)
2144
2145 #define SUB8(a, b, n) do { \
2146     uint32_t sum; \
2147     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
2148     RESULT(sum, n, 8); \
2149     if ((sum >> 8) == 0) \
2150         ge |= 1 << n; \
2151     } while(0)
2152
2153 #define PFX u
2154 #define ARITH_GE
2155
2156 #include "op_addsub.h"
2157
2158 /* Halved signed arithmetic.  */
2159 #define ADD16(a, b, n) \
2160   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
2161 #define SUB16(a, b, n) \
2162   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
2163 #define ADD8(a, b, n) \
2164   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
2165 #define SUB8(a, b, n) \
2166   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
2167 #define PFX sh
2168
2169 #include "op_addsub.h"
2170
2171 /* Halved unsigned arithmetic.  */
2172 #define ADD16(a, b, n) \
2173   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2174 #define SUB16(a, b, n) \
2175   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2176 #define ADD8(a, b, n) \
2177   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2178 #define SUB8(a, b, n) \
2179   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2180 #define PFX uh
2181
2182 #include "op_addsub.h"
2183
2184 static inline uint8_t do_usad(uint8_t a, uint8_t b)
2185 {
2186     if (a > b)
2187         return a - b;
2188     else
2189         return b - a;
2190 }
2191
2192 /* Unsigned sum of absolute byte differences.  */
2193 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
2194 {
2195     uint32_t sum;
2196     sum = do_usad(a, b);
2197     sum += do_usad(a >> 8, b >> 8);
2198     sum += do_usad(a >> 16, b >>16);
2199     sum += do_usad(a >> 24, b >> 24);
2200     return sum;
2201 }
2202
2203 /* For ARMv6 SEL instruction.  */
2204 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
2205 {
2206     uint32_t mask;
2207
2208     mask = 0;
2209     if (flags & 1)
2210         mask |= 0xff;
2211     if (flags & 2)
2212         mask |= 0xff00;
2213     if (flags & 4)
2214         mask |= 0xff0000;
2215     if (flags & 8)
2216         mask |= 0xff000000;
2217     return (a & mask) | (b & ~mask);
2218 }
2219
2220 uint32_t HELPER(logicq_cc)(uint64_t val)
2221 {
2222     return (val >> 32) | (val != 0);
2223 }
2224
2225 /* VFP support.  We follow the convention used for VFP instrunctions:
2226    Single precition routines have a "s" suffix, double precision a
2227    "d" suffix.  */
2228
2229 /* Convert host exception flags to vfp form.  */
2230 static inline int vfp_exceptbits_from_host(int host_bits)
2231 {
2232     int target_bits = 0;
2233
2234     if (host_bits & float_flag_invalid)
2235         target_bits |= 1;
2236     if (host_bits & float_flag_divbyzero)
2237         target_bits |= 2;
2238     if (host_bits & float_flag_overflow)
2239         target_bits |= 4;
2240     if (host_bits & float_flag_underflow)
2241         target_bits |= 8;
2242     if (host_bits & float_flag_inexact)
2243         target_bits |= 0x10;
2244     return target_bits;
2245 }
2246
2247 uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
2248 {
2249     int i;
2250     uint32_t fpscr;
2251
2252     fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
2253             | (env->vfp.vec_len << 16)
2254             | (env->vfp.vec_stride << 20);
2255     i = get_float_exception_flags(&env->vfp.fp_status);
2256     fpscr |= vfp_exceptbits_from_host(i);
2257     return fpscr;
2258 }
2259
2260 /* Convert vfp exception flags to target form.  */
2261 static inline int vfp_exceptbits_to_host(int target_bits)
2262 {
2263     int host_bits = 0;
2264
2265     if (target_bits & 1)
2266         host_bits |= float_flag_invalid;
2267     if (target_bits & 2)
2268         host_bits |= float_flag_divbyzero;
2269     if (target_bits & 4)
2270         host_bits |= float_flag_overflow;
2271     if (target_bits & 8)
2272         host_bits |= float_flag_underflow;
2273     if (target_bits & 0x10)
2274         host_bits |= float_flag_inexact;
2275     return host_bits;
2276 }
2277
2278 void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
2279 {
2280     int i;
2281     uint32_t changed;
2282
2283     changed = env->vfp.xregs[ARM_VFP_FPSCR];
2284     env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
2285     env->vfp.vec_len = (val >> 16) & 7;
2286     env->vfp.vec_stride = (val >> 20) & 3;
2287
2288     changed ^= val;
2289     if (changed & (3 << 22)) {
2290         i = (val >> 22) & 3;
