target-arm/translate-a64.c

   1 /*
   2  *  AArch64 translation
   3  *
   4  *  Copyright (c) 2013 Alexander Graf <agraf@suse.de>
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include <stdarg.h>
  20 #include <stdlib.h>
  21 #include <stdio.h>
  22 #include <string.h>
  23 #include <inttypes.h>
  24
  25 #include "cpu.h"
  26 #include "tcg-op.h"
  27 #include "qemu/log.h"
  28 #include "translate.h"
  29 #include "qemu/host-utils.h"
  30
  31 #include "exec/gen-icount.h"
  32
  33 #include "helper.h"
  34 #define GEN_HELPER 1
  35 #include "helper.h"
  36
  37 static TCGv_i64 cpu_X[32];
  38 static TCGv_i64 cpu_pc;
  39 static TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
  40
  41 static const char *regnames[] = {
  42     "x0", "x1", "x2", "x3", "x4", "x5", "x6", "x7",
  43     "x8", "x9", "x10", "x11", "x12", "x13", "x14", "x15",
  44     "x16", "x17", "x18", "x19", "x20", "x21", "x22", "x23",
  45     "x24", "x25", "x26", "x27", "x28", "x29", "lr", "sp"
  46 };
  47
  48 enum a64_shift_type {
  49     A64_SHIFT_TYPE_LSL = 0,
  50     A64_SHIFT_TYPE_LSR = 1,
  51     A64_SHIFT_TYPE_ASR = 2,
  52     A64_SHIFT_TYPE_ROR = 3
  53 };
  54
  55 /* initialize TCG globals.  */
  56 void a64_translate_init(void)
  57 {
  58     int i;
  59
  60     cpu_pc = tcg_global_mem_new_i64(TCG_AREG0,
  61                                     offsetof(CPUARMState, pc),
  62                                     "pc");
  63     for (i = 0; i < 32; i++) {
  64         cpu_X[i] = tcg_global_mem_new_i64(TCG_AREG0,
  65                                           offsetof(CPUARMState, xregs[i]),
  66                                           regnames[i]);
  67     }
  68
  69     cpu_NF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, NF), "NF");
  70     cpu_ZF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, ZF), "ZF");
  71     cpu_CF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, CF), "CF");
  72     cpu_VF = tcg_global_mem_new_i32(TCG_AREG0, offsetof(CPUARMState, VF), "VF");
  73 }
  74
  75 void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
  76                             fprintf_function cpu_fprintf, int flags)
  77 {
  78     ARMCPU *cpu = ARM_CPU(cs);
  79     CPUARMState *env = &cpu->env;
  80     uint32_t psr = pstate_read(env);
  81     int i;
  82
  83     cpu_fprintf(f, "PC=%016"PRIx64"  SP=%016"PRIx64"\n",
  84             env->pc, env->xregs[31]);
  85     for (i = 0; i < 31; i++) {
  86         cpu_fprintf(f, "X%02d=%016"PRIx64, i, env->xregs[i]);
  87         if ((i % 4) == 3) {
  88             cpu_fprintf(f, "\n");
  89         } else {
  90             cpu_fprintf(f, " ");
  91         }
  92     }
  93     cpu_fprintf(f, "PSTATE=%08x (flags %c%c%c%c)\n",
  94                 psr,
  95                 psr & PSTATE_N ? 'N' : '-',
  96                 psr & PSTATE_Z ? 'Z' : '-',
  97                 psr & PSTATE_C ? 'C' : '-',
  98                 psr & PSTATE_V ? 'V' : '-');
  99     cpu_fprintf(f, "\n");
 100 }
 101
 102 void gen_a64_set_pc_im(uint64_t val)
 103 {
 104     tcg_gen_movi_i64(cpu_pc, val);
 105 }
 106
 107 static void gen_exception(int excp)
 108 {
 109     TCGv_i32 tmp = tcg_temp_new_i32();
 110     tcg_gen_movi_i32(tmp, excp);
 111     gen_helper_exception(cpu_env, tmp);
 112     tcg_temp_free_i32(tmp);
 113 }
 114
 115 static void gen_exception_insn(DisasContext *s, int offset, int excp)
 116 {
 117     gen_a64_set_pc_im(s->pc - offset);
 118     gen_exception(excp);
 119     s->is_jmp = DISAS_EXC;
 120 }
 121
 122 static inline bool use_goto_tb(DisasContext *s, int n, uint64_t dest)
 123 {
 124     /* No direct tb linking with singlestep or deterministic io */
 125     if (s->singlestep_enabled || (s->tb->cflags & CF_LAST_IO)) {
 126         return false;
 127     }
 128
 129     /* Only link tbs from inside the same guest page */
 130     if ((s->tb->pc & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) {
 131         return false;
 132     }
 133
 134     return true;
 135 }
 136
 137 static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
 138 {
 139     TranslationBlock *tb;
 140
 141     tb = s->tb;
 142     if (use_goto_tb(s, n, dest)) {
 143         tcg_gen_goto_tb(n);
 144         gen_a64_set_pc_im(dest);
 145         tcg_gen_exit_tb((tcg_target_long)tb + n);
 146         s->is_jmp = DISAS_TB_JUMP;
 147     } else {
 148         gen_a64_set_pc_im(dest);
 149         if (s->singlestep_enabled) {
 150             gen_exception(EXCP_DEBUG);
 151         }
 152         tcg_gen_exit_tb(0);
 153         s->is_jmp = DISAS_JUMP;
 154     }
 155 }
 156
 157 static void unallocated_encoding(DisasContext *s)
 158 {
 159     gen_exception_insn(s, 4, EXCP_UDEF);
 160 }
 161
 162 #define unsupported_encoding(s, insn)                                    \
 163     do {                                                                 \
 164         qemu_log_mask(LOG_UNIMP,                                         \
 165                       "%s:%d: unsupported instruction encoding 0x%08x "  \
 166                       "at pc=%016" PRIx64 "\n",                          \
 167                       __FILE__, __LINE__, insn, s->pc - 4);              \
 168         unallocated_encoding(s);                                         \
 169     } while (0);
 170
 171 static void init_tmp_a64_array(DisasContext *s)
 172 {
 173 #ifdef CONFIG_DEBUG_TCG
 174     int i;
 175     for (i = 0; i < ARRAY_SIZE(s->tmp_a64); i++) {
 176         TCGV_UNUSED_I64(s->tmp_a64[i]);
 177     }
 178 #endif
 179     s->tmp_a64_count = 0;
 180 }
 181
 182 static void free_tmp_a64(DisasContext *s)
 183 {
 184     int i;
 185     for (i = 0; i < s->tmp_a64_count; i++) {
 186         tcg_temp_free_i64(s->tmp_a64[i]);
 187     }
 188     init_tmp_a64_array(s);
 189 }
 190
 191 static TCGv_i64 new_tmp_a64(DisasContext *s)
 192 {
 193     assert(s->tmp_a64_count < TMP_A64_MAX);
 194     return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_new_i64();
 195 }
 196
 197 static TCGv_i64 new_tmp_a64_zero(DisasContext *s)
 198 {
 199     TCGv_i64 t = new_tmp_a64(s);
 200     tcg_gen_movi_i64(t, 0);
 201     return t;
 202 }
 203
 204 /*
 205  * Register access functions
 206  *
 207  * These functions are used for directly accessing a register in where
 208  * changes to the final register value are likely to be made. If you
 209  * need to use a register for temporary calculation (e.g. index type
 210  * operations) use the read_* form.
