target-arm/helper.c

   1 #include <stdio.h>
   2 #include <stdlib.h>
   3 #include <string.h>
   4
   5 #include "cpu.h"
   6 #include "exec-all.h"
   7 #include "gdbstub.h"
   8 #include "helpers.h"
   9 #include "qemu-common.h"
  10
  11 static uint32_t cortexa8_cp15_c0_c1[8] =
  12 { 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
  13
  14 static uint32_t cortexa8_cp15_c0_c2[8] =
  15 { 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
  16
  17 static uint32_t mpcore_cp15_c0_c1[8] =
  18 { 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
  19
  20 static uint32_t mpcore_cp15_c0_c2[8] =
  21 { 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
  22
  23 static uint32_t arm1136_cp15_c0_c1[8] =
  24 { 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
  25
  26 static uint32_t arm1136_cp15_c0_c2[8] =
  27 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
  28
  29 static uint32_t cpu_arm_find_by_name(const char *name);
  30
  31 static inline void set_feature(CPUARMState *env, int feature)
  32 {
  33     env->features |= 1u << feature;
  34 }
  35
  36 static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
  37 {
  38     env->cp15.c0_cpuid = id;
  39     switch (id) {
  40     case ARM_CPUID_ARM920T:
  41         set_feature(env, ARM_FEATURE_S3C);
  42         env->cp15.c0_cachetype = 0xd172172;
  43         env->cp15.c1_sys = 0x00000078;
  44         break;
  45     case ARM_CPUID_ARM926:
  46         set_feature(env, ARM_FEATURE_VFP);
  47         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
  48         env->cp15.c0_cachetype = 0x1dd20d2;
  49         env->cp15.c1_sys = 0x00090078;
  50         break;
  51     case ARM_CPUID_ARM946:
  52         set_feature(env, ARM_FEATURE_MPU);
  53         env->cp15.c0_cachetype = 0x0f004006;
  54         env->cp15.c1_sys = 0x00000078;
  55         break;
  56     case ARM_CPUID_ARM1026:
  57         set_feature(env, ARM_FEATURE_VFP);
  58         set_feature(env, ARM_FEATURE_AUXCR);
  59         env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
  60         env->cp15.c0_cachetype = 0x1dd20d2;
  61         env->cp15.c1_sys = 0x00090078;
  62         break;
  63     case ARM_CPUID_ARM1136_R2:
  64     case ARM_CPUID_ARM1136:
  65         set_feature(env, ARM_FEATURE_V6);
  66         set_feature(env, ARM_FEATURE_VFP);
  67         set_feature(env, ARM_FEATURE_AUXCR);
  68         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  69         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  70         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  71         memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
  72         memcpy(env->cp15.c0_c2, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
  73         env->cp15.c0_cachetype = 0x1dd20d2;
  74         break;
  75     case ARM_CPUID_ARM11MPCORE:
  76         set_feature(env, ARM_FEATURE_V6);
  77         set_feature(env, ARM_FEATURE_V6K);
  78         set_feature(env, ARM_FEATURE_VFP);
  79         set_feature(env, ARM_FEATURE_AUXCR);
  80         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  81         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  82         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  83         memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
  84         memcpy(env->cp15.c0_c2, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
  85         env->cp15.c0_cachetype = 0x1dd20d2;
  86         break;
  87     case ARM_CPUID_CORTEXA8:
  88         set_feature(env, ARM_FEATURE_V6);
  89         set_feature(env, ARM_FEATURE_V6K);
  90         set_feature(env, ARM_FEATURE_V7);
  91         set_feature(env, ARM_FEATURE_AUXCR);
  92         set_feature(env, ARM_FEATURE_THUMB2);
  93         set_feature(env, ARM_FEATURE_VFP);
  94         set_feature(env, ARM_FEATURE_VFP3);
  95         set_feature(env, ARM_FEATURE_NEON);
  96         set_feature(env, ARM_FEATURE_THUMB2EE);
  97         env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
  98         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
  99         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
 100         memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
 101         memcpy(env->cp15.c0_c2, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
 102         env->cp15.c0_cachetype = 0x82048004;
 103         env->cp15.c0_clid = (1 << 27) | (2 << 24) | 3;
 104         env->cp15.c0_ccsid[0] = 0xe007e01a; /* 16k L1 dcache. */
 105         env->cp15.c0_ccsid[1] = 0x2007e01a; /* 16k L1 icache. */
 106         env->cp15.c0_ccsid[2] = 0xf0000000; /* No L2 icache. */
 107         break;
 108     case ARM_CPUID_CORTEXM3:
 109         set_feature(env, ARM_FEATURE_V6);
 110         set_feature(env, ARM_FEATURE_THUMB2);
 111         set_feature(env, ARM_FEATURE_V7);
 112         set_feature(env, ARM_FEATURE_M);
 113         set_feature(env, ARM_FEATURE_DIV);
 114         break;
 115     case ARM_CPUID_ANY: /* For userspace emulation.  */
 116         set_feature(env, ARM_FEATURE_V6);
 117         set_feature(env, ARM_FEATURE_V6K);
 118         set_feature(env, ARM_FEATURE_V7);
 119         set_feature(env, ARM_FEATURE_THUMB2);
 120         set_feature(env, ARM_FEATURE_VFP);
 121         set_feature(env, ARM_FEATURE_VFP3);
 122         set_feature(env, ARM_FEATURE_NEON);
 123         set_feature(env, ARM_FEATURE_THUMB2EE);
 124         set_feature(env, ARM_FEATURE_DIV);
 125         break;
 126     case ARM_CPUID_TI915T:
 127     case ARM_CPUID_TI925T:
 128         set_feature(env, ARM_FEATURE_OMAPCP);
 129         env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
 130         env->cp15.c0_cachetype = 0x5109149;
 131         env->cp15.c1_sys = 0x00000070;
 132         env->cp15.c15_i_max = 0x000;
 133         env->cp15.c15_i_min = 0xff0;
 134         break;
 135     case ARM_CPUID_PXA250:
 136     case ARM_CPUID_PXA255:
 137     case ARM_CPUID_PXA260:
 138     case ARM_CPUID_PXA261:
 139     case ARM_CPUID_PXA262:
 140         set_feature(env, ARM_FEATURE_XSCALE);
 141         /* JTAG_ID is ((id << 28) | 0x09265013) */
 142         env->cp15.c0_cachetype = 0xd172172;
 143         env->cp15.c1_sys = 0x00000078;
 144         break;
 145     case ARM_CPUID_PXA270_A0:
 146     case ARM_CPUID_PXA270_A1:
 147     case ARM_CPUID_PXA270_B0:
 148     case ARM_CPUID_PXA270_B1:
 149     case ARM_CPUID_PXA270_C0:
 150     case ARM_CPUID_PXA270_C5:
 151         set_feature(env, ARM_FEATURE_XSCALE);
 152         /* JTAG_ID is ((id << 28) | 0x09265013) */
 153         set_feature(env, ARM_FEATURE_IWMMXT);
 154         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
 155         env->cp15.c0_cachetype = 0xd172172;
 156         env->cp15.c1_sys = 0x00000078;
 157         break;
 158     default:
 159         cpu_abort(env, "Bad CPU ID: %x\n", id);
 160         break;
 161     }
 162 }
 163
 164 void cpu_reset(CPUARMState *env)
 165 {
 166     uint32_t id;
 167
 168     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
 169         qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
 170         log_cpu_state(env, 0);
 171     }
 172
 173     id = env->cp15.c0_cpuid;
 174     memset(env, 0, offsetof(CPUARMState, breakpoints));
 175     if (id)
 176         cpu_reset_model_id(env, id);
 177 #if defined (CONFIG_USER_ONLY)
 178     env->uncached_cpsr = ARM_CPU_MODE_USR;
 179     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
 180 #else
 181     /* SVC mode with interrupts disabled.  */
 182     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
 183     /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
 184        clear at reset.  */
 185     if (IS_M(env))
 186         env->uncached_cpsr &= ~CPSR_I;
 187     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 188     env->cp15.c2_base_mask = 0xffffc000u;
 189 #endif
 190     env->regs[15] = 0;
 191     tlb_flush(env, 1);
 192 }
 193
 194 static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
 195 {
 196     int nregs;
 197
 198     /* VFP data registers are always little-endian.  */
 199     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 200     if (reg < nregs) {
 201         stfq_le_p(buf, env->vfp.regs[reg]);
 202         return 8;
 203     }
 204     if (arm_feature(env, ARM_FEATURE_NEON)) {
 205         /* Aliases for Q regs.  */
 206         nregs += 16;
 207         if (reg < nregs) {
 208             stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 209             stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 210             return 16;
 211         }
 212     }
 213     switch (reg - nregs) {
 214     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
 215     case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
 216     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
 217     }
 218     return 0;
 219 }
 220
 221 static int vfp_gdb_set_reg(CPUState *env, uint8_t *buf, int reg)
 222 {
 223     int nregs;
 224
 225     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 226     if (reg < nregs) {
 227         env->vfp.regs[reg] = ldfq_le_p(buf);
 228         return 8;
 229     }
 230     if (arm_feature(env, ARM_FEATURE_NEON)) {
 231         nregs += 16;
 232         if (reg < nregs) {
 233             env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
 234             env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
 235             return 16;
 236         }
 237     }
 238     switch (reg - nregs) {
 239     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
 240     case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
 241     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf); return 4;
 242     }
 243     return 0;
 244 }
 245
 246 CPUARMState *cpu_arm_init(const char *cpu_model)
 247 {
 248     CPUARMState *env;
 249     uint32_t id;
