target-arm/helper.c

   1 #include <stdio.h>
   2 #include <stdlib.h>
   3 #include <string.h>
   4
   5 #include "cpu.h"
   6 #include "exec-all.h"
   7 #include "gdbstub.h"
   8 #include "helpers.h"
   9 #include "qemu-common.h"
  10
  11 static uint32_t cortexa8_cp15_c0_c1[8] =
  12 { 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
  13
  14 static uint32_t cortexa8_cp15_c0_c2[8] =
  15 { 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
  16
  17 static uint32_t mpcore_cp15_c0_c1[8] =
  18 { 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
  19
  20 static uint32_t mpcore_cp15_c0_c2[8] =
  21 { 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
  22
  23 static uint32_t arm1136_cp15_c0_c1[8] =
  24 { 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
  25
  26 static uint32_t arm1136_cp15_c0_c2[8] =
  27 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
  28
  29 static uint32_t cpu_arm_find_by_name(const char *name);
  30
  31 static inline void set_feature(CPUARMState *env, int feature)
  32 {
  33     env->features |= 1u << feature;
  34 }
  35
  36 static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
  37 {
  38     env->cp15.c0_cpuid = id;
  39     switch (id) {
  40     case ARM_CPUID_ARM926:
  41         set_feature(env, ARM_FEATURE_VFP);
  42         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
  43         env->cp15.c0_cachetype = 0x1dd20d2;
  44         env->cp15.c1_sys = 0x00090078;
  45         break;
  46     case ARM_CPUID_ARM946:
  47         set_feature(env, ARM_FEATURE_MPU);
  48         env->cp15.c0_cachetype = 0x0f004006;
  49         env->cp15.c1_sys = 0x00000078;
  50         break;
  51     case ARM_CPUID_ARM1026:
  52         set_feature(env, ARM_FEATURE_VFP);
  53         set_feature(env, ARM_FEATURE_AUXCR);
  54         env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
  55         env->cp15.c0_cachetype = 0x1dd20d2;
  56         env->cp15.c1_sys = 0x00090078;
  57         break;
  58     case ARM_CPUID_ARM1136_R2:
  59     case ARM_CPUID_ARM1136:
  60         set_feature(env, ARM_FEATURE_V6);
  61         set_feature(env, ARM_FEATURE_VFP);
  62         set_feature(env, ARM_FEATURE_AUXCR);
  63         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  64         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  65         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  66         memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
  67         memcpy(env->cp15.c0_c2, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
  68         env->cp15.c0_cachetype = 0x1dd20d2;
  69         break;
  70     case ARM_CPUID_ARM11MPCORE:
  71         set_feature(env, ARM_FEATURE_V6);
  72         set_feature(env, ARM_FEATURE_V6K);
  73         set_feature(env, ARM_FEATURE_VFP);
  74         set_feature(env, ARM_FEATURE_AUXCR);
  75         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  76         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  77         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  78         memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
  79         memcpy(env->cp15.c0_c2, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
  80         env->cp15.c0_cachetype = 0x1dd20d2;
  81         break;
  82     case ARM_CPUID_CORTEXA8:
  83         set_feature(env, ARM_FEATURE_V6);
  84         set_feature(env, ARM_FEATURE_V6K);
  85         set_feature(env, ARM_FEATURE_V7);
  86         set_feature(env, ARM_FEATURE_AUXCR);
  87         set_feature(env, ARM_FEATURE_THUMB2);
  88         set_feature(env, ARM_FEATURE_VFP);
  89         set_feature(env, ARM_FEATURE_VFP3);
  90         set_feature(env, ARM_FEATURE_NEON);
  91         set_feature(env, ARM_FEATURE_THUMB2EE);
  92         env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
  93         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
  94         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
  95         memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
  96         memcpy(env->cp15.c0_c2, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
  97         env->cp15.c0_cachetype = 0x82048004;
  98         env->cp15.c0_clid = (1 << 27) | (2 << 24) | 3;
  99         env->cp15.c0_ccsid[0] = 0xe007e01a; /* 16k L1 dcache. */
 100         env->cp15.c0_ccsid[1] = 0x2007e01a; /* 16k L1 icache. */
 101         env->cp15.c0_ccsid[2] = 0xf0000000; /* No L2 icache. */
 102         break;
 103     case ARM_CPUID_CORTEXM3:
 104         set_feature(env, ARM_FEATURE_V6);
 105         set_feature(env, ARM_FEATURE_THUMB2);
 106         set_feature(env, ARM_FEATURE_V7);
 107         set_feature(env, ARM_FEATURE_M);
 108         set_feature(env, ARM_FEATURE_DIV);
 109         break;
 110     case ARM_CPUID_ANY: /* For userspace emulation.  */
 111         set_feature(env, ARM_FEATURE_V6);
 112         set_feature(env, ARM_FEATURE_V6K);
 113         set_feature(env, ARM_FEATURE_V7);
 114         set_feature(env, ARM_FEATURE_THUMB2);
 115         set_feature(env, ARM_FEATURE_VFP);
 116         set_feature(env, ARM_FEATURE_VFP3);
 117         set_feature(env, ARM_FEATURE_NEON);
 118         set_feature(env, ARM_FEATURE_THUMB2EE);
 119         set_feature(env, ARM_FEATURE_DIV);
 120         break;
 121     case ARM_CPUID_TI915T:
 122     case ARM_CPUID_TI925T:
 123         set_feature(env, ARM_FEATURE_OMAPCP);
 124         env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
 125         env->cp15.c0_cachetype = 0x5109149;
 126         env->cp15.c1_sys = 0x00000070;
 127         env->cp15.c15_i_max = 0x000;
 128         env->cp15.c15_i_min = 0xff0;
 129         break;
 130     case ARM_CPUID_PXA250:
 131     case ARM_CPUID_PXA255:
 132     case ARM_CPUID_PXA260:
 133     case ARM_CPUID_PXA261:
 134     case ARM_CPUID_PXA262:
 135         set_feature(env, ARM_FEATURE_XSCALE);
 136         /* JTAG_ID is ((id << 28) | 0x09265013) */
 137         env->cp15.c0_cachetype = 0xd172172;
 138         env->cp15.c1_sys = 0x00000078;
 139         break;
 140     case ARM_CPUID_PXA270_A0:
 141     case ARM_CPUID_PXA270_A1:
 142     case ARM_CPUID_PXA270_B0:
 143     case ARM_CPUID_PXA270_B1:
 144     case ARM_CPUID_PXA270_C0:
 145     case ARM_CPUID_PXA270_C5:
 146         set_feature(env, ARM_FEATURE_XSCALE);
 147         /* JTAG_ID is ((id << 28) | 0x09265013) */
 148         set_feature(env, ARM_FEATURE_IWMMXT);
 149         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
 150         env->cp15.c0_cachetype = 0xd172172;
 151         env->cp15.c1_sys = 0x00000078;
 152         break;
 153     default:
 154         cpu_abort(env, "Bad CPU ID: %x\n", id);
 155         break;
 156     }
 157 }
 158
 159 void cpu_reset(CPUARMState *env)
 160 {
 161     uint32_t id;
 162     id = env->cp15.c0_cpuid;
 163     memset(env, 0, offsetof(CPUARMState, breakpoints));
 164     if (id)
 165         cpu_reset_model_id(env, id);
 166 #if defined (CONFIG_USER_ONLY)
 167     env->uncached_cpsr = ARM_CPU_MODE_USR;
 168     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
 169 #else
 170     /* SVC mode with interrupts disabled.  */
 171     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
 172     /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
 173        clear at reset.  */
 174     if (IS_M(env))
 175         env->uncached_cpsr &= ~CPSR_I;
 176     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 177     env->cp15.c2_base_mask = 0xffffc000u;
 178 #endif
 179     env->regs[15] = 0;
 180     tlb_flush(env, 1);
 181 }
 182
 183 static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
 184 {
 185     int nregs;
 186
 187     /* VFP data registers are always little-endian.  */
 188     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 189     if (reg < nregs) {
 190         stfq_le_p(buf, env->vfp.regs[reg]);
 191         return 8;
 192     }
 193     if (arm_feature(env, ARM_FEATURE_NEON)) {
 194         /* Aliases for Q regs.  */
 195         nregs += 16;
 196         if (reg < nregs) {
 197             stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 198             stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 199             return 16;
 200         }
 201     }
 202     switch (reg - nregs) {
 203     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
 204     case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
 205     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
 206     }
 207     return 0;
 208 }
 209
 210 static int vfp_gdb_set_reg(CPUState *env, uint8_t *buf, int reg)
 211 {
 212     int nregs;
 213
 214     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 215     if (reg < nregs) {
 216         env->vfp.regs[reg] = ldfq_le_p(buf);
 217         return 8;
 218     }
 219     if (arm_feature(env, ARM_FEATURE_NEON)) {
 220         nregs += 16;
 221         if (reg < nregs) {
 222             env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
 223             env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
 224             return 16;
 225         }
 226     }
 227     switch (reg - nregs) {
 228     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
 229     case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
 230     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf); return 4;
 231     }
 232     return 0;
 233 }
 234
 235 CPUARMState *cpu_arm_init(const char *cpu_model)
 236 {
 237     CPUARMState *env;
 238     uint32_t id;
 239     static int inited = 0;
 240
 241     id = cpu_arm_find_by_name(cpu_model);
 242     if (id == 0)
 243         return NULL;
 244     env = qemu_mallocz(sizeof(CPUARMState));
 245     if (!env)
 246         return NULL;
 247     cpu_exec_init(env);
 248     if (!inited) {