 211  *
 212  * B1.2.1 Register mappings
 213  *
 214  * In instruction register encoding 31 can refer to ZR (zero register) or
 215  * the SP (stack pointer) depending on context. In QEMU's case we map SP
 216  * to cpu_X[31] and ZR accesses to a temporary which can be discarded.
 217  * This is the point of the _sp forms.
 218  */
 219 static TCGv_i64 cpu_reg(DisasContext *s, int reg)
 220 {
 221     if (reg == 31) {
 222         return new_tmp_a64_zero(s);
 223     } else {
 224         return cpu_X[reg];
 225     }
 226 }
 227
 228 /* register access for when 31 == SP */
 229 static TCGv_i64 cpu_reg_sp(DisasContext *s, int reg)
 230 {
 231     return cpu_X[reg];
 232 }
 233
 234 /* read a cpu register in 32bit/64bit mode. Returns a TCGv_i64
 235  * representing the register contents. This TCGv is an auto-freed
 236  * temporary so it need not be explicitly freed, and may be modified.
 237  */
 238 static TCGv_i64 read_cpu_reg(DisasContext *s, int reg, int sf)
 239 {
 240     TCGv_i64 v = new_tmp_a64(s);
 241     if (reg != 31) {
 242         if (sf) {
 243             tcg_gen_mov_i64(v, cpu_X[reg]);
 244         } else {
 245             tcg_gen_ext32u_i64(v, cpu_X[reg]);
 246         }
 247     } else {
 248         tcg_gen_movi_i64(v, 0);
 249     }
 250     return v;
 251 }
 252
 253 /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
 254  * than the 32 bit equivalent.
 255  */
 256 static inline void gen_set_NZ64(TCGv_i64 result)
 257 {
 258     TCGv_i64 flag = tcg_temp_new_i64();
 259
 260     tcg_gen_setcondi_i64(TCG_COND_NE, flag, result, 0);
 261     tcg_gen_trunc_i64_i32(cpu_ZF, flag);
 262     tcg_gen_shri_i64(flag, result, 32);
 263     tcg_gen_trunc_i64_i32(cpu_NF, flag);
 264     tcg_temp_free_i64(flag);
 265 }
 266
 267 /* Set NZCV as for a logical operation: NZ as per result, CV cleared. */
 268 static inline void gen_logic_CC(int sf, TCGv_i64 result)
 269 {
 270     if (sf) {
 271         gen_set_NZ64(result);
 272     } else {
 273         tcg_gen_trunc_i64_i32(cpu_ZF, result);
 274         tcg_gen_trunc_i64_i32(cpu_NF, result);
 275     }
 276     tcg_gen_movi_i32(cpu_CF, 0);
 277     tcg_gen_movi_i32(cpu_VF, 0);
 278 }
 279
 280 /*
 281  * the instruction disassembly implemented here matches
 282  * the instruction encoding classifications in chapter 3 (C3)
 283  * of the ARM Architecture Reference Manual (DDI0487A_a)
 284  */
 285
 286 /* C3.2.7 Unconditional branch (immediate)
 287  *   31  30       26 25                                  0
 288  * +----+-----------+-------------------------------------+
 289  * | op | 0 0 1 0 1 |                 imm26               |
 290  * +----+-----------+-------------------------------------+
 291  */
 292 static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
 293 {
 294     uint64_t addr = s->pc + sextract32(insn, 0, 26) * 4 - 4;
 295
 296     if (insn & (1 << 31)) {
 297         /* C5.6.26 BL Branch with link */
 298         tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
 299     }
 300
 301     /* C5.6.20 B Branch / C5.6.26 BL Branch with link */
 302     gen_goto_tb(s, 0, addr);
 303 }
 304
 305 /* C3.2.1 Compare & branch (immediate)
 306  *   31  30         25  24  23                  5 4      0
 307  * +----+-------------+----+---------------------+--------+
 308  * | sf | 0 1 1 0 1 0 | op |         imm19       |   Rt   |
 309  * +----+-------------+----+---------------------+--------+
 310  */
 311 static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
 312 {
 313     unsigned int sf, op, rt;
 314     uint64_t addr;
 315     int label_match;
 316     TCGv_i64 tcg_cmp;
 317
 318     sf = extract32(insn, 31, 1);
 319     op = extract32(insn, 24, 1); /* 0: CBZ; 1: CBNZ */
 320     rt = extract32(insn, 0, 5);
 321     addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
 322
 323     tcg_cmp = read_cpu_reg(s, rt, sf);
 324     label_match = gen_new_label();
 325
 326     tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
 327                         tcg_cmp, 0, label_match);
 328
 329     gen_goto_tb(s, 0, s->pc);
 330     gen_set_label(label_match);
 331     gen_goto_tb(s, 1, addr);
 332 }
 333
 334 /* C3.2.5 Test & branch (immediate)
 335  *   31  30         25  24  23   19 18          5 4    0
 336  * +----+-------------+----+-------+-------------+------+
 337  * | b5 | 0 1 1 0 1 1 | op |  b40  |    imm14    |  Rt  |
 338  * +----+-------------+----+-------+-------------+------+
 339  */
 340 static void disas_test_b_imm(DisasContext *s, uint32_t insn)
 341 {
 342     unsigned int bit_pos, op, rt;
 343     uint64_t addr;
 344     int label_match;
 345     TCGv_i64 tcg_cmp;
 346
 347     bit_pos = (extract32(insn, 31, 1) << 5) | extract32(insn, 19, 5);
 348     op = extract32(insn, 24, 1); /* 0: TBZ; 1: TBNZ */
 349     addr = s->pc + sextract32(insn, 5, 14) * 4 - 4;
 350     rt = extract32(insn, 0, 5);
 351
 352     tcg_cmp = tcg_temp_new_i64();
 353     tcg_gen_andi_i64(tcg_cmp, cpu_reg(s, rt), (1ULL << bit_pos));
 354     label_match = gen_new_label();
 355     tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
 356                         tcg_cmp, 0, label_match);
 357     tcg_temp_free_i64(tcg_cmp);
 358     gen_goto_tb(s, 0, s->pc);
 359     gen_set_label(label_match);
 360     gen_goto_tb(s, 1, addr);
 361 }
 362
 363 /* C3.2.2 / C5.6.19 Conditional branch (immediate)
 364  *  31           25  24  23                  5   4  3    0
 365  * +---------------+----+---------------------+----+------+
 366  * | 0 1 0 1 0 1 0 | o1 |         imm19       | o0 | cond |
 367  * +---------------+----+---------------------+----+------+
 368  */
 369 static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
 370 {
 371     unsigned int cond;
 372     uint64_t addr;
 373
 374     if ((insn & (1 << 4)) || (insn & (1 << 24))) {
 375         unallocated_encoding(s);
 376         return;
 377     }