 250     static int inited = 0;
 251
 252     id = cpu_arm_find_by_name(cpu_model);
 253     if (id == 0)
 254         return NULL;
 255     env = qemu_mallocz(sizeof(CPUARMState));
 256     cpu_exec_init(env);
 257     if (!inited) {
 258         inited = 1;
 259         arm_translate_init();
 260     }
 261
 262     env->cpu_model_str = cpu_model;
 263     env->cp15.c0_cpuid = id;
 264     cpu_reset(env);
 265     if (arm_feature(env, ARM_FEATURE_NEON)) {
 266         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 267                                  51, "arm-neon.xml", 0);
 268     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
 269         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 270                                  35, "arm-vfp3.xml", 0);
 271     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 272         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 273                                  19, "arm-vfp.xml", 0);
 274     }
 275     return env;
 276 }
 277
 278 struct arm_cpu_t {
 279     uint32_t id;
 280     const char *name;
 281 };
 282
 283 static const struct arm_cpu_t arm_cpu_names[] = {
 284     { ARM_CPUID_ARM920T, "arm920t"},
 285     { ARM_CPUID_ARM926, "arm926"},
 286     { ARM_CPUID_ARM946, "arm946"},
 287     { ARM_CPUID_ARM1026, "arm1026"},
 288     { ARM_CPUID_ARM1136, "arm1136"},
 289     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
 290     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
 291     { ARM_CPUID_CORTEXM3, "cortex-m3"},
 292     { ARM_CPUID_CORTEXA8, "cortex-a8"},
 293     { ARM_CPUID_TI925T, "ti925t" },
 294     { ARM_CPUID_PXA250, "pxa250" },
 295     { ARM_CPUID_PXA255, "pxa255" },
 296     { ARM_CPUID_PXA260, "pxa260" },
 297     { ARM_CPUID_PXA261, "pxa261" },
 298     { ARM_CPUID_PXA262, "pxa262" },
 299     { ARM_CPUID_PXA270, "pxa270" },
 300     { ARM_CPUID_PXA270_A0, "pxa270-a0" },
 301     { ARM_CPUID_PXA270_A1, "pxa270-a1" },
 302     { ARM_CPUID_PXA270_B0, "pxa270-b0" },
 303     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
 304     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
 305     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
 306     { ARM_CPUID_ANY, "any"},
 307     { 0, NULL}
 308 };
 309
 310 void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 311 {
 312     int i;
 313
 314     (*cpu_fprintf)(f, "Available CPUs:\n");
 315     for (i = 0; arm_cpu_names[i].name; i++) {
 316         (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
 317     }
 318 }
 319
 320 /* return 0 if not found */
 321 static uint32_t cpu_arm_find_by_name(const char *name)
 322 {
 323     int i;
 324     uint32_t id;
 325
 326     id = 0;
 327     for (i = 0; arm_cpu_names[i].name; i++) {
 328         if (strcmp(name, arm_cpu_names[i].name) == 0) {
 329             id = arm_cpu_names[i].id;
 330             break;
 331         }
 332     }
 333     return id;
 334 }
 335
 336 void cpu_arm_close(CPUARMState *env)
 337 {
 338     free(env);
 339 }
 340
 341 uint32_t cpsr_read(CPUARMState *env)
 342 {
 343     int ZF;
 344     ZF = (env->ZF == 0);
 345     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
 346         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
 347         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
 348         | ((env->condexec_bits & 0xfc) << 8)
 349         | (env->GE << 16);
 350 }
 351
 352 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 353 {
 354     if (mask & CPSR_NZCV) {
 355         env->ZF = (~val) & CPSR_Z;
 356         env->NF = val;
 357         env->CF = (val >> 29) & 1;
 358         env->VF = (val << 3) & 0x80000000;
 359     }
 360     if (mask & CPSR_Q)
 361         env->QF = ((val & CPSR_Q) != 0);
 362     if (mask & CPSR_T)
 363         env->thumb = ((val & CPSR_T) != 0);
 364     if (mask & CPSR_IT_0_1) {
 365         env->condexec_bits &= ~3;
 366         env->condexec_bits |= (val >> 25) & 3;
 367     }
 368     if (mask & CPSR_IT_2_7) {
 369         env->condexec_bits &= 3;
 370         env->condexec_bits |= (val >> 8) & 0xfc;
 371     }
 372     if (mask & CPSR_GE) {
 373         env->GE = (val >> 16) & 0xf;
 374     }
 375
 376     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
 377         switch_mode(env, val & CPSR_M);
 378     }
 379     mask &= ~CACHED_CPSR_BITS;
 380     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 381 }
 382
 383 /* Sign/zero extend */
 384 uint32_t HELPER(sxtb16)(uint32_t x)
 385 {
 386     uint32_t res;
 387     res = (uint16_t)(int8_t)x;
 388     res |= (uint32_t)(int8_t)(x >> 16) << 16;
 389     return res;
 390 }
 391
 392 uint32_t HELPER(uxtb16)(uint32_t x)
 393 {
 394     uint32_t res;
 395     res = (uint16_t)(uint8_t)x;
 396     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
 397     return res;
 398 }
 399
 400 uint32_t HELPER(clz)(uint32_t x)
 401 {
 402     int count;
 403     for (count = 32; x; count--)
 404         x >>= 1;
 405     return count;
 406 }
 407
 408 int32_t HELPER(sdiv)(int32_t num, int32_t den)
 409 {
 410     if (den == 0)
 411       return 0;
 412     return num / den;
 413 }
 414
 415 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
 416 {
 417     if (den == 0)
 418       return 0;
 419     return num / den;
 420 }
 421
 422 uint32_t HELPER(rbit)(uint32_t x)
 423 {
 424     x =  ((x & 0xff000000) >> 24)
 425        | ((x & 0x00ff0000) >> 8)
 426        | ((x & 0x0000ff00) << 8)
 427        | ((x & 0x000000ff) << 24);
 428     x =  ((x & 0xf0f0f0f0) >> 4)
 429        | ((x & 0x0f0f0f0f) << 4);
 430     x =  ((x & 0x88888888) >> 3)
 431        | ((x & 0x44444444) >> 1)
 432        | ((x & 0x22222222) << 1)
 433        | ((x & 0x11111111) << 3);
 434     return x;
 435 }
 436
 437 uint32_t HELPER(abs)(uint32_t x)
 438 {
 439     return ((int32_t)x < 0) ? -x : x;
 440 }
 441
 442 #if defined(CONFIG_USER_ONLY)
 443
 444 void do_interrupt (CPUState *env)
 445 {
 446     env->exception_index = -1;
 447 }
 448
 449 /* Structure used to record exclusive memory locations.  */
 450 typedef struct mmon_state {
 451     struct mmon_state *next;
 452     CPUARMState *cpu_env;
 453     uint32_t addr;
 454 } mmon_state;
 455
 456 /* Chain of current locks.  */
 457 static mmon_state* mmon_head = NULL;
 458
 459 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 460                               int mmu_idx, int is_softmmu)
 461 {
 462     if (rw == 2) {
 463         env->exception_index = EXCP_PREFETCH_ABORT;
 464         env->cp15.c6_insn = address;
 465     } else {
 466         env->exception_index = EXCP_DATA_ABORT;
 467         env->cp15.c6_data = address;
 468     }
 469     return 1;
 470 }
 471
 472 static void allocate_mmon_state(CPUState *env)
 473 {
 474     env->mmon_entry = malloc(sizeof (mmon_state));
 475     memset (env->mmon_entry, 0, sizeof (mmon_state));
 476     env->mmon_entry->cpu_env = env;
 477     mmon_head = env->mmon_entry;
 478 }
 479
 480 /* Flush any monitor locks for the specified address.  */
 481 static void flush_mmon(uint32_t addr)
 482 {
 483     mmon_state *mon;
 484
 485     for (mon = mmon_head; mon; mon = mon->next)
 486       {
 487         if (mon->addr != addr)
 488           continue;
 489
 490         mon->addr = 0;
 491         break;
 492       }
 493 }
 494
 495 /* Mark an address for exclusive access.  */
 496 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
 497 {
 498     if (!env->mmon_entry)
 499         allocate_mmon_state(env);
 500     /* Clear any previous locks.  */
 501     flush_mmon(addr);
 502     env->mmon_entry->addr = addr;
 503 }
 504
 505 /* Test if an exclusive address is still exclusive.  Returns zero
 506    if the address is still exclusive.   */
 507 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
 508 {
 509     int res;
 510
 511     if (!env->mmon_entry)
 512         return 1;
 513     if (env->mmon_entry->addr == addr)
 514         res = 0;
 515     else
 516         res = 1;
 517     flush_mmon(addr);
 518     return res;
 519 }
 520
 521 void HELPER(clrex)(CPUState *env)
 522 {
 523     if (!(env->mmon_entry && env->mmon_entry->addr))
 524         return;
 525     flush_mmon(env->mmon_entry->addr);
 526 }
 527
 528 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 529 {
 530     return addr;
 531 }
 532
 533 /* These should probably raise undefined insn exceptions.  */
 534 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
 535 {
 536     int op1 = (insn >> 8) & 0xf;
 537     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 538     return;
 539 }
 540
 541 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
 542 {
 543     int op1 = (insn >> 8) & 0xf;
 544     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 545     return 0;
 546 }
 547
 548 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
 549 {
 550     cpu_abort(env, "cp15 insn %08x\n", insn);
 551 }
 552
 553 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 554 {
 555     cpu_abort(env, "cp15 insn %08x\n", insn);
 556     return 0;
 557 }
 558
 559 /* These should probably raise undefined insn exceptions.  */
 560 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
 561 {
 562     cpu_abort(env, "v7m_mrs %d\n", reg);
 563 }
 564
 565 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
 566 {
 567     cpu_abort(env, "v7m_mrs %d\n", reg);
 568     return 0;
 569 }
 570
 571 void switch_mode(CPUState *env, int mode)
 572 {
 573     if (mode != ARM_CPU_MODE_USR)
 574         cpu_abort(env, "Tried to switch out of user mode\n");
 575 }
 576
 577 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
 578 {
 579     cpu_abort(env, "banked r13 write\n");
 580 }
 581
 582 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
 583 {
 584     cpu_abort(env, "banked r13 read\n");
 585     return 0;
 586 }
 587
 588 #else
 589
 590 extern int semihosting_enabled;