 249         inited = 1;
 250         arm_translate_init();
 251     }
 252
 253     env->cpu_model_str = cpu_model;
 254     env->cp15.c0_cpuid = id;
 255     cpu_reset(env);
 256     if (arm_feature(env, ARM_FEATURE_NEON)) {
 257         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 258                                  51, "arm-neon.xml", 0);
 259     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
 260         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 261                                  35, "arm-vfp3.xml", 0);
 262     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 263         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 264                                  19, "arm-vfp.xml", 0);
 265     }
 266     return env;
 267 }
 268
 269 struct arm_cpu_t {
 270     uint32_t id;
 271     const char *name;
 272 };
 273
 274 static const struct arm_cpu_t arm_cpu_names[] = {
 275     { ARM_CPUID_ARM926, "arm926"},
 276     { ARM_CPUID_ARM946, "arm946"},
 277     { ARM_CPUID_ARM1026, "arm1026"},
 278     { ARM_CPUID_ARM1136, "arm1136"},
 279     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
 280     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
 281     { ARM_CPUID_CORTEXM3, "cortex-m3"},
 282     { ARM_CPUID_CORTEXA8, "cortex-a8"},
 283     { ARM_CPUID_TI925T, "ti925t" },
 284     { ARM_CPUID_PXA250, "pxa250" },
 285     { ARM_CPUID_PXA255, "pxa255" },
 286     { ARM_CPUID_PXA260, "pxa260" },
 287     { ARM_CPUID_PXA261, "pxa261" },
 288     { ARM_CPUID_PXA262, "pxa262" },
 289     { ARM_CPUID_PXA270, "pxa270" },
 290     { ARM_CPUID_PXA270_A0, "pxa270-a0" },
 291     { ARM_CPUID_PXA270_A1, "pxa270-a1" },
 292     { ARM_CPUID_PXA270_B0, "pxa270-b0" },
 293     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
 294     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
 295     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
 296     { ARM_CPUID_ANY, "any"},
 297     { 0, NULL}
 298 };
 299
 300 void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 301 {
 302     int i;
 303
 304     (*cpu_fprintf)(f, "Available CPUs:\n");
 305     for (i = 0; arm_cpu_names[i].name; i++) {
 306         (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
 307     }
 308 }
 309
 310 /* return 0 if not found */
 311 static uint32_t cpu_arm_find_by_name(const char *name)
 312 {
 313     int i;
 314     uint32_t id;
 315
 316     id = 0;
 317     for (i = 0; arm_cpu_names[i].name; i++) {
 318         if (strcmp(name, arm_cpu_names[i].name) == 0) {
 319             id = arm_cpu_names[i].id;
 320             break;
 321         }
 322     }
 323     return id;
 324 }
 325
 326 void cpu_arm_close(CPUARMState *env)
 327 {
 328     free(env);
 329 }
 330
 331 uint32_t cpsr_read(CPUARMState *env)
 332 {
 333     int ZF;
 334     ZF = (env->ZF == 0);
 335     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
 336         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
 337         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
 338         | ((env->condexec_bits & 0xfc) << 8)
 339         | (env->GE << 16);
 340 }
 341
 342 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 343 {
 344     if (mask & CPSR_NZCV) {
 345         env->ZF = (~val) & CPSR_Z;
 346         env->NF = val;
 347         env->CF = (val >> 29) & 1;
 348         env->VF = (val << 3) & 0x80000000;
 349     }
 350     if (mask & CPSR_Q)
 351         env->QF = ((val & CPSR_Q) != 0);
 352     if (mask & CPSR_T)
 353         env->thumb = ((val & CPSR_T) != 0);
 354     if (mask & CPSR_IT_0_1) {
 355         env->condexec_bits &= ~3;
 356         env->condexec_bits |= (val >> 25) & 3;
 357     }
 358     if (mask & CPSR_IT_2_7) {
 359         env->condexec_bits &= 3;
 360         env->condexec_bits |= (val >> 8) & 0xfc;
 361     }
 362     if (mask & CPSR_GE) {
 363         env->GE = (val >> 16) & 0xf;
 364     }
 365
 366     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
 367         switch_mode(env, val & CPSR_M);
 368     }
 369     mask &= ~CACHED_CPSR_BITS;
 370     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 371 }
 372
 373 /* Sign/zero extend */
 374 uint32_t HELPER(sxtb16)(uint32_t x)
 375 {
 376     uint32_t res;
 377     res = (uint16_t)(int8_t)x;
 378     res |= (uint32_t)(int8_t)(x >> 16) << 16;
 379     return res;
 380 }
 381
 382 uint32_t HELPER(uxtb16)(uint32_t x)
 383 {
 384     uint32_t res;
 385     res = (uint16_t)(uint8_t)x;
 386     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
 387     return res;
 388 }
 389
 390 uint32_t HELPER(clz)(uint32_t x)
 391 {
 392     int count;
 393     for (count = 32; x; count--)
 394         x >>= 1;
 395     return count;
 396 }
 397
 398 int32_t HELPER(sdiv)(int32_t num, int32_t den)
 399 {
 400     if (den == 0)
 401       return 0;
 402     return num / den;
 403 }
 404
 405 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
 406 {
 407     if (den == 0)
 408       return 0;
 409     return num / den;
 410 }
 411
 412 uint32_t HELPER(rbit)(uint32_t x)
 413 {
 414     x =  ((x & 0xff000000) >> 24)
 415        | ((x & 0x00ff0000) >> 8)
 416        | ((x & 0x0000ff00) << 8)
 417        | ((x & 0x000000ff) << 24);
 418     x =  ((x & 0xf0f0f0f0) >> 4)
 419        | ((x & 0x0f0f0f0f) << 4);
 420     x =  ((x & 0x88888888) >> 3)
 421        | ((x & 0x44444444) >> 1)
 422        | ((x & 0x22222222) << 1)
 423        | ((x & 0x11111111) << 3);
 424     return x;
 425 }
 426
 427 uint32_t HELPER(abs)(uint32_t x)
 428 {
 429     return ((int32_t)x < 0) ? -x : x;
 430 }
 431
 432 #if defined(CONFIG_USER_ONLY)
 433
 434 void do_interrupt (CPUState *env)
 435 {
 436     env->exception_index = -1;
 437 }
 438
 439 /* Structure used to record exclusive memory locations.  */
 440 typedef struct mmon_state {
 441     struct mmon_state *next;
 442     CPUARMState *cpu_env;
 443     uint32_t addr;
 444 } mmon_state;
 445
 446 /* Chain of current locks.  */
 447 static mmon_state* mmon_head = NULL;
 448
 449 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 450                               int mmu_idx, int is_softmmu)
 451 {
 452     if (rw == 2) {
 453         env->exception_index = EXCP_PREFETCH_ABORT;
 454         env->cp15.c6_insn = address;
 455     } else {
 456         env->exception_index = EXCP_DATA_ABORT;
 457         env->cp15.c6_data = address;
 458     }
 459     return 1;
 460 }
 461
 462 static void allocate_mmon_state(CPUState *env)
 463 {
 464     env->mmon_entry = malloc(sizeof (mmon_state));
 465     if (!env->mmon_entry)
 466         abort();
 467     memset (env->mmon_entry, 0, sizeof (mmon_state));
 468     env->mmon_entry->cpu_env = env;
 469     mmon_head = env->mmon_entry;
 470 }
 471
 472 /* Flush any monitor locks for the specified address.  */
 473 static void flush_mmon(uint32_t addr)
 474 {
 475     mmon_state *mon;
 476
 477     for (mon = mmon_head; mon; mon = mon->next)
 478       {
 479         if (mon->addr != addr)
 480           continue;
 481
 482         mon->addr = 0;
 483         break;
 484       }
 485 }
 486
 487 /* Mark an address for exclusive access.  */
 488 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
 489 {
 490     if (!env->mmon_entry)
 491         allocate_mmon_state(env);
 492     /* Clear any previous locks.  */
 493     flush_mmon(addr);
 494     env->mmon_entry->addr = addr;
 495 }
 496
 497 /* Test if an exclusive address is still exclusive.  Returns zero
 498    if the address is still exclusive.   */
 499 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
 500 {
 501     int res;
 502
 503     if (!env->mmon_entry)
 504         return 1;
 505     if (env->mmon_entry->addr == addr)
 506         res = 0;
 507     else
 508         res = 1;
 509     flush_mmon(addr);
 510     return res;
 511 }
 512
 513 void HELPER(clrex)(CPUState *env)
 514 {
 515     if (!(env->mmon_entry && env->mmon_entry->addr))
 516         return;
 517     flush_mmon(env->mmon_entry->addr);
 518 }
 519
 520 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 521 {
 522     return addr;
 523 }
 524
 525 /* These should probably raise undefined insn exceptions.  */
 526 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
 527 {
 528     int op1 = (insn >> 8) & 0xf;
 529     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 530     return;
 531 }
 532
 533 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
 534 {
 535     int op1 = (insn >> 8) & 0xf;
 536     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 537     return 0;
 538 }
 539
 540 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
 541 {
 542     cpu_abort(env, "cp15 insn %08x\n", insn);
 543 }
 544
 545 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 546 {
 547     cpu_abort(env, "cp15 insn %08x\n", insn);
 548     return 0;
 549 }
 550
 551 /* These should probably raise undefined insn exceptions.  */
 552 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
 553 {
 554     cpu_abort(env, "v7m_mrs %d\n", reg);
 555 }
 556
 557 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
 558 {
 559     cpu_abort(env, "v7m_mrs %d\n", reg);
 560     return 0;
 561 }
 562
 563 void switch_mode(CPUState *env, int mode)
 564 {
 565     if (mode != ARM_CPU_MODE_USR)
 566         cpu_abort(env, "Tried to switch out of user mode\n");
 567 }
 568
 569 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
 570 {
 571     cpu_abort(env, "banked r13 write\n");
 572 }
 573
 574 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
 575 {
 576     cpu_abort(env, "banked r13 read\n");
 577     return 0;
 578 }
 579
 580 #else
 581
 582 extern int semihosting_enabled;
 583
 584 /* Map CPU modes onto saved register banks.  */
 585 static inline int bank_number (int mode)