 378     addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
 379     cond = extract32(insn, 0, 4);
 380
 381     if (cond < 0x0e) {
 382         /* genuinely conditional branches */
 383         int label_match = gen_new_label();
 384         arm_gen_test_cc(cond, label_match);
 385         gen_goto_tb(s, 0, s->pc);
 386         gen_set_label(label_match);
 387         gen_goto_tb(s, 1, addr);
 388     } else {
 389         /* 0xe and 0xf are both "always" conditions */
 390         gen_goto_tb(s, 0, addr);
 391     }
 392 }
 393
 394 /* C5.6.68 HINT */
 395 static void handle_hint(DisasContext *s, uint32_t insn,
 396                         unsigned int op1, unsigned int op2, unsigned int crm)
 397 {
 398     unsigned int selector = crm << 3 | op2;
 399
 400     if (op1 != 3) {
 401         unallocated_encoding(s);
 402         return;
 403     }
 404
 405     switch (selector) {
 406     case 0: /* NOP */
 407         return;
 408     case 1: /* YIELD */
 409     case 2: /* WFE */
 410     case 3: /* WFI */
 411     case 4: /* SEV */
 412     case 5: /* SEVL */
 413         /* we treat all as NOP at least for now */
 414         return;
 415     default:
 416         /* default specified as NOP equivalent */
 417         return;
 418     }
 419 }
 420
 421 /* CLREX, DSB, DMB, ISB */
 422 static void handle_sync(DisasContext *s, uint32_t insn,
 423                         unsigned int op1, unsigned int op2, unsigned int crm)
 424 {
 425     if (op1 != 3) {
 426         unallocated_encoding(s);
 427         return;
 428     }
 429
 430     switch (op2) {
 431     case 2: /* CLREX */
 432         unsupported_encoding(s, insn);
 433         return;
 434     case 4: /* DSB */
 435     case 5: /* DMB */
 436     case 6: /* ISB */
 437         /* We don't emulate caches so barriers are no-ops */
 438         return;
 439     default:
 440         unallocated_encoding(s);
 441         return;
 442     }
 443 }
 444
 445 /* C5.6.130 MSR (immediate) - move immediate to processor state field */
 446 static void handle_msr_i(DisasContext *s, uint32_t insn,
 447                          unsigned int op1, unsigned int op2, unsigned int crm)
 448 {
 449     unsupported_encoding(s, insn);
 450 }
 451
 452 /* C5.6.204 SYS */
 453 static void handle_sys(DisasContext *s, uint32_t insn, unsigned int l,
 454                        unsigned int op1, unsigned int op2,
 455                        unsigned int crn, unsigned int crm, unsigned int rt)
 456 {
 457     unsupported_encoding(s, insn);
 458 }
 459
 460 /* C5.6.129 MRS - move from system register */
 461 static void handle_mrs(DisasContext *s, uint32_t insn, unsigned int op0,
 462                        unsigned int op1, unsigned int op2,
 463                        unsigned int crn, unsigned int crm, unsigned int rt)
 464 {
 465     unsupported_encoding(s, insn);
 466 }
 467
 468 /* C5.6.131 MSR (register) - move to system register */
 469 static void handle_msr(DisasContext *s, uint32_t insn, unsigned int op0,
 470                        unsigned int op1, unsigned int op2,
 471                        unsigned int crn, unsigned int crm, unsigned int rt)
 472 {
 473     unsupported_encoding(s, insn);
 474 }
 475
 476 /* C3.2.4 System
 477  *  31                 22 21  20 19 18 16 15   12 11    8 7   5 4    0
 478  * +---------------------+---+-----+-----+-------+-------+-----+------+
 479  * | 1 1 0 1 0 1 0 1 0 0 | L | op0 | op1 |  CRn  |  CRm  | op2 |  Rt  |
 480  * +---------------------+---+-----+-----+-------+-------+-----+------+
 481  */
 482 static void disas_system(DisasContext *s, uint32_t insn)
 483 {
 484     unsigned int l, op0, op1, crn, crm, op2, rt;
 485     l = extract32(insn, 21, 1);
 486     op0 = extract32(insn, 19, 2);
 487     op1 = extract32(insn, 16, 3);
 488     crn = extract32(insn, 12, 4);
 489     crm = extract32(insn, 8, 4);
 490     op2 = extract32(insn, 5, 3);
 491     rt = extract32(insn, 0, 5);
 492
 493     if (op0 == 0) {
 494         if (l || rt != 31) {
 495             unallocated_encoding(s);
 496             return;
 497         }
 498         switch (crn) {
 499         case 2: /* C5.6.68 HINT */
 500             handle_hint(s, insn, op1, op2, crm);
 501             break;
 502         case 3: /* CLREX, DSB, DMB, ISB */
 503             handle_sync(s, insn, op1, op2, crm);
 504             break;
 505         case 4: /* C5.6.130 MSR (immediate) */
 506             handle_msr_i(s, insn, op1, op2, crm);
 507             break;
 508         default:
 509             unallocated_encoding(s);
 510             break;
 511         }
 512         return;
 513     }
 514
 515     if (op0 == 1) {
 516         /* C5.6.204 SYS */
 517         handle_sys(s, insn, l, op1, op2, crn, crm, rt);
 518     } else if (l) { /* op0 > 1 */
 519         /* C5.6.129 MRS - move from system register */
 520         handle_mrs(s, insn, op0, op1, op2, crn, crm, rt);
 521     } else {
 522         /* C5.6.131 MSR (register) - move to system register */
 523         handle_msr(s, insn, op0, op1, op2, crn, crm, rt);
 524     }
 525 }
 526
 527 /* Exception generation */
 528 static void disas_exc(DisasContext *s, uint32_t insn)
 529 {
 530     unsupported_encoding(s, insn);
 531 }
 532
 533 /* C3.2.7 Unconditional branch (register)
 534  *  31           25 24   21 20   16 15   10 9    5 4     0
 535  * +---------------+-------+-------+-------+------+-------+
 536  * | 1 1 0 1 0 1 1 |  opc  |  op2  |  op3  |  Rn  |  op4  |
 537  * +---------------+-------+-------+-------+------+-------+
 538  */
 539 static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
 540 {
 541     unsigned int opc, op2, op3, rn, op4;
 542
 543     opc = extract32(insn, 21, 4);
 544     op2 = extract32(insn, 16, 5);
 545     op3 = extract32(insn, 10, 6);
 546     rn = extract32(insn, 5, 5);
 547     op4 = extract32(insn, 0, 5);
 548
 549     if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {
 550         unallocated_encoding(s);
 551         return;
 552     }
 553
 554     switch (opc) {
 555     case 0: /* BR */
 556     case 2: /* RET */
 557         break;
 558     case 1: /* BLR */
 559         tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
 560         break;
 561     case 4: /* ERET */
 562     case 5: /* DRPS */
 563         if (rn != 0x1f) {
 564             unallocated_encoding(s);
 565         } else {
 566             unsupported_encoding(s, insn);
 567         }
 568         return;
 569     default:
 570         unallocated_encoding(s);
 571         return;
 572     }
 573
 574     tcg_gen_mov_i64(cpu_pc, cpu_reg(s, rn));
 575     s->is_jmp = DISAS_JUMP;
 576 }
 577
 578 /* C3.2 Branches, exception generating and system instructions */
 579 static void disas_b_exc_sys(DisasContext *s, uint32_t insn)
 580 {
 581     switch (extract32(insn, 25, 7)) {
 582     case 0x0a: case 0x0b:
 583     case 0x4a: case 0x4b: /* Unconditional branch (immediate) */
 584         disas_uncond_b_imm(s, insn);
 585         break;
 586     case 0x1a: case 0x5a: /* Compare & branch (immediate) */
 587         disas_comp_b_imm(s, insn);
 588         break;
 589     case 0x1b: case 0x5b: /* Test & branch (immediate) */
 590         disas_test_b_imm(s, insn);
 591         break;
 592     case 0x2a: /* Conditional branch (immediate) */
 593         disas_cond_b_imm(s, insn);
 594         break;
 595     case 0x6a: /* Exception generation / System */
 596         if (insn & (1 << 24)) {
 597             disas_system(s, insn);
 598         } else {
 599             disas_exc(s, insn);
 600         }
 601         break;
 602     case 0x6b: /* Unconditional branch (register) */
 603         disas_uncond_b_reg(s, insn);
 604         break;
 605     default:
 606         unallocated_encoding(s);
 607         break;
 608     }
 609 }
 610
 611 /* Load/store exclusive */
 612 static void disas_ldst_excl(DisasContext *s, uint32_t insn)
 613 {
 614     unsupported_encoding(s, insn);
 615 }
 616
 617 /* Load register (literal) */
 618 static void disas_ld_lit(DisasContext *s, uint32_t insn)
 619 {
 620     unsupported_encoding(s, insn);
 621 }
 622
 623 /* Load/store pair (all forms) */
 624 static void disas_ldst_pair(DisasContext *s, uint32_t insn)
 625 {
 626     unsupported_encoding(s, insn);
 627 }
 628
 629 /* Load/store register (all forms) */
 630 static void disas_ldst_reg(DisasContext *s, uint32_t insn)
 631 {
 632     unsupported_encoding(s, insn);
 633 }
 634
 635 /* AdvSIMD load/store multiple structures */
 636 static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
 637 {
 638     unsupported_encoding(s, insn);
 639 }
 640
 641 /* AdvSIMD load/store single structure */
 642 static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
 643 {
 644     unsupported_encoding(s, insn);
 645 }
 646
 647 /* C3.3 Loads and stores */
 648 static void disas_ldst(DisasContext *s, uint32_t insn)
 649 {
 650     switch (extract32(insn, 24, 6)) {
 651     case 0x08: /* Load/store exclusive */
 652         disas_ldst_excl(s, insn);
 653         break;
 654     case 0x18: case 0x1c: /* Load register (literal) */
 655         disas_ld_lit(s, insn);
 656         break;
 657     case 0x28: case 0x29:
 658     case 0x2c: case 0x2d: /* Load/store pair (all forms) */
 659         disas_ldst_pair(s, insn);
 660         break;
 661     case 0x38: case 0x39:
 662     case 0x3c: case 0x3d: /* Load/store register (all forms) */
 663         disas_ldst_reg(s, insn);
 664         break;
 665     case 0x0c: /* AdvSIMD load/store multiple structures */
 666         disas_ldst_multiple_struct(s, insn);
 667         break;
 668     case 0x0d: /* AdvSIMD load/store single structure */
 669         disas_ldst_single_struct(s, insn);
 670         break;
 671     default:
 672         unallocated_encoding(s);
 673         break;
 674     }
 675 }
 676
 677 /* C3.4.6 PC-rel. addressing
 678  *   31  30   29 28       24 23                5 4    0
 679  * +----+-------+-----------+-------------------+------+
 680  * | op | immlo | 1 0 0 0 0 |       immhi       |  Rd  |
 681  * +----+-------+-----------+-------------------+------+
 682  */
 683 static void disas_pc_rel_adr(DisasContext *s, uint32_t insn)
 684 {
 685     unsigned int page, rd;
 686     uint64_t base;
 687     int64_t offset;
 688
 689     page = extract32(insn, 31, 1);
 690     /* SignExtend(immhi:immlo) -> offset */
 691     offset = ((int64_t)sextract32(insn, 5, 19) << 2) | extract32(insn, 29, 2);
 692     rd = extract32(insn, 0, 5);
 693     base = s->pc - 4;
 694
 695     if (page) {
 696         /* ADRP (page based) */
 697         base &= ~0xfff;
 698         offset <<= 12;
 699     }
 700
 701     tcg_gen_movi_i64(cpu_reg(s, rd), base + offset);
 702 }
 703
 704 /* Add/subtract (immediate) */
 705 static void disas_add_sub_imm(DisasContext *s, uint32_t insn)
 706 {
 707     unsupported_encoding(s, insn);
 708 }
 709
 710 /* The input should be a value in the bottom e bits (with higher
 711  * bits zero); returns that value replicated into every element
 712  * of size e in a 64 bit integer.
 713  */
 714 static uint64_t bitfield_replicate(uint64_t mask, unsigned int e)
 715 {
 716     assert(e != 0);
 717     while (e < 64) {
 718         mask |= mask << e;
 719         e *= 2;
 720     }
 721     return mask;
 722 }
 723
 724 /* Return a value with the bottom len bits set (where 0 < len <= 64) */
 725 static inline uint64_t bitmask64(unsigned int length)
 726 {
 727     assert(length > 0 && length <= 64);
 728     return ~0ULL >> (64 - length);
 729 }
 730
 731 /* Simplified variant of pseudocode DecodeBitMasks() for the case where we
 732  * only require the wmask. Returns false if the imms/immr/immn are a reserved
 733  * value (ie should cause a guest UNDEF exception), and true if they are
 734  * valid, in which case the decoded bit pattern is written to result.