 591
 592 /* Map CPU modes onto saved register banks.  */
 593 static inline int bank_number (int mode)
 594 {
 595     switch (mode) {
 596     case ARM_CPU_MODE_USR:
 597     case ARM_CPU_MODE_SYS:
 598         return 0;
 599     case ARM_CPU_MODE_SVC:
 600         return 1;
 601     case ARM_CPU_MODE_ABT:
 602         return 2;
 603     case ARM_CPU_MODE_UND:
 604         return 3;
 605     case ARM_CPU_MODE_IRQ:
 606         return 4;
 607     case ARM_CPU_MODE_FIQ:
 608         return 5;
 609     }
 610     cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
 611     return -1;
 612 }
 613
 614 void switch_mode(CPUState *env, int mode)
 615 {
 616     int old_mode;
 617     int i;
 618
 619     old_mode = env->uncached_cpsr & CPSR_M;
 620     if (mode == old_mode)
 621         return;
 622
 623     if (old_mode == ARM_CPU_MODE_FIQ) {
 624         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
 625         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
 626     } else if (mode == ARM_CPU_MODE_FIQ) {
 627         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
 628         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
 629     }
 630
 631     i = bank_number(old_mode);
 632     env->banked_r13[i] = env->regs[13];
 633     env->banked_r14[i] = env->regs[14];
 634     env->banked_spsr[i] = env->spsr;
 635
 636     i = bank_number(mode);
 637     env->regs[13] = env->banked_r13[i];
 638     env->regs[14] = env->banked_r14[i];
 639     env->spsr = env->banked_spsr[i];
 640 }
 641
 642 static void v7m_push(CPUARMState *env, uint32_t val)
 643 {
 644     env->regs[13] -= 4;
 645     stl_phys(env->regs[13], val);
 646 }
 647
 648 static uint32_t v7m_pop(CPUARMState *env)
 649 {
 650     uint32_t val;
 651     val = ldl_phys(env->regs[13]);
 652     env->regs[13] += 4;
 653     return val;
 654 }
 655
 656 /* Switch to V7M main or process stack pointer.  */
 657 static void switch_v7m_sp(CPUARMState *env, int process)
 658 {
 659     uint32_t tmp;
 660     if (env->v7m.current_sp != process) {
 661         tmp = env->v7m.other_sp;
 662         env->v7m.other_sp = env->regs[13];
 663         env->regs[13] = tmp;
 664         env->v7m.current_sp = process;
 665     }
 666 }
 667
 668 static void do_v7m_exception_exit(CPUARMState *env)
 669 {
 670     uint32_t type;
 671     uint32_t xpsr;
 672
 673     type = env->regs[15];
 674     if (env->v7m.exception != 0)
 675         armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
 676
 677     /* Switch to the target stack.  */
 678     switch_v7m_sp(env, (type & 4) != 0);
 679     /* Pop registers.  */
 680     env->regs[0] = v7m_pop(env);
 681     env->regs[1] = v7m_pop(env);
 682     env->regs[2] = v7m_pop(env);
 683     env->regs[3] = v7m_pop(env);
 684     env->regs[12] = v7m_pop(env);
 685     env->regs[14] = v7m_pop(env);
 686     env->regs[15] = v7m_pop(env);
 687     xpsr = v7m_pop(env);
 688     xpsr_write(env, xpsr, 0xfffffdff);
 689     /* Undo stack alignment.  */
 690     if (xpsr & 0x200)
 691         env->regs[13] |= 4;
 692     /* ??? The exception return type specifies Thread/Handler mode.  However
 693        this is also implied by the xPSR value. Not sure what to do
 694        if there is a mismatch.  */
 695     /* ??? Likewise for mismatches between the CONTROL register and the stack
 696        pointer.  */
 697 }
 698
 699 static void do_interrupt_v7m(CPUARMState *env)
 700 {
 701     uint32_t xpsr = xpsr_read(env);
 702     uint32_t lr;
 703     uint32_t addr;
 704
 705     lr = 0xfffffff1;
 706     if (env->v7m.current_sp)
 707         lr |= 4;
 708     if (env->v7m.exception == 0)
 709         lr |= 8;
 710
 711     /* For exceptions we just mark as pending on the NVIC, and let that
 712        handle it.  */
 713     /* TODO: Need to escalate if the current priority is higher than the
 714        one we're raising.  */
 715     switch (env->exception_index) {
 716     case EXCP_UDEF:
 717         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
 718         return;
 719     case EXCP_SWI:
 720         env->regs[15] += 2;
 721         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
 722         return;
 723     case EXCP_PREFETCH_ABORT:
 724     case EXCP_DATA_ABORT:
 725         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
 726         return;
 727     case EXCP_BKPT:
 728         if (semihosting_enabled) {
 729             int nr;
 730             nr = lduw_code(env->regs[15]) & 0xff;
 731             if (nr == 0xab) {
 732                 env->regs[15] += 2;
 733                 env->regs[0] = do_arm_semihosting(env);
 734                 return;
 735             }
 736         }
 737         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
 738         return;
 739     case EXCP_IRQ:
 740         env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
 741         break;
 742     case EXCP_EXCEPTION_EXIT:
 743         do_v7m_exception_exit(env);
 744         return;
 745     default:
 746         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 747         return; /* Never happens.  Keep compiler happy.  */
 748     }
 749
 750     /* Align stack pointer.  */
 751     /* ??? Should only do this if Configuration Control Register
 752        STACKALIGN bit is set.  */
 753     if (env->regs[13] & 4) {
 754         env->regs[13] -= 4;
 755         xpsr |= 0x200;
 756     }
 757     /* Switch to the handler mode.  */
 758     v7m_push(env, xpsr);
 759     v7m_push(env, env->regs[15]);
 760     v7m_push(env, env->regs[14]);
 761     v7m_push(env, env->regs[12]);
 762     v7m_push(env, env->regs[3]);
 763     v7m_push(env, env->regs[2]);
 764     v7m_push(env, env->regs[1]);
 765     v7m_push(env, env->regs[0]);
 766     switch_v7m_sp(env, 0);
 767     env->uncached_cpsr &= ~CPSR_IT;
 768     env->regs[14] = lr;
 769     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
 770     env->regs[15] = addr & 0xfffffffe;
 771     env->thumb = addr & 1;
 772 }
 773
 774 /* Handle a CPU exception.  */
 775 void do_interrupt(CPUARMState *env)
 776 {
 777     uint32_t addr;
 778     uint32_t mask;
 779     int new_mode;
 780     uint32_t offset;
 781
 782     if (IS_M(env)) {
 783         do_interrupt_v7m(env);
 784         return;
 785     }
 786     /* TODO: Vectored interrupt controller.  */
 787     switch (env->exception_index) {
 788     case EXCP_UDEF:
 789         new_mode = ARM_CPU_MODE_UND;
 790         addr = 0x04;
 791         mask = CPSR_I;
 792         if (env->thumb)
 793             offset = 2;
 794         else
 795             offset = 4;
 796         break;
 797     case EXCP_SWI:
 798         if (semihosting_enabled) {
 799             /* Check for semihosting interrupt.  */
 800             if (env->thumb) {
 801                 mask = lduw_code(env->regs[15] - 2) & 0xff;
 802             } else {
 803                 mask = ldl_code(env->regs[15] - 4) & 0xffffff;
 804             }
 805             /* Only intercept calls from privileged modes, to provide some
 806                semblance of security.  */
 807             if (((mask == 0x123456 && !env->thumb)
 808                     || (mask == 0xab && env->thumb))
 809                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 810                 env->regs[0] = do_arm_semihosting(env);
 811                 return;
 812             }
 813         }
 814         new_mode = ARM_CPU_MODE_SVC;
 815         addr = 0x08;
 816         mask = CPSR_I;
 817         /* The PC already points to the next instruction.  */
 818         offset = 0;
 819         break;
 820     case EXCP_BKPT:
 821         /* See if this is a semihosting syscall.  */
 822         if (env->thumb && semihosting_enabled) {
 823             mask = lduw_code(env->regs[15]) & 0xff;
 824             if (mask == 0xab
 825                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 826                 env->regs[15] += 2;
 827                 env->regs[0] = do_arm_semihosting(env);
 828                 return;
 829             }
 830         }
 831         /* Fall through to prefetch abort.  */
 832     case EXCP_PREFETCH_ABORT:
 833         new_mode = ARM_CPU_MODE_ABT;
 834         addr = 0x0c;
 835         mask = CPSR_A | CPSR_I;
 836         offset = 4;
 837         break;
 838     case EXCP_DATA_ABORT:
 839         new_mode = ARM_CPU_MODE_ABT;
 840         addr = 0x10;
 841         mask = CPSR_A | CPSR_I;
 842         offset = 8;
 843         break;
 844     case EXCP_IRQ:
 845         new_mode = ARM_CPU_MODE_IRQ;
 846         addr = 0x18;
 847         /* Disable IRQ and imprecise data aborts.  */
 848         mask = CPSR_A | CPSR_I;
 849         offset = 4;
 850         break;
 851     case EXCP_FIQ:
 852         new_mode = ARM_CPU_MODE_FIQ;
 853         addr = 0x1c;
 854         /* Disable FIQ, IRQ and imprecise data aborts.  */
 855         mask = CPSR_A | CPSR_I | CPSR_F;
 856         offset = 4;
 857         break;
 858     default:
 859         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 860         return; /* Never happens.  Keep compiler happy.  */
 861     }
 862     /* High vectors.  */
 863     if (env->cp15.c1_sys & (1 << 13)) {
 864         addr += 0xffff0000;
 865     }
 866     switch_mode (env, new_mode);
 867     env->spsr = cpsr_read(env);
 868     /* Clear IT bits.  */
 869     env->condexec_bits = 0;
 870     /* Switch to the new mode, and switch to Arm mode.  */
 871     /* ??? Thumb interrupt handlers not implemented.  */
 872     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
 873     env->uncached_cpsr |= mask;
 874     env->thumb = 0;
 875     env->regs[14] = env->regs[15] + offset;
 876     env->regs[15] = addr;
 877     env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 878 }
 879
 880 /* Check section/page access permissions.