 586 {
 587     switch (mode) {
 588     case ARM_CPU_MODE_USR:
 589     case ARM_CPU_MODE_SYS:
 590         return 0;
 591     case ARM_CPU_MODE_SVC:
 592         return 1;
 593     case ARM_CPU_MODE_ABT:
 594         return 2;
 595     case ARM_CPU_MODE_UND:
 596         return 3;
 597     case ARM_CPU_MODE_IRQ:
 598         return 4;
 599     case ARM_CPU_MODE_FIQ:
 600         return 5;
 601     }
 602     cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
 603     return -1;
 604 }
 605
 606 void switch_mode(CPUState *env, int mode)
 607 {
 608     int old_mode;
 609     int i;
 610
 611     old_mode = env->uncached_cpsr & CPSR_M;
 612     if (mode == old_mode)
 613         return;
 614
 615     if (old_mode == ARM_CPU_MODE_FIQ) {
 616         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
 617         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
 618     } else if (mode == ARM_CPU_MODE_FIQ) {
 619         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
 620         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
 621     }
 622
 623     i = bank_number(old_mode);
 624     env->banked_r13[i] = env->regs[13];
 625     env->banked_r14[i] = env->regs[14];
 626     env->banked_spsr[i] = env->spsr;
 627
 628     i = bank_number(mode);
 629     env->regs[13] = env->banked_r13[i];
 630     env->regs[14] = env->banked_r14[i];
 631     env->spsr = env->banked_spsr[i];
 632 }
 633
 634 static void v7m_push(CPUARMState *env, uint32_t val)
 635 {
 636     env->regs[13] -= 4;
 637     stl_phys(env->regs[13], val);
 638 }
 639
 640 static uint32_t v7m_pop(CPUARMState *env)
 641 {
 642     uint32_t val;
 643     val = ldl_phys(env->regs[13]);
 644     env->regs[13] += 4;
 645     return val;
 646 }
 647
 648 /* Switch to V7M main or process stack pointer.  */
 649 static void switch_v7m_sp(CPUARMState *env, int process)
 650 {
 651     uint32_t tmp;
 652     if (env->v7m.current_sp != process) {
 653         tmp = env->v7m.other_sp;
 654         env->v7m.other_sp = env->regs[13];
 655         env->regs[13] = tmp;
 656         env->v7m.current_sp = process;
 657     }
 658 }
 659
 660 static void do_v7m_exception_exit(CPUARMState *env)
 661 {
 662     uint32_t type;
 663     uint32_t xpsr;
 664
 665     type = env->regs[15];
 666     if (env->v7m.exception != 0)
 667         armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
 668
 669     /* Switch to the target stack.  */
 670     switch_v7m_sp(env, (type & 4) != 0);
 671     /* Pop registers.  */
 672     env->regs[0] = v7m_pop(env);
 673     env->regs[1] = v7m_pop(env);
 674     env->regs[2] = v7m_pop(env);
 675     env->regs[3] = v7m_pop(env);
 676     env->regs[12] = v7m_pop(env);
 677     env->regs[14] = v7m_pop(env);
 678     env->regs[15] = v7m_pop(env);
 679     xpsr = v7m_pop(env);
 680     xpsr_write(env, xpsr, 0xfffffdff);
 681     /* Undo stack alignment.  */
 682     if (xpsr & 0x200)
 683         env->regs[13] |= 4;
 684     /* ??? The exception return type specifies Thread/Handler mode.  However
 685        this is also implied by the xPSR value. Not sure what to do
 686        if there is a mismatch.  */
 687     /* ??? Likewise for mismatches between the CONTROL register and the stack
 688        pointer.  */
 689 }
 690
 691 void do_interrupt_v7m(CPUARMState *env)
 692 {
 693     uint32_t xpsr = xpsr_read(env);
 694     uint32_t lr;
 695     uint32_t addr;
 696
 697     lr = 0xfffffff1;
 698     if (env->v7m.current_sp)
 699         lr |= 4;
 700     if (env->v7m.exception == 0)
 701         lr |= 8;
 702
 703     /* For exceptions we just mark as pending on the NVIC, and let that
 704        handle it.  */
 705     /* TODO: Need to escalate if the current priority is higher than the
 706        one we're raising.  */
 707     switch (env->exception_index) {
 708     case EXCP_UDEF:
 709         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
 710         return;
 711     case EXCP_SWI:
 712         env->regs[15] += 2;
 713         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
 714         return;
 715     case EXCP_PREFETCH_ABORT:
 716     case EXCP_DATA_ABORT:
 717         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
 718         return;
 719     case EXCP_BKPT:
 720         if (semihosting_enabled) {
 721             int nr;
 722             nr = lduw_code(env->regs[15]) & 0xff;
 723             if (nr == 0xab) {
 724                 env->regs[15] += 2;
 725                 env->regs[0] = do_arm_semihosting(env);
 726                 return;
 727             }
 728         }
 729         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
 730         return;
 731     case EXCP_IRQ:
 732         env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
 733         break;
 734     case EXCP_EXCEPTION_EXIT:
 735         do_v7m_exception_exit(env);
 736         return;
 737     default:
 738         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 739         return; /* Never happens.  Keep compiler happy.  */
 740     }
 741
 742     /* Align stack pointer.  */
 743     /* ??? Should only do this if Configuration Control Register
 744        STACKALIGN bit is set.  */
 745     if (env->regs[13] & 4) {
 746         env->regs[13] -= 4;
 747         xpsr |= 0x200;
 748     }
 749     /* Switch to the handler mode.  */
 750     v7m_push(env, xpsr);
 751     v7m_push(env, env->regs[15]);
 752     v7m_push(env, env->regs[14]);
 753     v7m_push(env, env->regs[12]);
 754     v7m_push(env, env->regs[3]);
 755     v7m_push(env, env->regs[2]);
 756     v7m_push(env, env->regs[1]);
 757     v7m_push(env, env->regs[0]);
 758     switch_v7m_sp(env, 0);
 759     env->uncached_cpsr &= ~CPSR_IT;
 760     env->regs[14] = lr;
 761     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
 762     env->regs[15] = addr & 0xfffffffe;
 763     env->thumb = addr & 1;
 764 }
 765
 766 /* Handle a CPU exception.  */
 767 void do_interrupt(CPUARMState *env)
 768 {
 769     uint32_t addr;
 770     uint32_t mask;
 771     int new_mode;
 772     uint32_t offset;
 773
 774     if (IS_M(env)) {
 775         do_interrupt_v7m(env);
 776         return;
 777     }
 778     /* TODO: Vectored interrupt controller.  */
 779     switch (env->exception_index) {
 780     case EXCP_UDEF:
 781         new_mode = ARM_CPU_MODE_UND;
 782         addr = 0x04;
 783         mask = CPSR_I;
 784         if (env->thumb)
 785             offset = 2;
 786         else
 787             offset = 4;
 788         break;
 789     case EXCP_SWI:
 790         if (semihosting_enabled) {
 791             /* Check for semihosting interrupt.  */
 792             if (env->thumb) {
 793                 mask = lduw_code(env->regs[15] - 2) & 0xff;
 794             } else {
 795                 mask = ldl_code(env->regs[15] - 4) & 0xffffff;
 796             }
 797             /* Only intercept calls from privileged modes, to provide some
 798                semblance of security.  */
 799             if (((mask == 0x123456 && !env->thumb)
 800                     || (mask == 0xab && env->thumb))
 801                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 802                 env->regs[0] = do_arm_semihosting(env);
 803                 return;
 804             }
 805         }
 806         new_mode = ARM_CPU_MODE_SVC;
 807         addr = 0x08;
 808         mask = CPSR_I;
 809         /* The PC already points to the next instruction.  */
 810         offset = 0;
 811         break;
 812     case EXCP_BKPT:
 813         /* See if this is a semihosting syscall.  */
 814         if (env->thumb && semihosting_enabled) {
 815             mask = lduw_code(env->regs[15]) & 0xff;
 816             if (mask == 0xab
 817                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 818                 env->regs[15] += 2;
 819                 env->regs[0] = do_arm_semihosting(env);
 820                 return;
 821             }
 822         }
 823         /* Fall through to prefetch abort.  */
 824     case EXCP_PREFETCH_ABORT:
 825         new_mode = ARM_CPU_MODE_ABT;
 826         addr = 0x0c;
 827         mask = CPSR_A | CPSR_I;
 828         offset = 4;
 829         break;
 830     case EXCP_DATA_ABORT:
 831         new_mode = ARM_CPU_MODE_ABT;
 832         addr = 0x10;
 833         mask = CPSR_A | CPSR_I;
 834         offset = 8;
 835         break;
 836     case EXCP_IRQ:
 837         new_mode = ARM_CPU_MODE_IRQ;
 838         addr = 0x18;
 839         /* Disable IRQ and imprecise data aborts.  */
 840         mask = CPSR_A | CPSR_I;
 841         offset = 4;
 842         break;
 843     case EXCP_FIQ:
 844         new_mode = ARM_CPU_MODE_FIQ;
 845         addr = 0x1c;
 846         /* Disable FIQ, IRQ and imprecise data aborts.  */
 847         mask = CPSR_A | CPSR_I | CPSR_F;
 848         offset = 4;
 849         break;
 850     default:
 851         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 852         return; /* Never happens.  Keep compiler happy.  */
 853     }
 854     /* High vectors.  */
 855     if (env->cp15.c1_sys & (1 << 13)) {
 856         addr += 0xffff0000;
 857     }
 858     switch_mode (env, new_mode);
 859     env->spsr = cpsr_read(env);
 860     /* Clear IT bits.  */
 861     env->condexec_bits = 0;
 862     /* Switch to the new mode, and switch to Arm mode.  */
 863     /* ??? Thumb interrupt handlers not implemented.  */
 864     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
 865     env->uncached_cpsr |= mask;
 866     env->thumb = 0;
 867     env->regs[14] = env->regs[15] + offset;
 868     env->regs[15] = addr;
 869     env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 870 }
 871
 872 /* Check section/page access permissions.