 735  */
 736 static bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
 737                                    unsigned int imms, unsigned int immr)
 738 {
 739     uint64_t mask;
 740     unsigned e, levels, s, r;
 741     int len;
 742
 743     assert(immn < 2 && imms < 64 && immr < 64);
 744
 745     /* The bit patterns we create here are 64 bit patterns which
 746      * are vectors of identical elements of size e = 2, 4, 8, 16, 32 or
 747      * 64 bits each. Each element contains the same value: a run
 748      * of between 1 and e-1 non-zero bits, rotated within the
 749      * element by between 0 and e-1 bits.
 750      *
 751      * The element size and run length are encoded into immn (1 bit)
 752      * and imms (6 bits) as follows:
 753      * 64 bit elements: immn = 1, imms = <length of run - 1>
 754      * 32 bit elements: immn = 0, imms = 0 : <length of run - 1>
 755      * 16 bit elements: immn = 0, imms = 10 : <length of run - 1>
 756      *  8 bit elements: immn = 0, imms = 110 : <length of run - 1>
 757      *  4 bit elements: immn = 0, imms = 1110 : <length of run - 1>
 758      *  2 bit elements: immn = 0, imms = 11110 : <length of run - 1>
 759      * Notice that immn = 0, imms = 11111x is the only combination
 760      * not covered by one of the above options; this is reserved.
 761      * Further, <length of run - 1> all-ones is a reserved pattern.
 762      *
 763      * In all cases the rotation is by immr % e (and immr is 6 bits).
 764      */
 765
 766     /* First determine the element size */
 767     len = 31 - clz32((immn << 6) | (~imms & 0x3f));
 768     if (len < 1) {
 769         /* This is the immn == 0, imms == 0x11111x case */
 770         return false;
 771     }
 772     e = 1 << len;
 773
 774     levels = e - 1;
 775     s = imms & levels;
 776     r = immr & levels;
 777
 778     if (s == levels) {
 779         /* <length of run - 1> mustn't be all-ones. */
 780         return false;
 781     }
 782
 783     /* Create the value of one element: s+1 set bits rotated
 784      * by r within the element (which is e bits wide)...
 785      */
 786     mask = bitmask64(s + 1);
 787     mask = (mask >> r) | (mask << (e - r));
 788     /* ...then replicate the element over the whole 64 bit value */
 789     mask = bitfield_replicate(mask, e);
 790     *result = mask;
 791     return true;
 792 }
 793
 794 /* C3.4.4 Logical (immediate)
 795  *   31  30 29 28         23 22  21  16 15  10 9    5 4    0
 796  * +----+-----+-------------+---+------+------+------+------+
 797  * | sf | opc | 1 0 0 1 0 0 | N | immr | imms |  Rn  |  Rd  |
 798  * +----+-----+-------------+---+------+------+------+------+
 799  */
 800 static void disas_logic_imm(DisasContext *s, uint32_t insn)
 801 {
 802     unsigned int sf, opc, is_n, immr, imms, rn, rd;
 803     TCGv_i64 tcg_rd, tcg_rn;
 804     uint64_t wmask;
 805     bool is_and = false;
 806
 807     sf = extract32(insn, 31, 1);
 808     opc = extract32(insn, 29, 2);
 809     is_n = extract32(insn, 22, 1);
 810     immr = extract32(insn, 16, 6);
 811     imms = extract32(insn, 10, 6);
 812     rn = extract32(insn, 5, 5);
 813     rd = extract32(insn, 0, 5);
 814
 815     if (!sf && is_n) {
 816         unallocated_encoding(s);
 817         return;
 818     }
 819
 820     if (opc == 0x3) { /* ANDS */
 821         tcg_rd = cpu_reg(s, rd);
 822     } else {
 823         tcg_rd = cpu_reg_sp(s, rd);
 824     }
 825     tcg_rn = cpu_reg(s, rn);
 826
 827     if (!logic_imm_decode_wmask(&wmask, is_n, imms, immr)) {
 828         /* some immediate field values are reserved */
 829         unallocated_encoding(s);
 830         return;
 831     }
 832
 833     if (!sf) {
 834         wmask &= 0xffffffff;
 835     }
 836
 837     switch (opc) {
 838     case 0x3: /* ANDS */
 839     case 0x0: /* AND */
 840         tcg_gen_andi_i64(tcg_rd, tcg_rn, wmask);
 841         is_and = true;
 842         break;
 843     case 0x1: /* ORR */
 844         tcg_gen_ori_i64(tcg_rd, tcg_rn, wmask);
 845         break;
 846     case 0x2: /* EOR */
 847         tcg_gen_xori_i64(tcg_rd, tcg_rn, wmask);
 848         break;
 849     default:
 850         assert(FALSE); /* must handle all above */
 851         break;
 852     }
 853
 854     if (!sf && !is_and) {
 855         /* zero extend final result; we know we can skip this for AND
 856          * since the immediate had the high 32 bits clear.
 857          */
 858         tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 859     }
 860
 861     if (opc == 3) { /* ANDS */
 862         gen_logic_CC(sf, tcg_rd);
 863     }
 864 }
 865
 866 /* Move wide (immediate) */
 867 static void disas_movw_imm(DisasContext *s, uint32_t insn)
 868 {
 869     unsupported_encoding(s, insn);
 870 }
 871
 872 /* C3.4.2 Bitfield
 873  *   31  30 29 28         23 22  21  16 15  10 9    5 4    0
 874  * +----+-----+-------------+---+------+------+------+------+
 875  * | sf | opc | 1 0 0 1 1 0 | N | immr | imms |  Rn  |  Rd  |
 876  * +----+-----+-------------+---+------+------+------+------+
 877  */
 878 static void disas_bitfield(DisasContext *s, uint32_t insn)
 879 {
 880     unsigned int sf, n, opc, ri, si, rn, rd, bitsize, pos, len;
 881     TCGv_i64 tcg_rd, tcg_tmp;
 882
 883     sf = extract32(insn, 31, 1);
 884     opc = extract32(insn, 29, 2);
 885     n = extract32(insn, 22, 1);
 886     ri = extract32(insn, 16, 6);
 887     si = extract32(insn, 10, 6);
 888     rn = extract32(insn, 5, 5);
 889     rd = extract32(insn, 0, 5);
 890     bitsize = sf ? 64 : 32;
 891
 892     if (sf != n || ri >= bitsize || si >= bitsize || opc > 2) {
 893         unallocated_encoding(s);
 894         return;
 895     }
 896
 897     tcg_rd = cpu_reg(s, rd);
 898     tcg_tmp = read_cpu_reg(s, rn, sf);
 899
 900     /* OPTME: probably worth recognizing common cases of ext{8,16,32}{u,s} */
 901
 902     if (opc != 1) { /* SBFM or UBFM */
 903         tcg_gen_movi_i64(tcg_rd, 0);
 904     }
 905
 906     /* do the bit move operation */
 907     if (si >= ri) {
 908         /* Wd<s-r:0> = Wn<s:r> */
 909         tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
 910         pos = 0;
 911         len = (si - ri) + 1;
 912     } else {
 913         /* Wd<32+s-r,32-r> = Wn<s:0> */
 914         pos = bitsize - ri;
 915         len = si + 1;
 916     }
 917
 918     tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
 919
 920     if (opc == 0) { /* SBFM - sign extend the destination field */
 921         tcg_gen_shli_i64(tcg_rd, tcg_rd, 64 - (pos + len));
 922         tcg_gen_sari_i64(tcg_rd, tcg_rd, 64 - (pos + len));
 923     }
 924
 925     if (!sf) { /* zero extend final result */