 881    Returns the page protection flags, or zero if the access is not
 882    permitted.  */
 883 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
 884                            int is_user)
 885 {
 886   int prot_ro;
 887
 888   if (domain == 3)
 889     return PAGE_READ | PAGE_WRITE;
 890
 891   if (access_type == 1)
 892       prot_ro = 0;
 893   else
 894       prot_ro = PAGE_READ;
 895
 896   switch (ap) {
 897   case 0:
 898       if (access_type == 1)
 899           return 0;
 900       switch ((env->cp15.c1_sys >> 8) & 3) {
 901       case 1:
 902           return is_user ? 0 : PAGE_READ;
 903       case 2:
 904           return PAGE_READ;
 905       default:
 906           return 0;
 907       }
 908   case 1:
 909       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
 910   case 2:
 911       if (is_user)
 912           return prot_ro;
 913       else
 914           return PAGE_READ | PAGE_WRITE;
 915   case 3:
 916       return PAGE_READ | PAGE_WRITE;
 917   case 4: /* Reserved.  */
 918       return 0;
 919   case 5:
 920       return is_user ? 0 : prot_ro;
 921   case 6:
 922       return prot_ro;
 923   case 7:
 924       if (!arm_feature (env, ARM_FEATURE_V7))
 925           return 0;
 926       return prot_ro;
 927   default:
 928       abort();
 929   }
 930 }
 931
 932 static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
 933 {
 934     uint32_t table;
 935
 936     if (address & env->cp15.c2_mask)
 937         table = env->cp15.c2_base1 & 0xffffc000;
 938     else
 939         table = env->cp15.c2_base0 & env->cp15.c2_base_mask;
 940
 941     table |= (address >> 18) & 0x3ffc;
 942     return table;
 943 }
 944
 945 static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
 946                             int is_user, uint32_t *phys_ptr, int *prot)
 947 {
 948     int code;
 949     uint32_t table;
 950     uint32_t desc;
 951     int type;
 952     int ap;
 953     int domain;
 954     uint32_t phys_addr;
 955
 956     /* Pagetable walk.  */
 957     /* Lookup l1 descriptor.  */
 958     table = get_level1_table_address(env, address);
 959     desc = ldl_phys(table);
 960     type = (desc & 3);
 961     domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
 962     if (type == 0) {
 963         /* Section translation fault.  */
 964         code = 5;
 965         goto do_fault;
 966     }
 967     if (domain == 0 || domain == 2) {
 968         if (type == 2)
 969             code = 9; /* Section domain fault.  */
 970         else
 971             code = 11; /* Page domain fault.  */
 972         goto do_fault;
 973     }
 974     if (type == 2) {
 975         /* 1Mb section.  */
 976         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
 977         ap = (desc >> 10) & 3;
 978         code = 13;
 979     } else {
 980         /* Lookup l2 entry.  */
 981         if (type == 1) {
 982             /* Coarse pagetable.  */
 983             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
 984         } else {
 985             /* Fine pagetable.  */
 986             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
 987         }
 988         desc = ldl_phys(table);
 989         switch (desc & 3) {
 990         case 0: /* Page translation fault.  */
 991             code = 7;
 992             goto do_fault;
 993         case 1: /* 64k page.  */
 994             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
 995             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 996             break;
 997         case 2: /* 4k page.  */
 998             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 999             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
1000             break;
1001         case 3: /* 1k page.  */
1002             if (type == 1) {
1003                 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1004                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1005                 } else {
1006                     /* Page translation fault.  */
1007                     code = 7;
1008                     goto do_fault;
1009                 }
1010             } else {
1011                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
1012             }
1013             ap = (desc >> 4) & 3;
1014             break;
1015         default:
1016             /* Never happens, but compiler isn't smart enough to tell.  */
1017             abort();
1018         }
1019         code = 15;
1020     }
1021     *prot = check_ap(env, ap, domain, access_type, is_user);
1022     if (!*prot) {
1023         /* Access permission fault.  */
1024         goto do_fault;
1025     }
1026     *phys_ptr = phys_addr;
1027     return 0;
1028 do_fault:
1029     return code | (domain << 4);
1030 }
1031
1032 static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
1033                             int is_user, uint32_t *phys_ptr, int *prot)
1034 {
1035     int code;
1036     uint32_t table;
1037     uint32_t desc;
1038     uint32_t xn;
1039     int type;
1040     int ap;
1041     int domain;
1042     uint32_t phys_addr;
1043
1044     /* Pagetable walk.  */
1045     /* Lookup l1 descriptor.  */
1046     table = get_level1_table_address(env, address);
1047     desc = ldl_phys(table);
1048     type = (desc & 3);
1049     if (type == 0) {
1050         /* Section translation fault.  */
1051         code = 5;
1052         domain = 0;
1053         goto do_fault;
1054     } else if (type == 2 && (desc & (1 << 18))) {
1055         /* Supersection.  */
1056         domain = 0;
1057     } else {
1058         /* Section or page.  */
1059         domain = (desc >> 4) & 0x1e;
1060     }
1061     domain = (env->cp15.c3 >> domain) & 3;
1062     if (domain == 0 || domain == 2) {
1063         if (type == 2)
1064             code = 9; /* Section domain fault.  */
1065         else
1066             code = 11; /* Page domain fault.  */
1067         goto do_fault;
1068     }
1069     if (type == 2) {
1070         if (desc & (1 << 18)) {
1071             /* Supersection.  */
1072             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1073         } else {
1074             /* Section.  */
1075             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1076         }
1077         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1078         xn = desc & (1 << 4);
1079         code = 13;
1080     } else {
1081         /* Lookup l2 entry.  */
1082         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1083         desc = ldl_phys(table);
1084         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1085         switch (desc & 3) {
1086         case 0: /* Page translation fault.  */
1087             code = 7;
1088             goto do_fault;
1089         case 1: /* 64k page.  */
1090             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1091             xn = desc & (1 << 15);
1092             break;
1093         case 2: case 3: /* 4k page.  */
1094             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1095             xn = desc & 1;
1096             break;
1097         default:
1098             /* Never happens, but compiler isn't smart enough to tell.  */
1099             abort();
1100         }
1101         code = 15;
1102     }
1103     if (xn && access_type == 2)
1104         goto do_fault;
1105
1106     /* The simplified model uses AP[0] as an access control bit.  */
1107     if ((env->cp15.c1_sys & (1 << 29)) && (ap & 1) == 0) {
1108         /* Access flag fault.  */
1109         code = (code == 15) ? 6 : 3;
1110         goto do_fault;
1111     }
1112     *prot = check_ap(env, ap, domain, access_type, is_user);
1113     if (!*prot) {
1114         /* Access permission fault.  */
1115         goto do_fault;
1116     }
1117     *phys_ptr = phys_addr;
1118     return 0;
1119 do_fault:
1120     return code | (domain << 4);
1121 }
1122
1123 static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
1124                              int is_user, uint32_t *phys_ptr, int *prot)
1125 {
1126     int n;
1127     uint32_t mask;
1128     uint32_t base;
1129
1130     *phys_ptr = address;
1131     for (n = 7; n >= 0; n--) {
1132         base = env->cp15.c6_region[n];
1133         if ((base & 1) == 0)
1134             continue;
1135         mask = 1 << ((base >> 1) & 0x1f);
1136         /* Keep this shift separate from the above to avoid an
1137            (undefined) << 32.  */
1138         mask = (mask << 1) - 1;
1139         if (((base ^ address) & ~mask) == 0)
1140             break;
1141     }
1142     if (n < 0)
1143         return 2;
1144
1145     if (access_type == 2) {
1146         mask = env->cp15.c5_insn;
1147     } else {
1148         mask = env->cp15.c5_data;
1149     }
1150     mask = (mask >> (n * 4)) & 0xf;
1151     switch (mask) {
1152     case 0:
1153         return 1;
1154     case 1:
1155         if (is_user)
1156           return 1;
1157         *prot = PAGE_READ | PAGE_WRITE;
1158         break;
1159     case 2:
1160         *prot = PAGE_READ;
1161         if (!is_user)
1162             *prot |= PAGE_WRITE;
1163         break;
1164     case 3:
1165         *prot = PAGE_READ | PAGE_WRITE;
1166         break;
1167     case 5:
1168         if (is_user)
1169             return 1;
1170         *prot = PAGE_READ;
1171         break;
1172     case 6:
1173         *prot = PAGE_READ;
1174         break;
1175     default:
1176         /* Bad permission.  */
1177         return 1;
1178     }
1179     return 0;
1180 }
1181
1182 static inline int get_phys_addr(CPUState *env, uint32_t address,
1183                                 int access_type, int is_user,
1184                                 uint32_t *phys_ptr, int *prot)
1185 {
1186     /* Fast Context Switch Extension.  */
1187     if (address < 0x02000000)
1188         address += env->cp15.c13_fcse;
1189
1190     if ((env->cp15.c1_sys & 1) == 0) {
1191         /* MMU/MPU disabled.  */
1192         *phys_ptr = address;
1193         *prot = PAGE_READ | PAGE_WRITE;
1194         return 0;
1195     } else if (arm_feature(env, ARM_FEATURE_MPU)) {
1196         return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
1197                                  prot);
1198     } else if (env->cp15.c1_sys & (1 << 23)) {
1199         return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
1200                                 prot);
1201     } else {
1202         return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
1203                                 prot);
1204     }
1205 }
1206
1207 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
1208                               int access_type, int mmu_idx, int is_softmmu)
1209 {
1210     uint32_t phys_addr;
1211     int prot;
1212     int ret, is_user;
1213
1214     is_user = mmu_idx == MMU_USER_IDX;
1215     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
1216     if (ret == 0) {
1217         /* Map a single [sub]page.  */
1218         phys_addr &= ~(uint32_t)0x3ff;
1219         address &= ~(uint32_t)0x3ff;
1220         return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
1221                              is_softmmu);
1222     }
1223
1224     if (access_type == 2) {
1225         env->cp15.c5_insn = ret;
1226         env->cp15.c6_insn = address;
1227         env->exception_index = EXCP_PREFETCH_ABORT;
1228     } else {
1229         env->cp15.c5_data = ret;
1230         if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
1231             env->cp15.c5_data |= (1 << 11);
1232         env->cp15.c6_data = address;
1233         env->exception_index = EXCP_DATA_ABORT;
1234     }
1235     return 1;
1236 }
1237
1238 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
1239 {
1240     uint32_t phys_addr;
1241     int prot;
1242     int ret;
1243
1244     ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
1245
1246     if (ret != 0)
1247         return -1;
1248
1249     return phys_addr;
1250 }
1251
1252 /* Not really implemented.  Need to figure out a sane way of doing this.