2291         switch (i) {
2292         case 0:
2293             i = float_round_nearest_even;
2294             break;
2295         case 1:
2296             i = float_round_up;
2297             break;
2298         case 2:
2299             i = float_round_down;
2300             break;
2301         case 3:
2302             i = float_round_to_zero;
2303             break;
2304         }
2305         set_float_rounding_mode(i, &env->vfp.fp_status);
2306     }
2307
2308     i = vfp_exceptbits_to_host((val >> 8) & 0x1f);
2309     set_float_exception_flags(i, &env->vfp.fp_status);
2310     /* XXX: FZ and DN are not implemented.  */
2311 }
2312
2313 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
2314
2315 #define VFP_BINOP(name) \
2316 float32 VFP_HELPER(name, s)(float32 a, float32 b, CPUState *env) \
2317 { \
2318     return float32_ ## name (a, b, &env->vfp.fp_status); \
2319 } \
2320 float64 VFP_HELPER(name, d)(float64 a, float64 b, CPUState *env) \
2321 { \
2322     return float64_ ## name (a, b, &env->vfp.fp_status); \
2323 }
2324 VFP_BINOP(add)
2325 VFP_BINOP(sub)
2326 VFP_BINOP(mul)
2327 VFP_BINOP(div)
2328 #undef VFP_BINOP
2329
2330 float32 VFP_HELPER(neg, s)(float32 a)
2331 {
2332     return float32_chs(a);
2333 }
2334
2335 float64 VFP_HELPER(neg, d)(float64 a)
2336 {
2337     return float64_chs(a);
2338 }
2339
2340 float32 VFP_HELPER(abs, s)(float32 a)
2341 {
2342     return float32_abs(a);
2343 }
2344
2345 float64 VFP_HELPER(abs, d)(float64 a)
2346 {
2347     return float64_abs(a);
2348 }
2349
2350 float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
2351 {
2352     return float32_sqrt(a, &env->vfp.fp_status);
2353 }
2354
2355 float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
2356 {
2357     return float64_sqrt(a, &env->vfp.fp_status);
2358 }
2359
2360 /* XXX: check quiet/signaling case */
2361 #define DO_VFP_cmp(p, type) \
2362 void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
2363 { \
2364     uint32_t flags; \
2365     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
2366     case 0: flags = 0x6; break; \
2367     case -1: flags = 0x8; break; \
2368     case 1: flags = 0x2; break; \
2369     default: case 2: flags = 0x3; break; \
2370     } \
2371     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2372         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2373 } \
2374 void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
2375 { \
2376     uint32_t flags; \
2377     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
2378     case 0: flags = 0x6; break; \
2379     case -1: flags = 0x8; break; \
2380     case 1: flags = 0x2; break; \
2381     default: case 2: flags = 0x3; break; \
2382     } \
2383     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2384         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2385 }
2386 DO_VFP_cmp(s, float32)
2387 DO_VFP_cmp(d, float64)
2388 #undef DO_VFP_cmp
2389
2390 /* Helper routines to perform bitwise copies between float and int.  */
2391 static inline float32 vfp_itos(uint32_t i)
2392 {
2393     union {
2394         uint32_t i;
2395         float32 s;
2396     } v;
2397
2398     v.i = i;
2399     return v.s;
2400 }
2401
2402 static inline uint32_t vfp_stoi(float32 s)
2403 {
2404     union {
2405         uint32_t i;
2406         float32 s;
2407     } v;
2408
2409     v.s = s;
2410     return v.i;
2411 }
2412
2413 static inline float64 vfp_itod(uint64_t i)
2414 {
2415     union {
2416         uint64_t i;
2417         float64 d;
2418     } v;
2419
2420     v.i = i;
2421     return v.d;
2422 }
2423
2424 static inline uint64_t vfp_dtoi(float64 d)
2425 {
2426     union {
2427         uint64_t i;
2428         float64 d;
2429     } v;
2430
2431     v.d = d;
2432     return v.i;
2433 }
2434
2435 /* Integer to float conversion.  */
2436 float32 VFP_HELPER(uito, s)(float32 x, CPUState *env)
2437 {
2438     return uint32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2439 }
2440
2441 float64 VFP_HELPER(uito, d)(float32 x, CPUState *env)
2442 {
2443     return uint32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2444 }
2445
2446 float32 VFP_HELPER(sito, s)(float32 x, CPUState *env)
2447 {
2448     return int32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2449 }
2450
2451 float64 VFP_HELPER(sito, d)(float32 x, CPUState *env)
2452 {
2453     return int32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2454 }
2455
2456 /* Float to integer conversion.  */