 926         tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 927     }
 928 }
 929
 930 /* C3.4.3 Extract
 931  *   31  30  29 28         23 22   21  20  16 15    10 9    5 4    0
 932  * +----+------+-------------+---+----+------+--------+------+------+
 933  * | sf | op21 | 1 0 0 1 1 1 | N | o0 |  Rm  |  imms  |  Rn  |  Rd  |
 934  * +----+------+-------------+---+----+------+--------+------+------+
 935  */
 936 static void disas_extract(DisasContext *s, uint32_t insn)
 937 {
 938     unsigned int sf, n, rm, imm, rn, rd, bitsize, op21, op0;
 939
 940     sf = extract32(insn, 31, 1);
 941     n = extract32(insn, 22, 1);
 942     rm = extract32(insn, 16, 5);
 943     imm = extract32(insn, 10, 6);
 944     rn = extract32(insn, 5, 5);
 945     rd = extract32(insn, 0, 5);
 946     op21 = extract32(insn, 29, 2);
 947     op0 = extract32(insn, 21, 1);
 948     bitsize = sf ? 64 : 32;
 949
 950     if (sf != n || op21 || op0 || imm >= bitsize) {
 951         unallocated_encoding(s);
 952     } else {
 953         TCGv_i64 tcg_rd, tcg_rm, tcg_rn;
 954
 955         tcg_rd = cpu_reg(s, rd);
 956
 957         if (imm) {
 958             /* OPTME: we can special case rm==rn as a rotate */
 959             tcg_rm = read_cpu_reg(s, rm, sf);
 960             tcg_rn = read_cpu_reg(s, rn, sf);
 961             tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 962             tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 963             tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 964             if (!sf) {
 965                 tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 966             }
 967         } else {
 968             /* tcg shl_i32/shl_i64 is undefined for 32/64 bit shifts,
 969              * so an extract from bit 0 is a special case.
 970              */
 971             if (sf) {
 972                 tcg_gen_mov_i64(tcg_rd, cpu_reg(s, rm));
 973             } else {
 974                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
 975             }
 976         }
 977
 978     }
 979 }
 980
 981 /* C3.4 Data processing - immediate */
 982 static void disas_data_proc_imm(DisasContext *s, uint32_t insn)
 983 {
 984     switch (extract32(insn, 23, 6)) {
 985     case 0x20: case 0x21: /* PC-rel. addressing */
 986         disas_pc_rel_adr(s, insn);
 987         break;
 988     case 0x22: case 0x23: /* Add/subtract (immediate) */
 989         disas_add_sub_imm(s, insn);
 990         break;
 991     case 0x24: /* Logical (immediate) */
 992         disas_logic_imm(s, insn);
 993         break;
 994     case 0x25: /* Move wide (immediate) */
 995         disas_movw_imm(s, insn);
 996         break;
 997     case 0x26: /* Bitfield */
 998         disas_bitfield(s, insn);
 999         break;
1000     case 0x27: /* Extract */
1001         disas_extract(s, insn);
1002         break;
1003     default:
1004         unallocated_encoding(s);
1005         break;
1006     }
1007 }
1008
1009 /* Shift a TCGv src by TCGv shift_amount, put result in dst.
1010  * Note that it is the caller's responsibility to ensure that the
1011  * shift amount is in range (ie 0..31 or 0..63) and provide the ARM
1012  * mandated semantics for out of range shifts.
1013  */
1014 static void shift_reg(TCGv_i64 dst, TCGv_i64 src, int sf,
1015                       enum a64_shift_type shift_type, TCGv_i64 shift_amount)
1016 {
1017     switch (shift_type) {
1018     case A64_SHIFT_TYPE_LSL:
1019         tcg_gen_shl_i64(dst, src, shift_amount);
1020         break;
1021     case A64_SHIFT_TYPE_LSR:
1022         tcg_gen_shr_i64(dst, src, shift_amount);
1023         break;
1024     case A64_SHIFT_TYPE_ASR:
1025         if (!sf) {
1026             tcg_gen_ext32s_i64(dst, src);
1027         }
1028         tcg_gen_sar_i64(dst, sf ? src : dst, shift_amount);
1029         break;
1030     case A64_SHIFT_TYPE_ROR:
1031         if (sf) {
1032             tcg_gen_rotr_i64(dst, src, shift_amount);
1033         } else {
1034             TCGv_i32 t0, t1;
1035             t0 = tcg_temp_new_i32();
1036             t1 = tcg_temp_new_i32();
1037             tcg_gen_trunc_i64_i32(t0, src);
1038             tcg_gen_trunc_i64_i32(t1, shift_amount);
1039             tcg_gen_rotr_i32(t0, t0, t1);
1040             tcg_gen_extu_i32_i64(dst, t0);
1041             tcg_temp_free_i32(t0);
1042             tcg_temp_free_i32(t1);
1043         }
1044         break;
1045     default:
1046         assert(FALSE); /* all shift types should be handled */
1047         break;
1048     }
1049
1050     if (!sf) { /* zero extend final result */
1051         tcg_gen_ext32u_i64(dst, dst);
1052     }
1053 }
1054
1055 /* Shift a TCGv src by immediate, put result in dst.
1056  * The shift amount must be in range (this should always be true as the
1057  * relevant instructions will UNDEF on bad shift immediates).
1058  */
1059 static void shift_reg_imm(TCGv_i64 dst, TCGv_i64 src, int sf,
1060                           enum a64_shift_type shift_type, unsigned int shift_i)
1061 {
1062     assert(shift_i < (sf ? 64 : 32));
1063
1064     if (shift_i == 0) {
1065         tcg_gen_mov_i64(dst, src);
1066     } else {
1067         TCGv_i64 shift_const;
1068
1069         shift_const = tcg_const_i64(shift_i);
1070         shift_reg(dst, src, sf, shift_type, shift_const);
1071         tcg_temp_free_i64(shift_const);
1072     }
1073 }
1074
1075 /* C3.5.10 Logical (shifted register)
1076  *   31  30 29 28       24 23   22 21  20  16 15    10 9    5 4    0
1077  * +----+-----+-----------+-------+---+------+--------+------+------+
1078  * | sf | opc | 0 1 0 1 0 | shift | N |  Rm  |  imm6  |  Rn  |  Rd  |
1079  * +----+-----+-----------+-------+---+------+--------+------+------+
1080  */
1081 static void disas_logic_reg(DisasContext *s, uint32_t insn)
1082 {
1083     TCGv_i64 tcg_rd, tcg_rn, tcg_rm;
1084     unsigned int sf, opc, shift_type, invert, rm, shift_amount, rn, rd;
1085
1086     sf = extract32(insn, 31, 1);
1087     opc = extract32(insn, 29, 2);
1088     shift_type = extract32(insn, 22, 2);
1089     invert = extract32(insn, 21, 1);
1090     rm = extract32(insn, 16, 5);
1091     shift_amount = extract32(insn, 10, 6);
1092     rn = extract32(insn, 5, 5);
1093     rd = extract32(insn, 0, 5);
1094
1095     if (!sf && (shift_amount & (1 << 5))) {
1096         unallocated_encoding(s);
1097         return;
1098     }
1099
1100     tcg_rd = cpu_reg(s, rd);
1101
1102     if (opc == 1 && shift_amount == 0 && shift_type == 0 && rn == 31) {
1103         /* Unshifted ORR and ORN with WZR/XZR is the standard encoding for
1104          * register-register MOV and MVN, so it is worth special casing.