1253    Maybe add generic watchpoint support and use that.  */
1254
1255 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
1256 {
1257     env->mmon_addr = addr;
1258 }
1259
1260 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
1261 {
1262     return (env->mmon_addr != addr);
1263 }
1264
1265 void HELPER(clrex)(CPUState *env)
1266 {
1267     env->mmon_addr = -1;
1268 }
1269
1270 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
1271 {
1272     int cp_num = (insn >> 8) & 0xf;
1273     int cp_info = (insn >> 5) & 7;
1274     int src = (insn >> 16) & 0xf;
1275     int operand = insn & 0xf;
1276
1277     if (env->cp[cp_num].cp_write)
1278         env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
1279                                  cp_info, src, operand, val);
1280 }
1281
1282 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
1283 {
1284     int cp_num = (insn >> 8) & 0xf;
1285     int cp_info = (insn >> 5) & 7;
1286     int dest = (insn >> 16) & 0xf;
1287     int operand = insn & 0xf;
1288
1289     if (env->cp[cp_num].cp_read)
1290         return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
1291                                        cp_info, dest, operand);
1292     return 0;
1293 }
1294
1295 /* Return basic MPU access permission bits.  */
1296 static uint32_t simple_mpu_ap_bits(uint32_t val)
1297 {
1298     uint32_t ret;
1299     uint32_t mask;
1300     int i;
1301     ret = 0;
1302     mask = 3;
1303     for (i = 0; i < 16; i += 2) {
1304         ret |= (val >> i) & mask;
1305         mask <<= 2;
1306     }
1307     return ret;
1308 }
1309
1310 /* Pad basic MPU access permission bits to extended format.  */
1311 static uint32_t extended_mpu_ap_bits(uint32_t val)
1312 {
1313     uint32_t ret;
1314     uint32_t mask;
1315     int i;
1316     ret = 0;
1317     mask = 3;
1318     for (i = 0; i < 16; i += 2) {
1319         ret |= (val & mask) << i;
1320         mask <<= 2;
1321     }
1322     return ret;
1323 }
1324
1325 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
1326 {
1327     int op1;
1328     int op2;
1329     int crm;
1330
1331     op1 = (insn >> 21) & 7;
1332     op2 = (insn >> 5) & 7;
1333     crm = insn & 0xf;
1334     switch ((insn >> 16) & 0xf) {
1335     case 0:
1336         /* ID codes.  */
1337         if (arm_feature(env, ARM_FEATURE_XSCALE))
1338             break;
1339         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1340             break;
1341         if (arm_feature(env, ARM_FEATURE_V7)
1342                 && op1 == 2 && crm == 0 && op2 == 0) {
1343             env->cp15.c0_cssel = val & 0xf;
1344             break;
1345         }
1346         goto bad_reg;
1347     case 1: /* System configuration.  */
1348         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1349             op2 = 0;
1350         switch (op2) {
1351         case 0:
1352             if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
1353                 env->cp15.c1_sys = val;
1354             /* ??? Lots of these bits are not implemented.  */
1355             /* This may enable/disable the MMU, so do a TLB flush.  */
1356             tlb_flush(env, 1);
1357             break;
1358         case 1: /* Auxiliary cotrol register.  */
1359             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1360                 env->cp15.c1_xscaleauxcr = val;
1361                 break;
1362             }
1363             /* Not implemented.  */
1364             break;
1365         case 2:
1366             if (arm_feature(env, ARM_FEATURE_XSCALE))
1367                 goto bad_reg;
1368             if (env->cp15.c1_coproc != val) {
1369                 env->cp15.c1_coproc = val;
1370                 /* ??? Is this safe when called from within a TB?  */
1371                 tb_flush(env);
1372             }
1373             break;
1374         default:
1375             goto bad_reg;
1376         }
1377         break;
1378     case 2: /* MMU Page table control / MPU cache control.  */
1379         if (arm_feature(env, ARM_FEATURE_MPU)) {
1380             switch (op2) {
1381             case 0:
1382                 env->cp15.c2_data = val;
1383                 break;
1384             case 1:
1385                 env->cp15.c2_insn = val;
1386                 break;
1387             default:
1388                 goto bad_reg;
1389             }
1390         } else {
1391             switch (op2) {
1392             case 0:
1393                 env->cp15.c2_base0 = val;
1394                 break;
1395             case 1:
1396                 env->cp15.c2_base1 = val;
1397                 break;
1398             case 2:
1399                 val &= 7;
1400                 env->cp15.c2_control = val;
1401                 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
1402                 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> val);
1403                 break;
1404             default:
1405                 goto bad_reg;
1406             }
1407         }
1408         break;
1409     case 3: /* MMU Domain access control / MPU write buffer control.  */
1410         env->cp15.c3 = val;
1411         tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
1412         break;
1413     case 4: /* Reserved.  */
1414         goto bad_reg;
1415     case 5: /* MMU Fault status / MPU access permission.  */
1416         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1417             op2 = 0;
1418         switch (op2) {
1419         case 0:
1420             if (arm_feature(env, ARM_FEATURE_MPU))
1421                 val = extended_mpu_ap_bits(val);
1422             env->cp15.c5_data = val;
1423             break;
1424         case 1:
1425             if (arm_feature(env, ARM_FEATURE_MPU))
1426                 val = extended_mpu_ap_bits(val);
1427             env->cp15.c5_insn = val;
1428             break;
1429         case 2:
1430             if (!arm_feature(env, ARM_FEATURE_MPU))
1431                 goto bad_reg;
1432             env->cp15.c5_data = val;
1433             break;
1434         case 3:
1435             if (!arm_feature(env, ARM_FEATURE_MPU))
1436                 goto bad_reg;
1437             env->cp15.c5_insn = val;
1438             break;
1439         default:
1440             goto bad_reg;
1441         }
1442         break;
1443     case 6: /* MMU Fault address / MPU base/size.  */
1444         if (arm_feature(env, ARM_FEATURE_MPU)) {
1445             if (crm >= 8)
1446                 goto bad_reg;
1447             env->cp15.c6_region[crm] = val;
1448         } else {
1449             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1450                 op2 = 0;
1451             switch (op2) {
1452             case 0:
1453                 env->cp15.c6_data = val;
1454                 break;
1455             case 1: /* ??? This is WFAR on armv6 */
1456             case 2:
1457                 env->cp15.c6_insn = val;
1458                 break;
1459             default:
1460                 goto bad_reg;
1461             }
1462         }
1463         break;
1464     case 7: /* Cache control.  */
1465         env->cp15.c15_i_max = 0x000;
1466         env->cp15.c15_i_min = 0xff0;
1467         /* No cache, so nothing to do.  */
1468         /* ??? MPCore has VA to PA translation functions.  */
1469         break;
1470     case 8: /* MMU TLB control.  */
1471         switch (op2) {
1472         case 0: /* Invalidate all.  */
1473             tlb_flush(env, 0);
1474             break;
1475         case 1: /* Invalidate single TLB entry.  */
1476 #if 0
1477             /* ??? This is wrong for large pages and sections.  */
1478             /* As an ugly hack to make linux work we always flush a 4K
1479                pages.  */
1480             val &= 0xfffff000;
1481             tlb_flush_page(env, val);
1482             tlb_flush_page(env, val + 0x400);
1483             tlb_flush_page(env, val + 0x800);
1484             tlb_flush_page(env, val + 0xc00);
1485 #else
1486             tlb_flush(env, 1);
1487 #endif
1488             break;
1489         case 2: /* Invalidate on ASID.  */
1490             tlb_flush(env, val == 0);
1491             break;
1492         case 3: /* Invalidate single entry on MVA.  */
1493             /* ??? This is like case 1, but ignores ASID.  */
1494             tlb_flush(env, 1);
1495             break;
1496         default:
1497             goto bad_reg;
1498         }
1499         break;
1500     case 9:
1501         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1502             break;
1503         switch (crm) {
1504         case 0: /* Cache lockdown.  */
1505             switch (op1) {
1506             case 0: /* L1 cache.  */
1507                 switch (op2) {
1508                 case 0:
1509                     env->cp15.c9_data = val;
1510                     break;
1511                 case 1:
1512                     env->cp15.c9_insn = val;
1513                     break;
1514                 default:
1515                     goto bad_reg;
1516                 }
1517                 break;
1518             case 1: /* L2 cache.  */
1519                 /* Ignore writes to L2 lockdown/auxiliary registers.  */
1520                 break;
1521             default:
1522                 goto bad_reg;
1523             }
1524             break;
1525         case 1: /* TCM memory region registers.  */
1526             /* Not implemented.  */
1527             goto bad_reg;
1528         default:
1529             goto bad_reg;
1530         }
1531         break;
1532     case 10: /* MMU TLB lockdown.  */
1533         /* ??? TLB lockdown not implemented.  */
1534         break;
1535     case 12: /* Reserved.  */
1536         goto bad_reg;
1537     case 13: /* Process ID.  */
1538         if (arm_feature(env, ARM_FEATURE_S3C))
1539             op2 = 0;
1540         switch (op2) {
1541         case 0:
1542             /* Unlike real hardware the qemu TLB uses virtual addresses,
1543                not modified virtual addresses, so this causes a TLB flush.