 873    Returns the page protection flags, or zero if the access is not
 874    permitted.  */
 875 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
 876                            int is_user)
 877 {
 878   int prot_ro;
 879
 880   if (domain == 3)
 881     return PAGE_READ | PAGE_WRITE;
 882
 883   if (access_type == 1)
 884       prot_ro = 0;
 885   else
 886       prot_ro = PAGE_READ;
 887
 888   switch (ap) {
 889   case 0:
 890       if (access_type == 1)
 891           return 0;
 892       switch ((env->cp15.c1_sys >> 8) & 3) {
 893       case 1:
 894           return is_user ? 0 : PAGE_READ;
 895       case 2:
 896           return PAGE_READ;
 897       default:
 898           return 0;
 899       }
 900   case 1:
 901       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
 902   case 2:
 903       if (is_user)
 904           return prot_ro;
 905       else
 906           return PAGE_READ | PAGE_WRITE;
 907   case 3:
 908       return PAGE_READ | PAGE_WRITE;
 909   case 4: /* Reserved.  */
 910       return 0;
 911   case 5:
 912       return is_user ? 0 : prot_ro;
 913   case 6:
 914       return prot_ro;
 915   case 7:
 916       if (!arm_feature (env, ARM_FEATURE_V7))
 917           return 0;
 918       return prot_ro;
 919   default:
 920       abort();
 921   }
 922 }
 923
 924 static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
 925 {
 926     uint32_t table;
 927
 928     if (address & env->cp15.c2_mask)
 929         table = env->cp15.c2_base1 & 0xffffc000;
 930     else
 931         table = env->cp15.c2_base0 & env->cp15.c2_base_mask;
 932
 933     table |= (address >> 18) & 0x3ffc;
 934     return table;
 935 }
 936
 937 static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
 938                             int is_user, uint32_t *phys_ptr, int *prot)
 939 {
 940     int code;
 941     uint32_t table;
 942     uint32_t desc;
 943     int type;
 944     int ap;
 945     int domain;
 946     uint32_t phys_addr;
 947
 948     /* Pagetable walk.  */
 949     /* Lookup l1 descriptor.  */
 950     table = get_level1_table_address(env, address);
 951     desc = ldl_phys(table);
 952     type = (desc & 3);
 953     domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
 954     if (type == 0) {
 955         /* Section translation fault.  */
 956         code = 5;
 957         goto do_fault;
 958     }
 959     if (domain == 0 || domain == 2) {
 960         if (type == 2)
 961             code = 9; /* Section domain fault.  */
 962         else
 963             code = 11; /* Page domain fault.  */
 964         goto do_fault;
 965     }
 966     if (type == 2) {
 967         /* 1Mb section.  */
 968         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
 969         ap = (desc >> 10) & 3;
 970         code = 13;
 971     } else {
 972         /* Lookup l2 entry.  */
 973         if (type == 1) {
 974             /* Coarse pagetable.  */
 975             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
 976         } else {
 977             /* Fine pagetable.  */
 978             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
 979         }
 980         desc = ldl_phys(table);
 981         switch (desc & 3) {
 982         case 0: /* Page translation fault.  */
 983             code = 7;
 984             goto do_fault;
 985         case 1: /* 64k page.  */
 986             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
 987             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 988             break;
 989         case 2: /* 4k page.  */
 990             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 991             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 992             break;
 993         case 3: /* 1k page.  */
 994             if (type == 1) {
 995                 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
 996                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 997                 } else {
 998                     /* Page translation fault.  */
 999                     code = 7;
1000                     goto do_fault;
1001                 }
1002             } else {
1003                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
1004             }
1005             ap = (desc >> 4) & 3;
1006             break;
1007         default:
1008             /* Never happens, but compiler isn't smart enough to tell.  */
1009             abort();
1010         }
1011         code = 15;
1012     }
1013     *prot = check_ap(env, ap, domain, access_type, is_user);
1014     if (!*prot) {
1015         /* Access permission fault.  */
1016         goto do_fault;
1017     }
1018     *phys_ptr = phys_addr;
1019     return 0;
1020 do_fault:
1021     return code | (domain << 4);
1022 }
1023
1024 static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
1025                             int is_user, uint32_t *phys_ptr, int *prot)
1026 {
1027     int code;
1028     uint32_t table;
1029     uint32_t desc;
1030     uint32_t xn;
1031     int type;
1032     int ap;
1033     int domain;
1034     uint32_t phys_addr;
1035
1036     /* Pagetable walk.  */
1037     /* Lookup l1 descriptor.  */
1038     table = get_level1_table_address(env, address);
1039     desc = ldl_phys(table);
1040     type = (desc & 3);
1041     if (type == 0) {
1042         /* Section translation fault.  */
1043         code = 5;
1044         domain = 0;
1045         goto do_fault;
1046     } else if (type == 2 && (desc & (1 << 18))) {
1047         /* Supersection.  */
1048         domain = 0;
1049     } else {
1050         /* Section or page.  */
1051         domain = (desc >> 4) & 0x1e;
1052     }
1053     domain = (env->cp15.c3 >> domain) & 3;
1054     if (domain == 0 || domain == 2) {
1055         if (type == 2)
1056             code = 9; /* Section domain fault.  */
1057         else
1058             code = 11; /* Page domain fault.  */
1059         goto do_fault;
1060     }
1061     if (type == 2) {
1062         if (desc & (1 << 18)) {
1063             /* Supersection.  */
1064             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1065         } else {
1066             /* Section.  */
1067             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1068         }
1069         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1070         xn = desc & (1 << 4);
1071         code = 13;
1072     } else {
1073         /* Lookup l2 entry.  */
1074         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1075         desc = ldl_phys(table);
1076         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1077         switch (desc & 3) {
1078         case 0: /* Page translation fault.  */
1079             code = 7;
1080             goto do_fault;
1081         case 1: /* 64k page.  */
1082             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1083             xn = desc & (1 << 15);
1084             break;
1085         case 2: case 3: /* 4k page.  */
1086             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1087             xn = desc & 1;
1088             break;
1089         default:
1090             /* Never happens, but compiler isn't smart enough to tell.  */
1091             abort();
1092         }
1093         code = 15;
1094     }
1095     if (xn && access_type == 2)
1096         goto do_fault;
1097
1098     /* The simplified model uses AP[0] as an access control bit.  */
1099     if ((env->cp15.c1_sys & (1 << 29)) && (ap & 1) == 0) {
1100         /* Access flag fault.  */
1101         code = (code == 15) ? 6 : 3;
1102         goto do_fault;
1103     }
1104     *prot = check_ap(env, ap, domain, access_type, is_user);
1105     if (!*prot) {
1106         /* Access permission fault.  */
1107         goto do_fault;
1108     }
1109     *phys_ptr = phys_addr;
1110     return 0;
1111 do_fault:
1112     return code | (domain << 4);
1113 }
1114
1115 static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
1116                              int is_user, uint32_t *phys_ptr, int *prot)
1117 {
1118     int n;
1119     uint32_t mask;
1120     uint32_t base;
1121
1122     *phys_ptr = address;
1123     for (n = 7; n >= 0; n--) {
1124         base = env->cp15.c6_region[n];
1125         if ((base & 1) == 0)
1126             continue;
1127         mask = 1 << ((base >> 1) & 0x1f);
1128         /* Keep this shift separate from the above to avoid an
1129            (undefined) << 32.  */
1130         mask = (mask << 1) - 1;
1131         if (((base ^ address) & ~mask) == 0)
1132             break;
1133     }
1134     if (n < 0)
1135         return 2;
1136
1137     if (access_type == 2) {
1138         mask = env->cp15.c5_insn;
1139     } else {
1140         mask = env->cp15.c5_data;
1141     }
1142     mask = (mask >> (n * 4)) & 0xf;
1143     switch (mask) {
1144     case 0:
1145         return 1;
1146     case 1:
1147         if (is_user)
1148           return 1;
1149         *prot = PAGE_READ | PAGE_WRITE;
1150         break;
1151     case 2:
1152         *prot = PAGE_READ;
1153         if (!is_user)
1154             *prot |= PAGE_WRITE;
1155         break;
1156     case 3:
1157         *prot = PAGE_READ | PAGE_WRITE;
1158         break;
1159     case 5:
1160         if (is_user)
1161             return 1;
1162         *prot = PAGE_READ;
1163         break;
1164     case 6:
1165         *prot = PAGE_READ;
1166         break;
1167     default:
1168         /* Bad permission.  */
1169         return 1;
1170     }
1171     return 0;
1172 }
1173
1174 static inline int get_phys_addr(CPUState *env, uint32_t address,
1175                                 int access_type, int is_user,
1176                                 uint32_t *phys_ptr, int *prot)
1177 {
1178     /* Fast Context Switch Extension.  */
1179     if (address < 0x02000000)
1180         address += env->cp15.c13_fcse;
1181
1182     if ((env->cp15.c1_sys & 1) == 0) {
1183         /* MMU/MPU disabled.  */
1184         *phys_ptr = address;
1185         *prot = PAGE_READ | PAGE_WRITE;
1186         return 0;
1187     } else if (arm_feature(env, ARM_FEATURE_MPU)) {
1188         return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
1189                                  prot);
1190     } else if (env->cp15.c1_sys & (1 << 23)) {
1191         return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
1192                                 prot);
1193     } else {
1194         return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
1195                                 prot);
1196     }
1197 }
1198
1199 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
1200                               int access_type, int mmu_idx, int is_softmmu)
1201 {
1202     uint32_t phys_addr;
1203     int prot;
1204     int ret, is_user;
1205
1206     is_user = mmu_idx == MMU_USER_IDX;
1207     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
1208     if (ret == 0) {
1209         /* Map a single [sub]page.  */
1210         phys_addr &= ~(uint32_t)0x3ff;
1211         address &= ~(uint32_t)0x3ff;
1212         return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
1213                              is_softmmu);
1214     }
1215
1216     if (access_type == 2) {
1217         env->cp15.c5_insn = ret;
1218         env->cp15.c6_insn = address;
1219         env->exception_index = EXCP_PREFETCH_ABORT;
1220     } else {
1221         env->cp15.c5_data = ret;
1222         if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
1223             env->cp15.c5_data |= (1 << 11);
1224         env->cp15.c6_data = address;
1225         env->exception_index = EXCP_DATA_ABORT;
1226     }
1227     return 1;
1228 }
1229
1230 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
1231 {
1232     uint32_t phys_addr;
1233     int prot;
1234     int ret;
1235
1236     ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
1237
1238     if (ret != 0)
1239         return -1;
1240
1241     return phys_addr;
1242 }
1243
1244 /* Not really implemented.  Need to figure out a sane way of doing this.