1105          */
1106         tcg_rm = cpu_reg(s, rm);
1107         if (invert) {
1108             tcg_gen_not_i64(tcg_rd, tcg_rm);
1109             if (!sf) {
1110                 tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
1111             }
1112         } else {
1113             if (sf) {
1114                 tcg_gen_mov_i64(tcg_rd, tcg_rm);
1115             } else {
1116                 tcg_gen_ext32u_i64(tcg_rd, tcg_rm);
1117             }
1118         }
1119         return;
1120     }
1121
1122     tcg_rm = read_cpu_reg(s, rm, sf);
1123
1124     if (shift_amount) {
1125         shift_reg_imm(tcg_rm, tcg_rm, sf, shift_type, shift_amount);
1126     }
1127
1128     tcg_rn = cpu_reg(s, rn);
1129
1130     switch (opc | (invert << 2)) {
1131     case 0: /* AND */
1132     case 3: /* ANDS */
1133         tcg_gen_and_i64(tcg_rd, tcg_rn, tcg_rm);
1134         break;
1135     case 1: /* ORR */
1136         tcg_gen_or_i64(tcg_rd, tcg_rn, tcg_rm);
1137         break;
1138     case 2: /* EOR */
1139         tcg_gen_xor_i64(tcg_rd, tcg_rn, tcg_rm);
1140         break;
1141     case 4: /* BIC */
1142     case 7: /* BICS */
1143         tcg_gen_andc_i64(tcg_rd, tcg_rn, tcg_rm);
1144         break;
1145     case 5: /* ORN */
1146         tcg_gen_orc_i64(tcg_rd, tcg_rn, tcg_rm);
1147         break;
1148     case 6: /* EON */
1149         tcg_gen_eqv_i64(tcg_rd, tcg_rn, tcg_rm);
1150         break;
1151     default:
1152         assert(FALSE);
1153         break;
1154     }
1155
1156     if (!sf) {
1157         tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
1158     }
1159
1160     if (opc == 3) {
1161         gen_logic_CC(sf, tcg_rd);
1162     }
1163 }
1164
1165 /* Add/subtract (extended register) */
1166 static void disas_add_sub_ext_reg(DisasContext *s, uint32_t insn)
1167 {
1168     unsupported_encoding(s, insn);
1169 }
1170
1171 /* Add/subtract (shifted register) */
1172 static void disas_add_sub_reg(DisasContext *s, uint32_t insn)
1173 {
1174     unsupported_encoding(s, insn);
1175 }
1176
1177 /* Data-processing (3 source) */
1178 static void disas_data_proc_3src(DisasContext *s, uint32_t insn)
1179 {
1180     unsupported_encoding(s, insn);
1181 }
1182
1183 /* Add/subtract (with carry) */
1184 static void disas_adc_sbc(DisasContext *s, uint32_t insn)
1185 {
1186     unsupported_encoding(s, insn);
1187 }
1188
1189 /* Conditional compare (immediate) */
1190 static void disas_cc_imm(DisasContext *s, uint32_t insn)
1191 {
1192     unsupported_encoding(s, insn);
1193 }
1194
1195 /* Conditional compare (register) */
1196 static void disas_cc_reg(DisasContext *s, uint32_t insn)
1197 {
1198     unsupported_encoding(s, insn);
1199 }
1200
1201 /* C3.5.6 Conditional select
1202  *   31   30  29  28             21 20  16 15  12 11 10 9    5 4    0
1203  * +----+----+---+-----------------+------+------+-----+------+------+
1204  * | sf | op | S | 1 1 0 1 0 1 0 0 |  Rm  | cond | op2 |  Rn  |  Rd  |
1205  * +----+----+---+-----------------+------+------+-----+------+------+
1206  */
1207 static void disas_cond_select(DisasContext *s, uint32_t insn)
1208 {
1209     unsigned int sf, else_inv, rm, cond, else_inc, rn, rd;
1210     TCGv_i64 tcg_rd, tcg_src;
1211
1212     if (extract32(insn, 29, 1) || extract32(insn, 11, 1)) {
1213         /* S == 1 or op2<1> == 1 */
1214         unallocated_encoding(s);
1215         return;
1216     }
1217     sf = extract32(insn, 31, 1);
1218     else_inv = extract32(insn, 30, 1);
1219     rm = extract32(insn, 16, 5);
1220     cond = extract32(insn, 12, 4);
1221     else_inc = extract32(insn, 10, 1);
1222     rn = extract32(insn, 5, 5);
1223     rd = extract32(insn, 0, 5);
1224
1225     if (rd == 31) {
1226         /* silly no-op write; until we use movcond we must special-case
1227          * this to avoid a dead temporary across basic blocks.
1228          */
1229         return;
1230     }
1231
1232     tcg_rd = cpu_reg(s, rd);
1233
1234     if (cond >= 0x0e) { /* condition "always" */
1235         tcg_src = read_cpu_reg(s, rn, sf);
1236         tcg_gen_mov_i64(tcg_rd, tcg_src);
1237     } else {
1238         /* OPTME: we could use movcond here, at the cost of duplicating
1239          * a lot of the arm_gen_test_cc() logic.