1544              */
1545             if (env->cp15.c13_fcse != val)
1546               tlb_flush(env, 1);
1547             env->cp15.c13_fcse = val;
1548             break;
1549         case 1:
1550             /* This changes the ASID, so do a TLB flush.  */
1551             if (env->cp15.c13_context != val
1552                 && !arm_feature(env, ARM_FEATURE_MPU))
1553               tlb_flush(env, 0);
1554             env->cp15.c13_context = val;
1555             break;
1556         case 2:
1557             env->cp15.c13_tls1 = val;
1558             break;
1559         case 3:
1560             env->cp15.c13_tls2 = val;
1561             break;
1562         case 4:
1563             env->cp15.c13_tls3 = val;
1564             break;
1565         default:
1566             goto bad_reg;
1567         }
1568         break;
1569     case 14: /* Reserved.  */
1570         goto bad_reg;
1571     case 15: /* Implementation specific.  */
1572         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1573             if (op2 == 0 && crm == 1) {
1574                 if (env->cp15.c15_cpar != (val & 0x3fff)) {
1575                     /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
1576                     tb_flush(env);
1577                     env->cp15.c15_cpar = val & 0x3fff;
1578                 }
1579                 break;
1580             }
1581             goto bad_reg;
1582         }
1583         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1584             switch (crm) {
1585             case 0:
1586                 break;
1587             case 1: /* Set TI925T configuration.  */
1588                 env->cp15.c15_ticonfig = val & 0xe7;
1589                 env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
1590                         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1591                 break;
1592             case 2: /* Set I_max.  */
1593                 env->cp15.c15_i_max = val;
1594                 break;
1595             case 3: /* Set I_min.  */
1596                 env->cp15.c15_i_min = val;
1597                 break;
1598             case 4: /* Set thread-ID.  */
1599                 env->cp15.c15_threadid = val & 0xffff;
1600                 break;
1601             case 8: /* Wait-for-interrupt (deprecated).  */
1602                 cpu_interrupt(env, CPU_INTERRUPT_HALT);
1603                 break;
1604             default:
1605                 goto bad_reg;
1606             }
1607         }
1608         break;
1609     }
1610     return;
1611 bad_reg:
1612     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1613     cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
1614               (insn >> 16) & 0xf, crm, op1, op2);
1615 }
1616
1617 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
1618 {
1619     int op1;
1620     int op2;
1621     int crm;
1622
1623     op1 = (insn >> 21) & 7;
1624     op2 = (insn >> 5) & 7;
1625     crm = insn & 0xf;
1626     switch ((insn >> 16) & 0xf) {
1627     case 0: /* ID codes.  */
1628         switch (op1) {
1629         case 0:
1630             switch (crm) {
1631             case 0:
1632                 switch (op2) {
1633                 case 0: /* Device ID.  */
1634                     return env->cp15.c0_cpuid;
1635                 case 1: /* Cache Type.  */
1636                     return env->cp15.c0_cachetype;
1637                 case 2: /* TCM status.  */
1638                     if (arm_feature(env, ARM_FEATURE_S3C))
1639                         return env->cp15.c0_cpuid;
1640                     return 0;
1641                 case 3: /* TLB type register.  */
1642                     return 0; /* No lockable TLB entries.  */
1643                 case 5: /* CPU ID */
1644                     return env->cpu_index;
1645                 default:
1646                     goto bad_reg;
1647                 }
1648             case 1:
1649                 if (!arm_feature(env, ARM_FEATURE_V6))
1650                     goto bad_reg;
1651                 return env->cp15.c0_c1[op2];
1652             case 2:
1653                 if (!arm_feature(env, ARM_FEATURE_V6))
1654                     goto bad_reg;
1655                 return env->cp15.c0_c2[op2];
1656             case 3: case 4: case 5: case 6: case 7:
1657                 return 0;
1658             default:
1659                 goto bad_reg;
1660             }
1661         case 1:
1662             /* These registers aren't documented on arm11 cores.  However
1663                Linux looks at them anyway.  */
1664             if (!arm_feature(env, ARM_FEATURE_V6))
1665                 goto bad_reg;
1666             if (crm != 0)
1667                 goto bad_reg;
1668             if (!arm_feature(env, ARM_FEATURE_V7))
1669                 return 0;
1670
1671             switch (op2) {
1672             case 0:
1673                 return env->cp15.c0_ccsid[env->cp15.c0_cssel];
1674             case 1:
1675                 return env->cp15.c0_clid;
1676             case 7:
1677                 return 0;
1678             }
1679             goto bad_reg;
1680         case 2:
1681             if (op2 != 0 || crm != 0)
1682                 goto bad_reg;
1683             return env->cp15.c0_cssel;
1684         default:
1685             goto bad_reg;
1686         }
1687     case 1: /* System configuration.  */
1688         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1689             op2 = 0;
1690         switch (op2) {
1691         case 0: /* Control register.  */
1692             return env->cp15.c1_sys;
1693         case 1: /* Auxiliary control register.  */
1694             if (arm_feature(env, ARM_FEATURE_XSCALE))
1695                 return env->cp15.c1_xscaleauxcr;
1696             if (!arm_feature(env, ARM_FEATURE_AUXCR))
1697                 goto bad_reg;
1698             switch (ARM_CPUID(env)) {
1699             case ARM_CPUID_ARM1026:
1700                 return 1;
1701             case ARM_CPUID_ARM1136:
1702             case ARM_CPUID_ARM1136_R2:
1703                 return 7;
1704             case ARM_CPUID_ARM11MPCORE:
1705                 return 1;
1706             case ARM_CPUID_CORTEXA8:
1707                 return 2;
1708             default:
1709                 goto bad_reg;
1710             }
1711         case 2: /* Coprocessor access register.  */
1712             if (arm_feature(env, ARM_FEATURE_XSCALE))
1713                 goto bad_reg;
1714             return env->cp15.c1_coproc;
1715         default:
1716             goto bad_reg;
1717         }
1718     case 2: /* MMU Page table control / MPU cache control.  */
1719         if (arm_feature(env, ARM_FEATURE_MPU)) {
1720             switch (op2) {
1721             case 0:
1722                 return env->cp15.c2_data;
1723                 break;
1724             case 1:
1725                 return env->cp15.c2_insn;
1726                 break;
1727             default:
1728                 goto bad_reg;
1729             }
1730         } else {
1731             switch (op2) {
1732             case 0:
1733                 return env->cp15.c2_base0;
1734             case 1:
1735                 return env->cp15.c2_base1;
1736             case 2:
1737                 return env->cp15.c2_control;
1738             default:
1739                 goto bad_reg;
1740             }
1741         }
1742     case 3: /* MMU Domain access control / MPU write buffer control.  */
1743         return env->cp15.c3;
1744     case 4: /* Reserved.  */
1745         goto bad_reg;
1746     case 5: /* MMU Fault status / MPU access permission.  */
1747         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1748             op2 = 0;
1749         switch (op2) {
1750         case 0:
1751             if (arm_feature(env, ARM_FEATURE_MPU))
1752                 return simple_mpu_ap_bits(env->cp15.c5_data);
1753             return env->cp15.c5_data;
1754         case 1:
1755             if (arm_feature(env, ARM_FEATURE_MPU))
1756                 return simple_mpu_ap_bits(env->cp15.c5_data);
1757             return env->cp15.c5_insn;
1758         case 2:
1759             if (!arm_feature(env, ARM_FEATURE_MPU))
1760                 goto bad_reg;
1761             return env->cp15.c5_data;
1762         case 3:
1763             if (!arm_feature(env, ARM_FEATURE_MPU))
1764                 goto bad_reg;
1765             return env->cp15.c5_insn;
1766         default:
1767             goto bad_reg;
1768         }
1769     case 6: /* MMU Fault address.  */
1770         if (arm_feature(env, ARM_FEATURE_MPU)) {
1771             if (crm >= 8)
1772                 goto bad_reg;
1773             return env->cp15.c6_region[crm];
1774         } else {
1775             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1776                 op2 = 0;
1777             switch (op2) {
1778             case 0:
1779                 return env->cp15.c6_data;
1780             case 1:
1781                 if (arm_feature(env, ARM_FEATURE_V6)) {
1782                     /* Watchpoint Fault Adrress.  */
1783                     return 0; /* Not implemented.  */
1784                 } else {
1785                     /* Instruction Fault Adrress.  */
1786                     /* Arm9 doesn't have an IFAR, but implementing it anyway
1787                        shouldn't do any harm.  */
1788                     return env->cp15.c6_insn;
1789                 }
1790             case 2:
1791                 if (arm_feature(env, ARM_FEATURE_V6)) {
1792                     /* Instruction Fault Adrress.  */
1793                     return env->cp15.c6_insn;
1794                 } else {
1795                     goto bad_reg;
1796                 }
1797             default:
1798                 goto bad_reg;
1799             }
1800         }
1801     case 7: /* Cache control.  */
1802         /* FIXME: Should only clear Z flag if destination is r15.  */
1803         env->ZF = 0;
1804         return 0;
1805     case 8: /* MMU TLB control.  */
1806         goto bad_reg;
1807     case 9: /* Cache lockdown.  */
1808         switch (op1) {
1809         case 0: /* L1 cache.  */
1810             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1811                 return 0;
1812             switch (op2) {
1813             case 0:
1814                 return env->cp15.c9_data;
1815             case 1:
1816                 return env->cp15.c9_insn;
1817             default:
1818                 goto bad_reg;
1819             }
1820         case 1: /* L2 cache */
1821             if (crm != 0)
1822                 goto bad_reg;
1823             /* L2 Lockdown and Auxiliary control.  */
1824             return 0;
1825         default:
1826             goto bad_reg;
1827         }
1828     case 10: /* MMU TLB lockdown.  */
1829         /* ??? TLB lockdown not implemented.  */
1830         return 0;
1831     case 11: /* TCM DMA control.  */
1832     case 12: /* Reserved.  */
1833         goto bad_reg;
1834     case 13: /* Process ID.  */
1835         switch (op2) {
1836         case 0:
1837             return env->cp15.c13_fcse;
1838         case 1:
1839             return env->cp15.c13_context;
1840         case 2:
1841             return env->cp15.c13_tls1;
1842         case 3:
1843             return env->cp15.c13_tls2;
1844         case 4:
1845             return env->cp15.c13_tls3;
1846         default:
1847             goto bad_reg;
1848         }
1849     case 14: /* Reserved.  */
1850         goto bad_reg;
1851     case 15: /* Implementation specific.  */
1852         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1853             if (op2 == 0 && crm == 1)
1854                 return env->cp15.c15_cpar;
1855
1856             goto bad_reg;
1857         }
1858         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1859             switch (crm) {
1860             case 0:
1861                 return 0;
1862             case 1: /* Read TI925T configuration.  */
1863                 return env->cp15.c15_ticonfig;
1864             case 2: /* Read I_max.  */
1865                 return env->cp15.c15_i_max;
1866             case 3: /* Read I_min.  */
1867                 return env->cp15.c15_i_min;
1868             case 4: /* Read thread-ID.  */
1869                 return env->cp15.c15_threadid;
1870             case 8: /* TI925T_status */
1871                 return 0;
1872             }
1873             /* TODO: Peripheral port remap register:
1874              * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
1875              * controller base address at $rn & ~0xfff and map size of
1876              * 0x200 << ($rn & 0xfff), when MMU is off.  */
1877             goto bad_reg;
1878         }
1879         return 0;
1880     }
1881 bad_reg:
1882     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1883     cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
1884               (insn >> 16) & 0xf, crm, op1, op2);
1885     return 0;
1886 }
1887
1888 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
1889 {
1890     env->banked_r13[bank_number(mode)] = val;
1891 }
1892
1893 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
1894 {
1895     return env->banked_r13[bank_number(mode)];
1896 }
1897
1898 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
1899 {
1900     switch (reg) {
1901     case 0: /* APSR */
1902         return xpsr_read(env) & 0xf8000000;
1903     case 1: /* IAPSR */
1904         return xpsr_read(env) & 0xf80001ff;
1905     case 2: /* EAPSR */
1906         return xpsr_read(env) & 0xff00fc00;
1907     case 3: /* xPSR */
1908         return xpsr_read(env) & 0xff00fdff;
1909     case 5: /* IPSR */
1910         return xpsr_read(env) & 0x000001ff;
1911     case 6: /* EPSR */
1912         return xpsr_read(env) & 0x0700fc00;
1913     case 7: /* IEPSR */
1914         return xpsr_read(env) & 0x0700edff;
1915     case 8: /* MSP */
1916         return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
1917     case 9: /* PSP */
1918         return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
1919     case 16: /* PRIMASK */
1920         return (env->uncached_cpsr & CPSR_I) != 0;
1921     case 17: /* FAULTMASK */
1922         return (env->uncached_cpsr & CPSR_F) != 0;
1923     case 18: /* BASEPRI */
1924     case 19: /* BASEPRI_MAX */
1925         return env->v7m.basepri;
1926     case 20: /* CONTROL */
1927         return env->v7m.control;
1928     default:
1929         /* ??? For debugging only.  */
1930         cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
1931         return 0;
1932     }
1933 }
1934
1935 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
1936 {
1937     switch (reg) {
1938     case 0: /* APSR */
1939         xpsr_write(env, val, 0xf8000000);
1940         break;
1941     case 1: /* IAPSR */
1942         xpsr_write(env, val, 0xf8000000);
1943         break;
1944     case 2: /* EAPSR */
1945         xpsr_write(env, val, 0xfe00fc00);
1946         break;
1947     case 3: /* xPSR */
1948         xpsr_write(env, val, 0xfe00fc00);
1949         break;
1950     case 5: /* IPSR */
1951         /* IPSR bits are readonly.  */
1952         break;
1953     case 6: /* EPSR */
1954         xpsr_write(env, val, 0x0600fc00);
1955         break;
1956     case 7: /* IEPSR */
1957         xpsr_write(env, val, 0x0600fc00);
1958         break;
1959     case 8: /* MSP */
1960         if (env->v7m.current_sp)
1961             env->v7m.other_sp = val;
1962         else
1963             env->regs[13] = val;
1964         break;
1965     case 9: /* PSP */
1966         if (env->v7m.current_sp)
1967             env->regs[13] = val;
1968         else
1969             env->v7m.other_sp = val;
1970         break;
1971     case 16: /* PRIMASK */
1972         if (val & 1)
1973             env->uncached_cpsr |= CPSR_I;
1974         else
1975             env->uncached_cpsr &= ~CPSR_I;
1976         break;
1977     case 17: /* FAULTMASK */
1978         if (val & 1)
1979             env->uncached_cpsr |= CPSR_F;
1980         else
1981             env->uncached_cpsr &= ~CPSR_F;
1982         break;
1983     case 18: /* BASEPRI */
1984         env->v7m.basepri = val & 0xff;
1985         break;
1986     case 19: /* BASEPRI_MAX */
1987         val &= 0xff;
1988         if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
1989             env->v7m.basepri = val;
1990         break;
1991     case 20: /* CONTROL */
1992         env->v7m.control = val & 3;
1993         switch_v7m_sp(env, (val & 2) != 0);
1994         break;
1995     default:
1996         /* ??? For debugging only.  */
1997         cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
1998         return;
1999     }
2000 }
2001
2002 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
2003                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
2004                 void *opaque)
2005 {
2006     if (cpnum < 0 || cpnum > 14) {
2007         cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
2008         return;
2009     }
2010
2011     env->cp[cpnum].cp_read = cp_read;
2012     env->cp[cpnum].cp_write = cp_write;
2013     env->cp[cpnum].opaque = opaque;
2014 }
2015
2016 #endif
2017
2018 /* Note that signed overflow is undefined in C.  The following routines are
2019    careful to use unsigned types where modulo arithmetic is required.