1245    Maybe add generic watchpoint support and use that.  */
1246
1247 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
1248 {
1249     env->mmon_addr = addr;
1250 }
1251
1252 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
1253 {
1254     return (env->mmon_addr != addr);
1255 }
1256
1257 void HELPER(clrex)(CPUState *env)
1258 {
1259     env->mmon_addr = -1;
1260 }
1261
1262 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
1263 {
1264     int cp_num = (insn >> 8) & 0xf;
1265     int cp_info = (insn >> 5) & 7;
1266     int src = (insn >> 16) & 0xf;
1267     int operand = insn & 0xf;
1268
1269     if (env->cp[cp_num].cp_write)
1270         env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
1271                                  cp_info, src, operand, val);
1272 }
1273
1274 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
1275 {
1276     int cp_num = (insn >> 8) & 0xf;
1277     int cp_info = (insn >> 5) & 7;
1278     int dest = (insn >> 16) & 0xf;
1279     int operand = insn & 0xf;
1280
1281     if (env->cp[cp_num].cp_read)
1282         return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
1283                                        cp_info, dest, operand);
1284     return 0;
1285 }
1286
1287 /* Return basic MPU access permission bits.  */
1288 static uint32_t simple_mpu_ap_bits(uint32_t val)
1289 {
1290     uint32_t ret;
1291     uint32_t mask;
1292     int i;
1293     ret = 0;
1294     mask = 3;
1295     for (i = 0; i < 16; i += 2) {
1296         ret |= (val >> i) & mask;
1297         mask <<= 2;
1298     }
1299     return ret;
1300 }
1301
1302 /* Pad basic MPU access permission bits to extended format.  */
1303 static uint32_t extended_mpu_ap_bits(uint32_t val)
1304 {
1305     uint32_t ret;
1306     uint32_t mask;
1307     int i;
1308     ret = 0;
1309     mask = 3;
1310     for (i = 0; i < 16; i += 2) {
1311         ret |= (val & mask) << i;
1312         mask <<= 2;
1313     }
1314     return ret;
1315 }
1316
1317 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
1318 {
1319     int op1;
1320     int op2;
1321     int crm;
1322
1323     op1 = (insn >> 21) & 7;
1324     op2 = (insn >> 5) & 7;
1325     crm = insn & 0xf;
1326     switch ((insn >> 16) & 0xf) {
1327     case 0:
1328         /* ID codes.  */
1329         if (arm_feature(env, ARM_FEATURE_XSCALE))
1330             break;
1331         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1332             break;
1333         if (arm_feature(env, ARM_FEATURE_V7)
1334                 && op1 == 2 && crm == 0 && op2 == 0) {
1335             env->cp15.c0_cssel = val & 0xf;
1336             break;
1337         }
1338         goto bad_reg;
1339     case 1: /* System configuration.  */
1340         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1341             op2 = 0;
1342         switch (op2) {
1343         case 0:
1344             if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
1345                 env->cp15.c1_sys = val;
1346             /* ??? Lots of these bits are not implemented.  */
1347             /* This may enable/disable the MMU, so do a TLB flush.  */
1348             tlb_flush(env, 1);
1349             break;
1350         case 1: /* Auxiliary cotrol register.  */
1351             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1352                 env->cp15.c1_xscaleauxcr = val;
1353                 break;
1354             }
1355             /* Not implemented.  */
1356             break;
1357         case 2:
1358             if (arm_feature(env, ARM_FEATURE_XSCALE))
1359                 goto bad_reg;
1360             if (env->cp15.c1_coproc != val) {
1361                 env->cp15.c1_coproc = val;
1362                 /* ??? Is this safe when called from within a TB?  */
1363                 tb_flush(env);
1364             }
1365             break;
1366         default:
1367             goto bad_reg;
1368         }
1369         break;
1370     case 2: /* MMU Page table control / MPU cache control.  */
1371         if (arm_feature(env, ARM_FEATURE_MPU)) {
1372             switch (op2) {
1373             case 0:
1374                 env->cp15.c2_data = val;
1375                 break;
1376             case 1:
1377                 env->cp15.c2_insn = val;
1378                 break;
1379             default:
1380                 goto bad_reg;
1381             }
1382         } else {
1383             switch (op2) {
1384             case 0:
1385                 env->cp15.c2_base0 = val;
1386                 break;
1387             case 1:
1388                 env->cp15.c2_base1 = val;
1389                 break;
1390             case 2:
1391                 val &= 7;
1392                 env->cp15.c2_control = val;
1393                 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
1394                 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> val);
1395                 break;
1396             default:
1397                 goto bad_reg;
1398             }
1399         }
1400         break;
1401     case 3: /* MMU Domain access control / MPU write buffer control.  */
1402         env->cp15.c3 = val;
1403         tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
1404         break;
1405     case 4: /* Reserved.  */
1406         goto bad_reg;
1407     case 5: /* MMU Fault status / MPU access permission.  */
1408         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1409             op2 = 0;
1410         switch (op2) {
1411         case 0:
1412             if (arm_feature(env, ARM_FEATURE_MPU))
1413                 val = extended_mpu_ap_bits(val);
1414             env->cp15.c5_data = val;
1415             break;
1416         case 1:
1417             if (arm_feature(env, ARM_FEATURE_MPU))
1418                 val = extended_mpu_ap_bits(val);
1419             env->cp15.c5_insn = val;
1420             break;
1421         case 2:
1422             if (!arm_feature(env, ARM_FEATURE_MPU))
1423                 goto bad_reg;
1424             env->cp15.c5_data = val;
1425             break;
1426         case 3:
1427             if (!arm_feature(env, ARM_FEATURE_MPU))
1428                 goto bad_reg;
1429             env->cp15.c5_insn = val;
1430             break;
1431         default:
1432             goto bad_reg;
1433         }
1434         break;
1435     case 6: /* MMU Fault address / MPU base/size.  */
1436         if (arm_feature(env, ARM_FEATURE_MPU)) {
1437             if (crm >= 8)
1438                 goto bad_reg;
1439             env->cp15.c6_region[crm] = val;
1440         } else {
1441             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1442                 op2 = 0;
1443             switch (op2) {
1444             case 0:
1445                 env->cp15.c6_data = val;
1446                 break;
1447             case 1: /* ??? This is WFAR on armv6 */
1448             case 2:
1449                 env->cp15.c6_insn = val;
1450                 break;
1451             default:
1452                 goto bad_reg;
1453             }
1454         }
1455         break;
1456     case 7: /* Cache control.  */
1457         env->cp15.c15_i_max = 0x000;
1458         env->cp15.c15_i_min = 0xff0;
1459         /* No cache, so nothing to do.  */
1460         /* ??? MPCore has VA to PA translation functions.  */
1461         break;
1462     case 8: /* MMU TLB control.  */
1463         switch (op2) {
1464         case 0: /* Invalidate all.  */
1465             tlb_flush(env, 0);
1466             break;
1467         case 1: /* Invalidate single TLB entry.  */
1468 #if 0
1469             /* ??? This is wrong for large pages and sections.  */
1470             /* As an ugly hack to make linux work we always flush a 4K
1471                pages.  */
1472             val &= 0xfffff000;
1473             tlb_flush_page(env, val);
1474             tlb_flush_page(env, val + 0x400);
1475             tlb_flush_page(env, val + 0x800);
1476             tlb_flush_page(env, val + 0xc00);
1477 #else
1478             tlb_flush(env, 1);
1479 #endif
1480             break;
1481         case 2: /* Invalidate on ASID.  */
1482             tlb_flush(env, val == 0);
1483             break;
1484         case 3: /* Invalidate single entry on MVA.  */
1485             /* ??? This is like case 1, but ignores ASID.  */
1486             tlb_flush(env, 1);
1487             break;
1488         default:
1489             goto bad_reg;
1490         }
1491         break;
1492     case 9:
1493         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1494             break;
1495         switch (crm) {
1496         case 0: /* Cache lockdown.  */
1497             switch (op1) {
1498             case 0: /* L1 cache.  */
1499                 switch (op2) {
1500                 case 0:
1501                     env->cp15.c9_data = val;
1502                     break;
1503                 case 1:
1504                     env->cp15.c9_insn = val;
1505                     break;
1506                 default:
1507                     goto bad_reg;
1508                 }
1509                 break;
1510             case 1: /* L2 cache.  */
1511                 /* Ignore writes to L2 lockdown/auxiliary registers.  */
1512                 break;
1513             default:
1514                 goto bad_reg;
1515             }
1516             break;
1517         case 1: /* TCM memory region registers.  */
1518             /* Not implemented.  */
1519             goto bad_reg;
1520         default:
1521             goto bad_reg;
1522         }
1523         break;
1524     case 10: /* MMU TLB lockdown.  */
1525         /* ??? TLB lockdown not implemented.  */
1526         break;
1527     case 12: /* Reserved.  */
1528         goto bad_reg;
1529     case 13: /* Process ID.  */
1530         switch (op2) {
1531         case 0:
1532             /* Unlike real hardware the qemu TLB uses virtual addresses,
1533                not modified virtual addresses, so this causes a TLB flush.