2457 float32 VFP_HELPER(toui, s)(float32 x, CPUState *env)
2458 {
2459     return vfp_itos(float32_to_uint32(x, &env->vfp.fp_status));
2460 }
2461
2462 float32 VFP_HELPER(toui, d)(float64 x, CPUState *env)
2463 {
2464     return vfp_itos(float64_to_uint32(x, &env->vfp.fp_status));
2465 }
2466
2467 float32 VFP_HELPER(tosi, s)(float32 x, CPUState *env)
2468 {
2469     return vfp_itos(float32_to_int32(x, &env->vfp.fp_status));
2470 }
2471
2472 float32 VFP_HELPER(tosi, d)(float64 x, CPUState *env)
2473 {
2474     return vfp_itos(float64_to_int32(x, &env->vfp.fp_status));
2475 }
2476
2477 float32 VFP_HELPER(touiz, s)(float32 x, CPUState *env)
2478 {
2479     return vfp_itos(float32_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2480 }
2481
2482 float32 VFP_HELPER(touiz, d)(float64 x, CPUState *env)
2483 {
2484     return vfp_itos(float64_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2485 }
2486
2487 float32 VFP_HELPER(tosiz, s)(float32 x, CPUState *env)
2488 {
2489     return vfp_itos(float32_to_int32_round_to_zero(x, &env->vfp.fp_status));
2490 }
2491
2492 float32 VFP_HELPER(tosiz, d)(float64 x, CPUState *env)
2493 {
2494     return vfp_itos(float64_to_int32_round_to_zero(x, &env->vfp.fp_status));
2495 }
2496
2497 /* floating point conversion */
2498 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
2499 {
2500     return float32_to_float64(x, &env->vfp.fp_status);
2501 }
2502
2503 float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
2504 {
2505     return float64_to_float32(x, &env->vfp.fp_status);
2506 }
2507
2508 /* VFP3 fixed point conversion.  */
2509 #define VFP_CONV_FIX(name, p, ftype, itype, sign) \
2510 ftype VFP_HELPER(name##to, p)(ftype x, uint32_t shift, CPUState *env) \
2511 { \
2512     ftype tmp; \
2513     tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(x), \
2514                                   &env->vfp.fp_status); \
2515     return ftype##_scalbn(tmp, shift, &env->vfp.fp_status); \
2516 } \
2517 ftype VFP_HELPER(to##name, p)(ftype x, uint32_t shift, CPUState *env) \
2518 { \
2519     ftype tmp; \
2520     tmp = ftype##_scalbn(x, shift, &env->vfp.fp_status); \
2521     return vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
2522         &env->vfp.fp_status)); \
2523 }
2524
2525 VFP_CONV_FIX(sh, d, float64, int16, )
2526 VFP_CONV_FIX(sl, d, float64, int32, )
2527 VFP_CONV_FIX(uh, d, float64, uint16, u)
2528 VFP_CONV_FIX(ul, d, float64, uint32, u)
2529 VFP_CONV_FIX(sh, s, float32, int16, )
2530 VFP_CONV_FIX(sl, s, float32, int32, )
2531 VFP_CONV_FIX(uh, s, float32, uint16, u)
2532 VFP_CONV_FIX(ul, s, float32, uint32, u)
2533 #undef VFP_CONV_FIX
2534
2535 float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
2536 {
2537     float_status *s = &env->vfp.fp_status;
2538     float32 two = int32_to_float32(2, s);
2539     return float32_sub(two, float32_mul(a, b, s), s);
2540 }
2541
2542 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
2543 {
2544     float_status *s = &env->vfp.fp_status;
2545     float32 three = int32_to_float32(3, s);
2546     return float32_sub(three, float32_mul(a, b, s), s);
2547 }
2548
2549 /* NEON helpers.  */
2550
2551 /* TODO: The architecture specifies the value that the estimate functions
2552    should return.  We return the exact reciprocal/root instead.  */
2553 float32 HELPER(recpe_f32)(float32 a, CPUState *env)
2554 {
2555     float_status *s = &env->vfp.fp_status;
2556     float32 one = int32_to_float32(1, s);
2557     return float32_div(one, a, s);
2558 }
2559
2560 float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
2561 {
2562     float_status *s = &env->vfp.fp_status;
2563     float32 one = int32_to_float32(1, s);
2564     return float32_div(one, float32_sqrt(a, s), s);
2565 }
2566
2567 uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
2568 {
2569     float_status *s = &env->vfp.fp_status;
2570     float32 tmp;
2571     tmp = int32_to_float32(a, s);
2572     tmp = float32_scalbn(tmp, -32, s);
2573     tmp = helper_recpe_f32(tmp, env);
2574     tmp = float32_scalbn(tmp, 31, s);
2575     return float32_to_int32(tmp, s);
2576 }
2577
2578 uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
2579 {
2580     float_status *s = &env->vfp.fp_status;
2581     float32 tmp;
2582     tmp = int32_to_float32(a, s);
2583     tmp = float32_scalbn(tmp, -32, s);
2584     tmp = helper_rsqrte_f32(tmp, env);
2585     tmp = float32_scalbn(tmp, 31, s);
2586     return float32_to_int32(tmp, s);
2587 }