2020    Failure to do so _will_ break on newer gcc.  */
2021
2022 /* Signed saturating arithmetic.  */
2023
2024 /* Perform 16-bit signed saturating addition.  */
2025 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
2026 {
2027     uint16_t res;
2028
2029     res = a + b;
2030     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
2031         if (a & 0x8000)
2032             res = 0x8000;
2033         else
2034             res = 0x7fff;
2035     }
2036     return res;
2037 }
2038
2039 /* Perform 8-bit signed saturating addition.  */
2040 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
2041 {
2042     uint8_t res;
2043
2044     res = a + b;
2045     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
2046         if (a & 0x80)
2047             res = 0x80;
2048         else
2049             res = 0x7f;
2050     }
2051     return res;
2052 }
2053
2054 /* Perform 16-bit signed saturating subtraction.  */
2055 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
2056 {
2057     uint16_t res;
2058
2059     res = a - b;
2060     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
2061         if (a & 0x8000)
2062             res = 0x8000;
2063         else
2064             res = 0x7fff;
2065     }
2066     return res;
2067 }
2068
2069 /* Perform 8-bit signed saturating subtraction.  */
2070 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
2071 {
2072     uint8_t res;
2073
2074     res = a - b;
2075     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
2076         if (a & 0x80)
2077             res = 0x80;
2078         else
2079             res = 0x7f;
2080     }
2081     return res;
2082 }
2083
2084 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
2085 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
2086 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
2087 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
2088 #define PFX q
2089
2090 #include "op_addsub.h"
2091
2092 /* Unsigned saturating arithmetic.  */
2093 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
2094 {
2095     uint16_t res;
2096     res = a + b;
2097     if (res < a)
2098         res = 0xffff;
2099     return res;
2100 }
2101
2102 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
2103 {
2104     if (a < b)
2105         return a - b;
2106     else
2107         return 0;
2108 }
2109
2110 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
2111 {
2112     uint8_t res;
2113     res = a + b;
2114     if (res < a)
2115         res = 0xff;
2116     return res;
2117 }
2118
2119 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
2120 {
2121     if (a < b)
2122         return a - b;
2123     else
2124         return 0;
2125 }
2126
2127 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
2128 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
2129 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
2130 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
2131 #define PFX uq
2132
2133 #include "op_addsub.h"
2134
2135 /* Signed modulo arithmetic.  */
2136 #define SARITH16(a, b, n, op) do { \
2137     int32_t sum; \
2138     sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
2139     RESULT(sum, n, 16); \
2140     if (sum >= 0) \
2141         ge |= 3 << (n * 2); \
2142     } while(0)
2143
2144 #define SARITH8(a, b, n, op) do { \
2145     int32_t sum; \
2146     sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
2147     RESULT(sum, n, 8); \
2148     if (sum >= 0) \
2149         ge |= 1 << n; \
2150     } while(0)
2151
2152
2153 #define ADD16(a, b, n) SARITH16(a, b, n, +)
2154 #define SUB16(a, b, n) SARITH16(a, b, n, -)
2155 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
2156 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
2157 #define PFX s
2158 #define ARITH_GE
2159
2160 #include "op_addsub.h"
2161
2162 /* Unsigned modulo arithmetic.  */
2163 #define ADD16(a, b, n) do { \
2164     uint32_t sum; \
2165     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
2166     RESULT(sum, n, 16); \
2167     if ((sum >> 16) == 1) \
2168         ge |= 3 << (n * 2); \
2169     } while(0)
2170
2171 #define ADD8(a, b, n) do { \
2172     uint32_t sum; \
2173     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
2174     RESULT(sum, n, 8); \
2175     if ((sum >> 8) == 1) \
2176         ge |= 1 << n; \
2177     } while(0)
2178
2179 #define SUB16(a, b, n) do { \
2180     uint32_t sum; \
2181     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
2182     RESULT(sum, n, 16); \
2183     if ((sum >> 16) == 0) \
2184         ge |= 3 << (n * 2); \
2185     } while(0)
2186
2187 #define SUB8(a, b, n) do { \
2188     uint32_t sum; \
2189     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
2190     RESULT(sum, n, 8); \
2191     if ((sum >> 8) == 0) \
2192         ge |= 1 << n; \
2193     } while(0)
2194
2195 #define PFX u
2196 #define ARITH_GE
2197
2198 #include "op_addsub.h"
2199
2200 /* Halved signed arithmetic.  */
2201 #define ADD16(a, b, n) \
2202   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
2203 #define SUB16(a, b, n) \
2204   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
2205 #define ADD8(a, b, n) \
2206   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
2207 #define SUB8(a, b, n) \
2208   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
2209 #define PFX sh
2210
2211 #include "op_addsub.h"
2212
2213 /* Halved unsigned arithmetic.  */
2214 #define ADD16(a, b, n) \
2215   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2216 #define SUB16(a, b, n) \
2217   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2218 #define ADD8(a, b, n) \
2219   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2220 #define SUB8(a, b, n) \
2221   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2222 #define PFX uh
2223
2224 #include "op_addsub.h"
2225
2226 static inline uint8_t do_usad(uint8_t a, uint8_t b)
2227 {
2228     if (a > b)
2229         return a - b;
2230     else
2231         return b - a;
2232 }
2233
2234 /* Unsigned sum of absolute byte differences.  */
2235 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
2236 {
2237     uint32_t sum;
2238     sum = do_usad(a, b);
2239     sum += do_usad(a >> 8, b >> 8);
2240     sum += do_usad(a >> 16, b >>16);
2241     sum += do_usad(a >> 24, b >> 24);
2242     return sum;
2243 }
2244
2245 /* For ARMv6 SEL instruction.  */
2246 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
2247 {
2248     uint32_t mask;
2249
2250     mask = 0;
2251     if (flags & 1)
2252         mask |= 0xff;
2253     if (flags & 2)
2254         mask |= 0xff00;
2255     if (flags & 4)
2256         mask |= 0xff0000;
2257     if (flags & 8)
2258         mask |= 0xff000000;
2259     return (a & mask) | (b & ~mask);
2260 }
2261
2262 uint32_t HELPER(logicq_cc)(uint64_t val)
2263 {
2264     return (val >> 32) | (val != 0);
2265 }
2266
2267 /* VFP support.  We follow the convention used for VFP instrunctions:
2268    Single precition routines have a "s" suffix, double precision a
2269    "d" suffix.  */
2270
2271 /* Convert host exception flags to vfp form.  */
2272 static inline int vfp_exceptbits_from_host(int host_bits)
2273 {
2274     int target_bits = 0;
2275
2276     if (host_bits & float_flag_invalid)
2277         target_bits |= 1;
2278     if (host_bits & float_flag_divbyzero)
2279         target_bits |= 2;
2280     if (host_bits & float_flag_overflow)
2281         target_bits |= 4;
2282     if (host_bits & float_flag_underflow)
2283         target_bits |= 8;
2284     if (host_bits & float_flag_inexact)
2285         target_bits |= 0x10;
2286     return target_bits;
2287 }
2288
2289 uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
2290 {
2291     int i;
2292     uint32_t fpscr;
2293
2294     fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
2295             | (env->vfp.vec_len << 16)
2296             | (env->vfp.vec_stride << 20);
2297     i = get_float_exception_flags(&env->vfp.fp_status);
2298     fpscr |= vfp_exceptbits_from_host(i);
2299     return fpscr;
2300 }
2301
2302 /* Convert vfp exception flags to target form.  */
2303 static inline int vfp_exceptbits_to_host(int target_bits)
2304 {
2305     int host_bits = 0;
2306
2307     if (target_bits & 1)
2308         host_bits |= float_flag_invalid;
2309     if (target_bits & 2)
2310         host_bits |= float_flag_divbyzero;
2311     if (target_bits & 4)
2312         host_bits |= float_flag_overflow;
2313     if (target_bits & 8)
2314         host_bits |= float_flag_underflow;
2315     if (target_bits & 0x10)
2316         host_bits |= float_flag_inexact;
2317     return host_bits;
2318 }
2319
2320 void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
2321 {
2322     int i;
2323     uint32_t changed;
2324
2325     changed = env->vfp.xregs[ARM_VFP_FPSCR];
2326     env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
2327     env->vfp.vec_len = (val >> 16) & 7;
2328     env->vfp.vec_stride = (val >> 20) & 3;
2329
2330     changed ^= val;
2331     if (changed & (3 << 22)) {
2332         i = (val >> 22) & 3;
2333         switch (i) {
2334         case 0:
2335             i = float_round_nearest_even;
2336             break;