1534              */
1535             if (env->cp15.c13_fcse != val)
1536               tlb_flush(env, 1);
1537             env->cp15.c13_fcse = val;
1538             break;
1539         case 1:
1540             /* This changes the ASID, so do a TLB flush.  */
1541             if (env->cp15.c13_context != val
1542                 && !arm_feature(env, ARM_FEATURE_MPU))
1543               tlb_flush(env, 0);
1544             env->cp15.c13_context = val;
1545             break;
1546         case 2:
1547             env->cp15.c13_tls1 = val;
1548             break;
1549         case 3:
1550             env->cp15.c13_tls2 = val;
1551             break;
1552         case 4:
1553             env->cp15.c13_tls3 = val;
1554             break;
1555         default:
1556             goto bad_reg;
1557         }
1558         break;
1559     case 14: /* Reserved.  */
1560         goto bad_reg;
1561     case 15: /* Implementation specific.  */
1562         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1563             if (op2 == 0 && crm == 1) {
1564                 if (env->cp15.c15_cpar != (val & 0x3fff)) {
1565                     /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
1566                     tb_flush(env);
1567                     env->cp15.c15_cpar = val & 0x3fff;
1568                 }
1569                 break;
1570             }
1571             goto bad_reg;
1572         }
1573         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1574             switch (crm) {
1575             case 0:
1576                 break;
1577             case 1: /* Set TI925T configuration.  */
1578                 env->cp15.c15_ticonfig = val & 0xe7;
1579                 env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
1580                         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1581                 break;
1582             case 2: /* Set I_max.  */
1583                 env->cp15.c15_i_max = val;
1584                 break;
1585             case 3: /* Set I_min.  */
1586                 env->cp15.c15_i_min = val;
1587                 break;
1588             case 4: /* Set thread-ID.  */
1589                 env->cp15.c15_threadid = val & 0xffff;
1590                 break;
1591             case 8: /* Wait-for-interrupt (deprecated).  */
1592                 cpu_interrupt(env, CPU_INTERRUPT_HALT);
1593                 break;
1594             default:
1595                 goto bad_reg;
1596             }
1597         }
1598         break;
1599     }
1600     return;
1601 bad_reg:
1602     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1603     cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
1604               (insn >> 16) & 0xf, crm, op1, op2);
1605 }
1606
1607 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
1608 {
1609     int op1;
1610     int op2;
1611     int crm;
1612
1613     op1 = (insn >> 21) & 7;
1614     op2 = (insn >> 5) & 7;
1615     crm = insn & 0xf;
1616     switch ((insn >> 16) & 0xf) {
1617     case 0: /* ID codes.  */
1618         switch (op1) {
1619         case 0:
1620             switch (crm) {
1621             case 0:
1622                 switch (op2) {
1623                 case 0: /* Device ID.  */
1624                     return env->cp15.c0_cpuid;
1625                 case 1: /* Cache Type.  */
1626                     return env->cp15.c0_cachetype;
1627                 case 2: /* TCM status.  */
1628                     return 0;
1629                 case 3: /* TLB type register.  */
1630                     return 0; /* No lockable TLB entries.  */
1631                 case 5: /* CPU ID */
1632                     return env->cpu_index;
1633                 default:
1634                     goto bad_reg;
1635                 }
1636             case 1:
1637                 if (!arm_feature(env, ARM_FEATURE_V6))
1638                     goto bad_reg;
1639                 return env->cp15.c0_c1[op2];
1640             case 2:
1641                 if (!arm_feature(env, ARM_FEATURE_V6))
1642                     goto bad_reg;
1643                 return env->cp15.c0_c2[op2];
1644             case 3: case 4: case 5: case 6: case 7:
1645                 return 0;
1646             default:
1647                 goto bad_reg;
1648             }
1649         case 1:
1650             /* These registers aren't documented on arm11 cores.  However
1651                Linux looks at them anyway.  */
1652             if (!arm_feature(env, ARM_FEATURE_V6))
1653                 goto bad_reg;
1654             if (crm != 0)
1655                 goto bad_reg;
1656             if (!arm_feature(env, ARM_FEATURE_V7))
1657                 return 0;
1658
1659             switch (op2) {
1660             case 0:
1661                 return env->cp15.c0_ccsid[env->cp15.c0_cssel];
1662             case 1:
1663                 return env->cp15.c0_clid;
1664             case 7:
1665                 return 0;
1666             }
1667             goto bad_reg;
1668         case 2:
1669             if (op2 != 0 || crm != 0)
1670                 goto bad_reg;
1671             return env->cp15.c0_cssel;
1672         default:
1673             goto bad_reg;
1674         }
1675     case 1: /* System configuration.  */
1676         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1677             op2 = 0;
1678         switch (op2) {
1679         case 0: /* Control register.  */
1680             return env->cp15.c1_sys;
1681         case 1: /* Auxiliary control register.  */
1682             if (arm_feature(env, ARM_FEATURE_XSCALE))
1683                 return env->cp15.c1_xscaleauxcr;
1684             if (!arm_feature(env, ARM_FEATURE_AUXCR))
1685                 goto bad_reg;
1686             switch (ARM_CPUID(env)) {
1687             case ARM_CPUID_ARM1026:
1688                 return 1;
1689             case ARM_CPUID_ARM1136:
1690             case ARM_CPUID_ARM1136_R2:
1691                 return 7;
1692             case ARM_CPUID_ARM11MPCORE:
1693                 return 1;
1694             case ARM_CPUID_CORTEXA8:
1695                 return 0;
1696             default:
1697                 goto bad_reg;
1698             }
1699         case 2: /* Coprocessor access register.  */
1700             if (arm_feature(env, ARM_FEATURE_XSCALE))
1701                 goto bad_reg;
1702             return env->cp15.c1_coproc;
1703         default:
1704             goto bad_reg;
1705         }
1706     case 2: /* MMU Page table control / MPU cache control.  */
1707         if (arm_feature(env, ARM_FEATURE_MPU)) {
1708             switch (op2) {
1709             case 0:
1710                 return env->cp15.c2_data;
1711                 break;
1712             case 1:
1713                 return env->cp15.c2_insn;
1714                 break;
1715             default:
1716                 goto bad_reg;
1717             }
1718         } else {
1719             switch (op2) {
1720             case 0:
1721                 return env->cp15.c2_base0;
1722             case 1:
1723                 return env->cp15.c2_base1;
1724             case 2:
1725                 return env->cp15.c2_control;
1726             default:
1727                 goto bad_reg;
1728             }
1729         }
1730     case 3: /* MMU Domain access control / MPU write buffer control.  */
1731         return env->cp15.c3;
1732     case 4: /* Reserved.  */
1733         goto bad_reg;
1734     case 5: /* MMU Fault status / MPU access permission.  */
1735         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1736             op2 = 0;
1737         switch (op2) {
1738         case 0:
1739             if (arm_feature(env, ARM_FEATURE_MPU))
1740                 return simple_mpu_ap_bits(env->cp15.c5_data);
1741             return env->cp15.c5_data;
1742         case 1:
1743             if (arm_feature(env, ARM_FEATURE_MPU))
1744                 return simple_mpu_ap_bits(env->cp15.c5_data);
1745             return env->cp15.c5_insn;
1746         case 2:
1747             if (!arm_feature(env, ARM_FEATURE_MPU))
1748                 goto bad_reg;
1749             return env->cp15.c5_data;
1750         case 3:
1751             if (!arm_feature(env, ARM_FEATURE_MPU))
1752                 goto bad_reg;
1753             return env->cp15.c5_insn;
1754         default:
1755             goto bad_reg;
1756         }
1757     case 6: /* MMU Fault address.  */
1758         if (arm_feature(env, ARM_FEATURE_MPU)) {
1759             if (crm >= 8)
1760                 goto bad_reg;
1761             return env->cp15.c6_region[crm];
1762         } else {
1763             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1764                 op2 = 0;
1765             switch (op2) {
1766             case 0:
1767                 return env->cp15.c6_data;
1768             case 1:
1769                 if (arm_feature(env, ARM_FEATURE_V6)) {
1770                     /* Watchpoint Fault Adrress.  */
1771                     return 0; /* Not implemented.  */
1772                 } else {
1773                     /* Instruction Fault Adrress.  */
1774                     /* Arm9 doesn't have an IFAR, but implementing it anyway
1775                        shouldn't do any harm.  */
1776                     return env->cp15.c6_insn;
1777                 }
1778             case 2:
1779                 if (arm_feature(env, ARM_FEATURE_V6)) {
1780                     /* Instruction Fault Adrress.  */
1781                     return env->cp15.c6_insn;
1782                 } else {
1783                     goto bad_reg;
1784                 }
1785             default:
1786                 goto bad_reg;
1787             }
1788         }
1789     case 7: /* Cache control.  */
1790         /* FIXME: Should only clear Z flag if destination is r15.  */
1791         env->ZF = 0;
1792         return 0;
1793     case 8: /* MMU TLB control.  */
1794         goto bad_reg;
1795     case 9: /* Cache lockdown.  */
1796         switch (op1) {
1797         case 0: /* L1 cache.  */
1798             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1799                 return 0;
1800             switch (op2) {
1801             case 0:
1802                 return env->cp15.c9_data;
1803             case 1:
1804                 return env->cp15.c9_insn;
1805             default:
1806                 goto bad_reg;
1807             }
1808         case 1: /* L2 cache */
1809             if (crm != 0)
1810                 goto bad_reg;
1811             /* L2 Lockdown and Auxiliary control.  */
1812             return 0;
1813         default:
1814             goto bad_reg;
1815         }
1816     case 10: /* MMU TLB lockdown.  */
1817         /* ??? TLB lockdown not implemented.  */
1818         return 0;
1819     case 11: /* TCM DMA control.  */
1820     case 12: /* Reserved.  */
1821         goto bad_reg;
1822     case 13: /* Process ID.  */
1823         switch (op2) {
1824         case 0:
1825             return env->cp15.c13_fcse;
1826         case 1:
1827             return env->cp15.c13_context;
1828         case 2:
1829             return env->cp15.c13_tls1;
1830         case 3:
1831             return env->cp15.c13_tls2;
1832         case 4:
1833             return env->cp15.c13_tls3;
1834         default:
1835             goto bad_reg;
1836         }
1837     case 14: /* Reserved.  */
1838         goto bad_reg;
1839     case 15: /* Implementation specific.  */
1840         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1841             if (op2 == 0 && crm == 1)
1842                 return env->cp15.c15_cpar;
1843
1844             goto bad_reg;
1845         }
1846         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1847             switch (crm) {
1848             case 0:
1849                 return 0;
1850             case 1: /* Read TI925T configuration.  */
1851                 return env->cp15.c15_ticonfig;
1852             case 2: /* Read I_max.  */
1853                 return env->cp15.c15_i_max;
1854             case 3: /* Read I_min.  */
1855                 return env->cp15.c15_i_min;
1856             case 4: /* Read thread-ID.  */
1857                 return env->cp15.c15_threadid;
1858             case 8: /* TI925T_status */
1859                 return 0;
1860             }
1861             /* TODO: Peripheral port remap register:
1862              * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
1863              * controller base address at $rn & ~0xfff and map size of
1864              * 0x200 << ($rn & 0xfff), when MMU is off.  */
1865             goto bad_reg;
1866         }
1867         return 0;
1868     }
1869 bad_reg:
1870     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1871     cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
1872               (insn >> 16) & 0xf, crm, op1, op2);
1873     return 0;
1874 }
1875
1876 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
1877 {
1878     env->banked_r13[bank_number(mode)] = val;
1879 }
1880
1881 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
1882 {
1883     return env->banked_r13[bank_number(mode)];
1884 }
1885
1886 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
1887 {
1888     switch (reg) {
1889     case 0: /* APSR */
1890         return xpsr_read(env) & 0xf8000000;
1891     case 1: /* IAPSR */
1892         return xpsr_read(env) & 0xf80001ff;
1893     case 2: /* EAPSR */
1894         return xpsr_read(env) & 0xff00fc00;
1895     case 3: /* xPSR */
1896         return xpsr_read(env) & 0xff00fdff;
1897     case 5: /* IPSR */
1898         return xpsr_read(env) & 0x000001ff;
1899     case 6: /* EPSR */
1900         return xpsr_read(env) & 0x0700fc00;
1901     case 7: /* IEPSR */
1902         return xpsr_read(env) & 0x0700edff;
1903     case 8: /* MSP */
1904         return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
1905     case 9: /* PSP */
1906         return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
1907     case 16: /* PRIMASK */
1908         return (env->uncached_cpsr & CPSR_I) != 0;
1909     case 17: /* FAULTMASK */
1910         return (env->uncached_cpsr & CPSR_F) != 0;
1911     case 18: /* BASEPRI */
1912     case 19: /* BASEPRI_MAX */
1913         return env->v7m.basepri;
1914     case 20: /* CONTROL */
1915         return env->v7m.control;
1916     default:
1917         /* ??? For debugging only.  */
1918         cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
1919         return 0;
1920     }
1921 }
1922
1923 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
1924 {
1925     switch (reg) {
1926     case 0: /* APSR */
1927         xpsr_write(env, val, 0xf8000000);
1928         break;
1929     case 1: /* IAPSR */
1930         xpsr_write(env, val, 0xf8000000);
1931         break;
1932     case 2: /* EAPSR */
1933         xpsr_write(env, val, 0xfe00fc00);
1934         break;
1935     case 3: /* xPSR */
1936         xpsr_write(env, val, 0xfe00fc00);
1937         break;
1938     case 5: /* IPSR */
1939         /* IPSR bits are readonly.  */
1940         break;
1941     case 6: /* EPSR */
1942         xpsr_write(env, val, 0x0600fc00);
1943         break;
1944     case 7: /* IEPSR */
1945         xpsr_write(env, val, 0x0600fc00);
1946         break;
1947     case 8: /* MSP */
1948         if (env->v7m.current_sp)
1949             env->v7m.other_sp = val;
1950         else
1951             env->regs[13] = val;
1952         break;
1953     case 9: /* PSP */
1954         if (env->v7m.current_sp)
1955             env->regs[13] = val;
1956         else
1957             env->v7m.other_sp = val;
1958         break;
1959     case 16: /* PRIMASK */
1960         if (val & 1)
1961             env->uncached_cpsr |= CPSR_I;
1962         else
1963             env->uncached_cpsr &= ~CPSR_I;
1964         break;
1965     case 17: /* FAULTMASK */
1966         if (val & 1)
1967             env->uncached_cpsr |= CPSR_F;
1968         else
1969             env->uncached_cpsr &= ~CPSR_F;
1970         break;
1971     case 18: /* BASEPRI */
1972         env->v7m.basepri = val & 0xff;
1973         break;
1974     case 19: /* BASEPRI_MAX */
1975         val &= 0xff;
1976         if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
1977             env->v7m.basepri = val;
1978         break;
1979     case 20: /* CONTROL */
1980         env->v7m.control = val & 3;
1981         switch_v7m_sp(env, (val & 2) != 0);
1982         break;
1983     default:
1984         /* ??? For debugging only.  */
1985         cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
1986         return;
1987     }
1988 }
1989
1990 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
1991                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
1992                 void *opaque)
1993 {
1994     if (cpnum < 0 || cpnum > 14) {
1995         cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
1996         return;
1997     }
1998
1999     env->cp[cpnum].cp_read = cp_read;
2000     env->cp[cpnum].cp_write = cp_write;
2001     env->cp[cpnum].opaque = opaque;
2002 }
2003
2004 #endif
2005
2006 /* Note that signed overflow is undefined in C.  The following routines are
2007    careful to use unsigned types where modulo arithmetic is required.