2337         case 1:
2338             i = float_round_up;
2339             break;
2340         case 2:
2341             i = float_round_down;
2342             break;
2343         case 3:
2344             i = float_round_to_zero;
2345             break;
2346         }
2347         set_float_rounding_mode(i, &env->vfp.fp_status);
2348     }
2349     if (changed & (1 << 24))
2350         set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
2351     if (changed & (1 << 25))
2352         set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
2353
2354     i = vfp_exceptbits_to_host((val >> 8) & 0x1f);
2355     set_float_exception_flags(i, &env->vfp.fp_status);
2356 }
2357
2358 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
2359
2360 #define VFP_BINOP(name) \
2361 float32 VFP_HELPER(name, s)(float32 a, float32 b, CPUState *env) \
2362 { \
2363     return float32_ ## name (a, b, &env->vfp.fp_status); \
2364 } \
2365 float64 VFP_HELPER(name, d)(float64 a, float64 b, CPUState *env) \
2366 { \
2367     return float64_ ## name (a, b, &env->vfp.fp_status); \
2368 }
2369 VFP_BINOP(add)
2370 VFP_BINOP(sub)
2371 VFP_BINOP(mul)
2372 VFP_BINOP(div)
2373 #undef VFP_BINOP
2374
2375 float32 VFP_HELPER(neg, s)(float32 a)
2376 {
2377     return float32_chs(a);
2378 }
2379
2380 float64 VFP_HELPER(neg, d)(float64 a)
2381 {
2382     return float64_chs(a);
2383 }
2384
2385 float32 VFP_HELPER(abs, s)(float32 a)
2386 {
2387     return float32_abs(a);
2388 }
2389
2390 float64 VFP_HELPER(abs, d)(float64 a)
2391 {
2392     return float64_abs(a);
2393 }
2394
2395 float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
2396 {
2397     return float32_sqrt(a, &env->vfp.fp_status);
2398 }
2399
2400 float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
2401 {
2402     return float64_sqrt(a, &env->vfp.fp_status);
2403 }
2404
2405 /* XXX: check quiet/signaling case */
2406 #define DO_VFP_cmp(p, type) \
2407 void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
2408 { \
2409     uint32_t flags; \
2410     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
2411     case 0: flags = 0x6; break; \
2412     case -1: flags = 0x8; break; \
2413     case 1: flags = 0x2; break; \
2414     default: case 2: flags = 0x3; break; \
2415     } \
2416     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2417         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2418 } \
2419 void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
2420 { \
2421     uint32_t flags; \
2422     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
2423     case 0: flags = 0x6; break; \
2424     case -1: flags = 0x8; break; \
2425     case 1: flags = 0x2; break; \
2426     default: case 2: flags = 0x3; break; \
2427     } \
2428     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2429         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2430 }
2431 DO_VFP_cmp(s, float32)
2432 DO_VFP_cmp(d, float64)
2433 #undef DO_VFP_cmp
2434
2435 /* Helper routines to perform bitwise copies between float and int.  */
2436 static inline float32 vfp_itos(uint32_t i)
2437 {
2438     union {
2439         uint32_t i;
2440         float32 s;
2441     } v;
2442
2443     v.i = i;
2444     return v.s;
2445 }
2446
2447 static inline uint32_t vfp_stoi(float32 s)
2448 {
2449     union {
2450         uint32_t i;
2451         float32 s;
2452     } v;
2453
2454     v.s = s;
2455     return v.i;
2456 }
2457
2458 static inline float64 vfp_itod(uint64_t i)
2459 {
2460     union {
2461         uint64_t i;
2462         float64 d;
2463     } v;
2464
2465     v.i = i;
2466     return v.d;
2467 }
2468
2469 static inline uint64_t vfp_dtoi(float64 d)
2470 {
2471     union {
2472         uint64_t i;
2473         float64 d;
2474     } v;
2475
2476     v.d = d;
2477     return v.i;
2478 }
2479
2480 /* Integer to float conversion.  */
2481 float32 VFP_HELPER(uito, s)(float32 x, CPUState *env)
2482 {
2483     return uint32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2484 }
2485
2486 float64 VFP_HELPER(uito, d)(float32 x, CPUState *env)
2487 {
2488     return uint32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2489 }
2490
2491 float32 VFP_HELPER(sito, s)(float32 x, CPUState *env)
2492 {
2493     return int32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2494 }
2495
2496 float64 VFP_HELPER(sito, d)(float32 x, CPUState *env)
2497 {
2498     return int32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2499 }
2500
2501 /* Float to integer conversion.  */
2502 float32 VFP_HELPER(toui, s)(float32 x, CPUState *env)
2503 {
2504     return vfp_itos(float32_to_uint32(x, &env->vfp.fp_status));
2505 }
2506
2507 float32 VFP_HELPER(toui, d)(float64 x, CPUState *env)
2508 {
2509     return vfp_itos(float64_to_uint32(x, &env->vfp.fp_status));
2510 }
2511
2512 float32 VFP_HELPER(tosi, s)(float32 x, CPUState *env)
2513 {
2514     return vfp_itos(float32_to_int32(x, &env->vfp.fp_status));
2515 }
2516
2517 float32 VFP_HELPER(tosi, d)(float64 x, CPUState *env)
2518 {
2519     return vfp_itos(float64_to_int32(x, &env->vfp.fp_status));
2520 }
2521
2522 float32 VFP_HELPER(touiz, s)(float32 x, CPUState *env)
2523 {
2524     return vfp_itos(float32_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2525 }
2526
2527 float32 VFP_HELPER(touiz, d)(float64 x, CPUState *env)
2528 {
2529     return vfp_itos(float64_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2530 }
2531
2532 float32 VFP_HELPER(tosiz, s)(float32 x, CPUState *env)
2533 {
2534     return vfp_itos(float32_to_int32_round_to_zero(x, &env->vfp.fp_status));
2535 }
2536
2537 float32 VFP_HELPER(tosiz, d)(float64 x, CPUState *env)
2538 {
2539     return vfp_itos(float64_to_int32_round_to_zero(x, &env->vfp.fp_status));
2540 }
2541
2542 /* floating point conversion */
2543 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
2544 {
2545     return float32_to_float64(x, &env->vfp.fp_status);
2546 }
2547
2548 float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
2549 {
2550     return float64_to_float32(x, &env->vfp.fp_status);
2551 }
2552
2553 /* VFP3 fixed point conversion.  */
2554 #define VFP_CONV_FIX(name, p, ftype, itype, sign) \
2555 ftype VFP_HELPER(name##to, p)(ftype x, uint32_t shift, CPUState *env) \
2556 { \
2557     ftype tmp; \
2558     tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(x), \
2559                                   &env->vfp.fp_status); \
2560     return ftype##_scalbn(tmp, -(int)shift, &env->vfp.fp_status); \
2561 } \
2562 ftype VFP_HELPER(to##name, p)(ftype x, uint32_t shift, CPUState *env) \
2563 { \
2564     ftype tmp; \
2565     tmp = ftype##_scalbn(x, shift, &env->vfp.fp_status); \
2566     return vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
2567         &env->vfp.fp_status)); \
2568 }
2569
2570 VFP_CONV_FIX(sh, d, float64, int16, )
2571 VFP_CONV_FIX(sl, d, float64, int32, )
2572 VFP_CONV_FIX(uh, d, float64, uint16, u)
2573 VFP_CONV_FIX(ul, d, float64, uint32, u)
2574 VFP_CONV_FIX(sh, s, float32, int16, )
2575 VFP_CONV_FIX(sl, s, float32, int32, )
2576 VFP_CONV_FIX(uh, s, float32, uint16, u)
2577 VFP_CONV_FIX(ul, s, float32, uint32, u)
2578 #undef VFP_CONV_FIX
2579
2580 float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
2581 {
2582     float_status *s = &env->vfp.fp_status;
2583     float32 two = int32_to_float32(2, s);
2584     return float32_sub(two, float32_mul(a, b, s), s);
2585 }
2586
2587 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
2588 {
2589     float_status *s = &env->vfp.fp_status;
2590     float32 three = int32_to_float32(3, s);
2591     return float32_sub(three, float32_mul(a, b, s), s);
2592 }
2593
2594 /* NEON helpers.  */
2595
2596 /* TODO: The architecture specifies the value that the estimate functions
2597    should return.  We return the exact reciprocal/root instead.  */
2598 float32 HELPER(recpe_f32)(float32 a, CPUState *env)
2599 {
2600     float_status *s = &env->vfp.fp_status;
2601     float32 one = int32_to_float32(1, s);
2602     return float32_div(one, a, s);
2603 }
2604
2605 float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
2606 {
2607     float_status *s = &env->vfp.fp_status;
2608     float32 one = int32_to_float32(1, s);
2609     return float32_div(one, float32_sqrt(a, s), s);
2610 }
2611
2612 uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
2613 {
2614     float_status *s = &env->vfp.fp_status;
2615     float32 tmp;
2616     tmp = int32_to_float32(a, s);
2617     tmp = float32_scalbn(tmp, -32, s);
2618     tmp = helper_recpe_f32(tmp, env);
2619     tmp = float32_scalbn(tmp, 31, s);
2620     return float32_to_int32(tmp, s);
2621 }
2622
2623 uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
2624 {
2625     float_status *s = &env->vfp.fp_status;
2626     float32 tmp;
2627     tmp = int32_to_float32(a, s);
2628     tmp = float32_scalbn(tmp, -32, s);
2629     tmp = helper_rsqrte_f32(tmp, env);
2630     tmp = float32_scalbn(tmp, 31, s);
2631     return float32_to_int32(tmp, s);
2632 }
2633
2634 void HELPER(set_teecr)(CPUState *env, uint32_t val)
2635 {
2636     val &= 1;
2637     if (env->teecr != val) {
2638         env->teecr = val;
2639         tb_flush(env);
2640     }
2641 }