2008    Failure to do so _will_ break on newer gcc.  */
2009
2010 /* Signed saturating arithmetic.  */
2011
2012 /* Perform 16-bit signed saturating addition.  */
2013 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
2014 {
2015     uint16_t res;
2016
2017     res = a + b;
2018     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
2019         if (a & 0x8000)
2020             res = 0x8000;
2021         else
2022             res = 0x7fff;
2023     }
2024     return res;
2025 }
2026
2027 /* Perform 8-bit signed saturating addition.  */
2028 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
2029 {
2030     uint8_t res;
2031
2032     res = a + b;
2033     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
2034         if (a & 0x80)
2035             res = 0x80;
2036         else
2037             res = 0x7f;
2038     }
2039     return res;
2040 }
2041
2042 /* Perform 16-bit signed saturating subtraction.  */
2043 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
2044 {
2045     uint16_t res;
2046
2047     res = a - b;
2048     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
2049         if (a & 0x8000)
2050             res = 0x8000;
2051         else
2052             res = 0x7fff;
2053     }
2054     return res;
2055 }
2056
2057 /* Perform 8-bit signed saturating subtraction.  */
2058 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
2059 {
2060     uint8_t res;
2061
2062     res = a - b;
2063     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
2064         if (a & 0x80)
2065             res = 0x80;
2066         else
2067             res = 0x7f;
2068     }
2069     return res;
2070 }
2071
2072 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
2073 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
2074 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
2075 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
2076 #define PFX q
2077
2078 #include "op_addsub.h"
2079
2080 /* Unsigned saturating arithmetic.  */
2081 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
2082 {
2083     uint16_t res;
2084     res = a + b;
2085     if (res < a)
2086         res = 0xffff;
2087     return res;
2088 }
2089
2090 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
2091 {
2092     if (a < b)
2093         return a - b;
2094     else
2095         return 0;
2096 }
2097
2098 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
2099 {
2100     uint8_t res;
2101     res = a + b;
2102     if (res < a)
2103         res = 0xff;
2104     return res;
2105 }
2106
2107 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
2108 {
2109     if (a < b)
2110         return a - b;
2111     else
2112         return 0;
2113 }
2114
2115 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
2116 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
2117 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
2118 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
2119 #define PFX uq
2120
2121 #include "op_addsub.h"
2122
2123 /* Signed modulo arithmetic.  */
2124 #define SARITH16(a, b, n, op) do { \
2125     int32_t sum; \
2126     sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
2127     RESULT(sum, n, 16); \
2128     if (sum >= 0) \
2129         ge |= 3 << (n * 2); \
2130     } while(0)
2131
2132 #define SARITH8(a, b, n, op) do { \
2133     int32_t sum; \
2134     sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
2135     RESULT(sum, n, 8); \
2136     if (sum >= 0) \
2137         ge |= 1 << n; \
2138     } while(0)
2139
2140
2141 #define ADD16(a, b, n) SARITH16(a, b, n, +)
2142 #define SUB16(a, b, n) SARITH16(a, b, n, -)
2143 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
2144 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
2145 #define PFX s
2146 #define ARITH_GE
2147
2148 #include "op_addsub.h"
2149
2150 /* Unsigned modulo arithmetic.  */
2151 #define ADD16(a, b, n) do { \
2152     uint32_t sum; \
2153     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
2154     RESULT(sum, n, 16); \
2155     if ((sum >> 16) == 1) \
2156         ge |= 3 << (n * 2); \
2157     } while(0)
2158
2159 #define ADD8(a, b, n) do { \
2160     uint32_t sum; \
2161     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
2162     RESULT(sum, n, 8); \
2163     if ((sum >> 8) == 1) \
2164         ge |= 1 << n; \
2165     } while(0)
2166
2167 #define SUB16(a, b, n) do { \
2168     uint32_t sum; \
2169     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
2170     RESULT(sum, n, 16); \
2171     if ((sum >> 16) == 0) \
2172         ge |= 3 << (n * 2); \
2173     } while(0)
2174
2175 #define SUB8(a, b, n) do { \
2176     uint32_t sum; \
2177     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
2178     RESULT(sum, n, 8); \
2179     if ((sum >> 8) == 0) \
2180         ge |= 1 << n; \
2181     } while(0)
2182
2183 #define PFX u
2184 #define ARITH_GE
2185
2186 #include "op_addsub.h"
2187
2188 /* Halved signed arithmetic.  */
2189 #define ADD16(a, b, n) \
2190   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
2191 #define SUB16(a, b, n) \
2192   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
2193 #define ADD8(a, b, n) \
2194   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
2195 #define SUB8(a, b, n) \
2196   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
2197 #define PFX sh
2198
2199 #include "op_addsub.h"
2200
2201 /* Halved unsigned arithmetic.  */
2202 #define ADD16(a, b, n) \
2203   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2204 #define SUB16(a, b, n) \
2205   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2206 #define ADD8(a, b, n) \
2207   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2208 #define SUB8(a, b, n) \
2209   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2210 #define PFX uh
2211
2212 #include "op_addsub.h"
2213
2214 static inline uint8_t do_usad(uint8_t a, uint8_t b)
2215 {
2216     if (a > b)
2217         return a - b;
2218     else
2219         return b - a;
2220 }
2221
2222 /* Unsigned sum of absolute byte differences.  */
2223 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
2224 {
2225     uint32_t sum;
2226     sum = do_usad(a, b);
2227     sum += do_usad(a >> 8, b >> 8);
2228     sum += do_usad(a >> 16, b >>16);
2229     sum += do_usad(a >> 24, b >> 24);
2230     return sum;
2231 }
2232
2233 /* For ARMv6 SEL instruction.  */
2234 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
2235 {
2236     uint32_t mask;
2237
2238     mask = 0;
2239     if (flags & 1)
2240         mask |= 0xff;
2241     if (flags & 2)
2242         mask |= 0xff00;
2243     if (flags & 4)
2244         mask |= 0xff0000;
2245     if (flags & 8)
2246         mask |= 0xff000000;
2247     return (a & mask) | (b & ~mask);
2248 }
2249
2250 uint32_t HELPER(logicq_cc)(uint64_t val)
2251 {
2252     return (val >> 32) | (val != 0);
2253 }
2254
2255 /* VFP support.  We follow the convention used for VFP instrunctions:
2256    Single precition routines have a "s" suffix, double precision a
2257    "d" suffix.  */
2258
2259 /* Convert host exception flags to vfp form.  */
2260 static inline int vfp_exceptbits_from_host(int host_bits)
2261 {
2262     int target_bits = 0;
2263
2264     if (host_bits & float_flag_invalid)
2265         target_bits |= 1;
2266     if (host_bits & float_flag_divbyzero)
2267         target_bits |= 2;
2268     if (host_bits & float_flag_overflow)
2269         target_bits |= 4;
2270     if (host_bits & float_flag_underflow)
2271         target_bits |= 8;
2272     if (host_bits & float_flag_inexact)
2273         target_bits |= 0x10;
2274     return target_bits;
2275 }
2276
2277 uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
2278 {
2279     int i;
2280     uint32_t fpscr;
2281
2282     fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
2283             | (env->vfp.vec_len << 16)
2284             | (env->vfp.vec_stride << 20);
2285     i = get_float_exception_flags(&env->vfp.fp_status);
2286     fpscr |= vfp_exceptbits_from_host(i);
2287     return fpscr;
2288 }
2289
2290 /* Convert vfp exception flags to target form.  */
2291 static inline int vfp_exceptbits_to_host(int target_bits)
2292 {
2293     int host_bits = 0;
2294
2295     if (target_bits & 1)
2296         host_bits |= float_flag_invalid;
2297     if (target_bits & 2)
2298         host_bits |= float_flag_divbyzero;
2299     if (target_bits & 4)
2300         host_bits |= float_flag_overflow;
2301     if (target_bits & 8)
2302         host_bits |= float_flag_underflow;
2303     if (target_bits & 0x10)
2304         host_bits |= float_flag_inexact;
2305     return host_bits;
2306 }
2307
2308 void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
2309 {
2310     int i;
2311     uint32_t changed;
2312
2313     changed = env->vfp.xregs[ARM_VFP_FPSCR];
2314     env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
2315     env->vfp.vec_len = (val >> 16) & 7;
2316     env->vfp.vec_stride = (val >> 20) & 3;
2317
2318     changed ^= val;
2319     if (changed & (3 << 22)) {
2320         i = (val >> 22) & 3;
2321         switch (i) {
2322         case 0:
2323             i = float_round_nearest_even;
2324             break;
2325         case 1:
2326             i = float_round_up;
2327             break;
2328         case 2:
2329             i = float_round_down;
2330             break;
2331         case 3:
2332             i = float_round_to_zero;
2333             break;
2334         }
2335         set_float_rounding_mode(i, &env->vfp.fp_status);
2336     }
2337     if (changed & (1 << 24))
2338         set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
2339     if (changed & (1 << 25))
2340         set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
2341
2342     i = vfp_exceptbits_to_host((val >> 8) & 0x1f);
2343     set_float_exception_flags(i, &env->vfp.fp_status);
2344 }
2345
2346 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
2347
2348 #define VFP_BINOP(name) \
2349 float32 VFP_HELPER(name, s)(float32 a, float32 b, CPUState *env) \
2350 { \
2351     return float32_ ## name (a, b, &env->vfp.fp_status); \
2352 } \
2353 float64 VFP_HELPER(name, d)(float64 a, float64 b, CPUState *env) \
2354 { \
2355     return float64_ ## name (a, b, &env->vfp.fp_status); \
2356 }
2357 VFP_BINOP(add)
2358 VFP_BINOP(sub)
2359 VFP_BINOP(mul)
2360 VFP_BINOP(div)
2361 #undef VFP_BINOP
2362
2363 float32 VFP_HELPER(neg, s)(float32 a)
2364 {
2365     return float32_chs(a);
2366 }
2367
2368 float64 VFP_HELPER(neg, d)(float64 a)
2369 {
2370     return float64_chs(a);
2371 }
2372
2373 float32 VFP_HELPER(abs, s)(float32 a)
2374 {
2375     return float32_abs(a);
2376 }
2377
2378 float64 VFP_HELPER(abs, d)(float64 a)
2379 {
2380     return float64_abs(a);
2381 }
2382
2383 float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
2384 {
2385     return float32_sqrt(a, &env->vfp.fp_status);
2386 }
2387
2388 float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
2389 {
2390     return float64_sqrt(a, &env->vfp.fp_status);
2391 }
2392
2393 /* XXX: check quiet/signaling case */
2394 #define DO_VFP_cmp(p, type) \
2395 void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
2396 { \
2397     uint32_t flags; \
2398     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
2399     case 0: flags = 0x6; break; \
2400     case -1: flags = 0x8; break; \
2401     case 1: flags = 0x2; break; \
2402     default: case 2: flags = 0x3; break; \
2403     } \
2404     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2405         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2406 } \
2407 void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
2408 { \
2409     uint32_t flags; \
2410     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
2411     case 0: flags = 0x6; break; \
2412     case -1: flags = 0x8; break; \
2413     case 1: flags = 0x2; break; \
2414     default: case 2: flags = 0x3; break; \
2415     } \
2416     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2417         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2418 }
2419 DO_VFP_cmp(s, float32)
2420 DO_VFP_cmp(d, float64)
2421 #undef DO_VFP_cmp
2422
2423 /* Helper routines to perform bitwise copies between float and int.  */
2424 static inline float32 vfp_itos(uint32_t i)
2425 {
2426     union {
2427         uint32_t i;
2428         float32 s;
2429     } v;
2430
2431     v.i = i;
2432     return v.s;
2433 }
2434
2435 static inline uint32_t vfp_stoi(float32 s)
2436 {
2437     union {
2438         uint32_t i;
2439         float32 s;
2440     } v;
2441
2442     v.s = s;
2443     return v.i;
2444 }
2445
2446 static inline float64 vfp_itod(uint64_t i)
2447 {
2448     union {
2449         uint64_t i;
2450         float64 d;
2451     } v;
2452
2453     v.i = i;
2454     return v.d;
2455 }
2456
2457 static inline uint64_t vfp_dtoi(float64 d)
2458 {
2459     union {
2460         uint64_t i;
2461         float64 d;
2462     } v;
2463
2464     v.d = d;
2465     return v.i;
2466 }
2467
2468 /* Integer to float conversion.  */
2469 float32 VFP_HELPER(uito, s)(float32 x, CPUState *env)
2470 {
2471     return uint32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2472 }
2473
2474 float64 VFP_HELPER(uito, d)(float32 x, CPUState *env)
2475 {
2476     return uint32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2477 }
2478
2479 float32 VFP_HELPER(sito, s)(float32 x, CPUState *env)
2480 {
2481     return int32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2482 }
2483
2484 float64 VFP_HELPER(sito, d)(float32 x, CPUState *env)
2485 {
2486     return int32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2487 }
2488
2489 /* Float to integer conversion.  */
2490 float32 VFP_HELPER(toui, s)(float32 x, CPUState *env)
2491 {
2492     return vfp_itos(float32_to_uint32(x, &env->vfp.fp_status));
2493 }
2494
2495 float32 VFP_HELPER(toui, d)(float64 x, CPUState *env)
2496 {
2497     return vfp_itos(float64_to_uint32(x, &env->vfp.fp_status));
2498 }
2499
2500 float32 VFP_HELPER(tosi, s)(float32 x, CPUState *env)
2501 {
2502     return vfp_itos(float32_to_int32(x, &env->vfp.fp_status));
2503 }
2504
2505 float32 VFP_HELPER(tosi, d)(float64 x, CPUState *env)
2506 {
2507     return vfp_itos(float64_to_int32(x, &env->vfp.fp_status));
2508 }
2509
2510 float32 VFP_HELPER(touiz, s)(float32 x, CPUState *env)
2511 {
2512     return vfp_itos(float32_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2513 }
2514
2515 float32 VFP_HELPER(touiz, d)(float64 x, CPUState *env)
2516 {
2517     return vfp_itos(float64_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2518 }
2519
2520 float32 VFP_HELPER(tosiz, s)(float32 x, CPUState *env)
2521 {
2522     return vfp_itos(float32_to_int32_round_to_zero(x, &env->vfp.fp_status));
2523 }
2524
2525 float32 VFP_HELPER(tosiz, d)(float64 x, CPUState *env)
2526 {
2527     return vfp_itos(float64_to_int32_round_to_zero(x, &env->vfp.fp_status));
2528 }
2529
2530 /* floating point conversion */
2531 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
2532 {
2533     return float32_to_float64(x, &env->vfp.fp_status);
2534 }
2535
2536 float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
2537 {
2538     return float64_to_float32(x, &env->vfp.fp_status);
2539 }
2540
2541 /* VFP3 fixed point conversion.  */
2542 #define VFP_CONV_FIX(name, p, ftype, itype, sign) \
2543 ftype VFP_HELPER(name##to, p)(ftype x, uint32_t shift, CPUState *env) \
2544 { \
2545     ftype tmp; \
2546     tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(x), \
2547                                   &env->vfp.fp_status); \
2548     return ftype##_scalbn(tmp, -(int)shift, &env->vfp.fp_status); \
2549 } \
2550 ftype VFP_HELPER(to##name, p)(ftype x, uint32_t shift, CPUState *env) \
2551 { \
2552     ftype tmp; \
2553     tmp = ftype##_scalbn(x, shift, &env->vfp.fp_status); \
2554     return vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
2555         &env->vfp.fp_status)); \
2556 }
2557
2558 VFP_CONV_FIX(sh, d, float64, int16, )
2559 VFP_CONV_FIX(sl, d, float64, int32, )
2560 VFP_CONV_FIX(uh, d, float64, uint16, u)
2561 VFP_CONV_FIX(ul, d, float64, uint32, u)
2562 VFP_CONV_FIX(sh, s, float32, int16, )
2563 VFP_CONV_FIX(sl, s, float32, int32, )
2564 VFP_CONV_FIX(uh, s, float32, uint16, u)
2565 VFP_CONV_FIX(ul, s, float32, uint32, u)
2566 #undef VFP_CONV_FIX
2567
2568 float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
2569 {
2570     float_status *s = &env->vfp.fp_status;
2571     float32 two = int32_to_float32(2, s);
2572     return float32_sub(two, float32_mul(a, b, s), s);
2573 }
2574
2575 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
2576 {
2577     float_status *s = &env->vfp.fp_status;
2578     float32 three = int32_to_float32(3, s);
2579     return float32_sub(three, float32_mul(a, b, s), s);
2580 }
2581
2582 /* NEON helpers.  */
2583
2584 /* TODO: The architecture specifies the value that the estimate functions
2585    should return.  We return the exact reciprocal/root instead.  */
2586 float32 HELPER(recpe_f32)(float32 a, CPUState *env)
2587 {
2588     float_status *s = &env->vfp.fp_status;
2589     float32 one = int32_to_float32(1, s);
2590     return float32_div(one, a, s);
2591 }
2592
2593 float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
2594 {
2595     float_status *s = &env->vfp.fp_status;
2596     float32 one = int32_to_float32(1, s);
2597     return float32_div(one, float32_sqrt(a, s), s);
2598 }
2599
2600 uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
2601 {
2602     float_status *s = &env->vfp.fp_status;
2603     float32 tmp;
2604     tmp = int32_to_float32(a, s);
2605     tmp = float32_scalbn(tmp, -32, s);
2606     tmp = helper_recpe_f32(tmp, env);
2607     tmp = float32_scalbn(tmp, 31, s);
2608     return float32_to_int32(tmp, s);
2609 }
2610
2611 uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
2612 {
2613     float_status *s = &env->vfp.fp_status;
2614     float32 tmp;
2615     tmp = int32_to_float32(a, s);
2616     tmp = float32_scalbn(tmp, -32, s);
2617     tmp = helper_rsqrte_f32(tmp, env);
2618     tmp = float32_scalbn(tmp, 31, s);
2619     return float32_to_int32(tmp, s);
2620 }
2621
2622 void HELPER(set_teecr)(CPUState *env, uint32_t val)
2623 {
2624     val &= 1;
2625     if (env->teecr != val) {
2626         env->teecr = val;
2627         tb_flush(env);
2628     }
2629 }