1240          */
1241         int label_match = gen_new_label();
1242         int label_continue = gen_new_label();
1243
1244         arm_gen_test_cc(cond, label_match);
1245         /* nomatch: */
1246         tcg_src = cpu_reg(s, rm);
1247
1248         if (else_inv && else_inc) {
1249             tcg_gen_neg_i64(tcg_rd, tcg_src);
1250         } else if (else_inv) {
1251             tcg_gen_not_i64(tcg_rd, tcg_src);
1252         } else if (else_inc) {
1253             tcg_gen_addi_i64(tcg_rd, tcg_src, 1);
1254         } else {
1255             tcg_gen_mov_i64(tcg_rd, tcg_src);
1256         }
1257         if (!sf) {
1258             tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
1259         }
1260         tcg_gen_br(label_continue);
1261         /* match: */
1262         gen_set_label(label_match);
1263         tcg_src = read_cpu_reg(s, rn, sf);
1264         tcg_gen_mov_i64(tcg_rd, tcg_src);
1265         /* continue: */
1266         gen_set_label(label_continue);
1267     }
1268 }
1269
1270 static void handle_clz(DisasContext *s, unsigned int sf,
1271                        unsigned int rn, unsigned int rd)
1272 {
1273     TCGv_i64 tcg_rd, tcg_rn;
1274     tcg_rd = cpu_reg(s, rd);
1275     tcg_rn = cpu_reg(s, rn);
1276
1277     if (sf) {
1278         gen_helper_clz64(tcg_rd, tcg_rn);
1279     } else {
1280         TCGv_i32 tcg_tmp32 = tcg_temp_new_i32();
1281         tcg_gen_trunc_i64_i32(tcg_tmp32, tcg_rn);
1282         gen_helper_clz(tcg_tmp32, tcg_tmp32);
1283         tcg_gen_extu_i32_i64(tcg_rd, tcg_tmp32);
1284         tcg_temp_free_i32(tcg_tmp32);
1285     }
1286 }
1287
1288 static void handle_cls(DisasContext *s, unsigned int sf,
1289                        unsigned int rn, unsigned int rd)
1290 {
1291     TCGv_i64 tcg_rd, tcg_rn;
1292     tcg_rd = cpu_reg(s, rd);
1293     tcg_rn = cpu_reg(s, rn);
1294
1295     if (sf) {
1296         gen_helper_cls64(tcg_rd, tcg_rn);
1297     } else {
1298         TCGv_i32 tcg_tmp32 = tcg_temp_new_i32();
1299         tcg_gen_trunc_i64_i32(tcg_tmp32, tcg_rn);
1300         gen_helper_cls32(tcg_tmp32, tcg_tmp32);
1301         tcg_gen_extu_i32_i64(tcg_rd, tcg_tmp32);
1302         tcg_temp_free_i32(tcg_tmp32);
1303     }
1304 }
1305
1306 static void handle_rbit(DisasContext *s, unsigned int sf,
1307                         unsigned int rn, unsigned int rd)
1308 {
1309     TCGv_i64 tcg_rd, tcg_rn;
1310     tcg_rd = cpu_reg(s, rd);
1311     tcg_rn = cpu_reg(s, rn);
1312
1313     if (sf) {
1314         gen_helper_rbit64(tcg_rd, tcg_rn);
1315     } else {
1316         TCGv_i32 tcg_tmp32 = tcg_temp_new_i32();
1317         tcg_gen_trunc_i64_i32(tcg_tmp32, tcg_rn);
1318         gen_helper_rbit(tcg_tmp32, tcg_tmp32);
1319         tcg_gen_extu_i32_i64(tcg_rd, tcg_tmp32);
1320         tcg_temp_free_i32(tcg_tmp32);
1321     }
1322 }
1323
1324 /* C5.6.149 REV with sf==1, opcode==3 ("REV64") */
1325 static void handle_rev64(DisasContext *s, unsigned int sf,
1326                          unsigned int rn, unsigned int rd)
1327 {
1328     if (!sf) {
1329         unallocated_encoding(s);
1330         return;
1331     }
1332     tcg_gen_bswap64_i64(cpu_reg(s, rd), cpu_reg(s, rn));
1333 }
1334
1335 /* C5.6.149 REV with sf==0, opcode==2
1336  * C5.6.151 REV32 (sf==1, opcode==2)
1337  */
1338 static void handle_rev32(DisasContext *s, unsigned int sf,
1339                          unsigned int rn, unsigned int rd)
1340 {
1341     TCGv_i64 tcg_rd = cpu_reg(s, rd);
1342
1343     if (sf) {
1344         TCGv_i64 tcg_tmp = tcg_temp_new_i64();
1345         TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);
1346
1347         /* bswap32_i64 requires zero high word */
1348         tcg_gen_ext32u_i64(tcg_tmp, tcg_rn);
1349         tcg_gen_bswap32_i64(tcg_rd, tcg_tmp);
1350         tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
1351         tcg_gen_bswap32_i64(tcg_tmp, tcg_tmp);
1352         tcg_gen_concat32_i64(tcg_rd, tcg_rd, tcg_tmp);
1353
1354         tcg_temp_free_i64(tcg_tmp);
1355     } else {
1356         tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rn));
1357         tcg_gen_bswap32_i64(tcg_rd, tcg_rd);
1358     }
1359 }
1360
1361 /* C5.6.150 REV16 (opcode==1) */
1362 static void handle_rev16(DisasContext *s, unsigned int sf,
1363                          unsigned int rn, unsigned int rd)
1364 {
1365     TCGv_i64 tcg_rd = cpu_reg(s, rd);
1366     TCGv_i64 tcg_tmp = tcg_temp_new_i64();
1367     TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);
1368
1369     tcg_gen_andi_i64(tcg_tmp, tcg_rn, 0xffff);
1370     tcg_gen_bswap16_i64(tcg_rd, tcg_tmp);
1371
1372     tcg_gen_shri_i64(tcg_tmp, tcg_rn, 16);
1373     tcg_gen_andi_i64(tcg_tmp, tcg_tmp, 0xffff);
1374     tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp);
1375     tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, 16, 16);
1376
1377     if (sf) {
1378         tcg_gen_shri_i64(tcg_tmp, tcg_rn, 32);
1379         tcg_gen_andi_i64(tcg_tmp, tcg_tmp, 0xffff);
1380         tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp);
1381         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, 32, 16);
1382
1383         tcg_gen_shri_i64(tcg_tmp, tcg_rn, 48);
1384         tcg_gen_bswap16_i64(tcg_tmp, tcg_tmp);
1385         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, 48, 16);
1386     }
1387
1388     tcg_temp_free_i64(tcg_tmp);
1389 }
1390
1391 /* C3.5.7 Data-processing (1 source)
1392  *   31  30  29  28             21 20     16 15    10 9    5 4    0
1393  * +----+---+---+-----------------+---------+--------+------+------+
1394  * | sf | 1 | S | 1 1 0 1 0 1 1 0 | opcode2 | opcode |  Rn  |  Rd  |
1395  * +----+---+---+-----------------+---------+--------+------+------+
1396  */
1397 static void disas_data_proc_1src(DisasContext *s, uint32_t insn)
1398 {
1399     unsigned int sf, opcode, rn, rd;
1400
1401     if (extract32(insn, 29, 1) || extract32(insn, 16, 5)) {
1402         unallocated_encoding(s);
1403         return;
1404     }
1405
1406     sf = extract32(insn, 31, 1);
1407     opcode = extract32(insn, 10, 6);
1408     rn = extract32(insn, 5, 5);
1409     rd = extract32(insn, 0, 5);
1410
1411     switch (opcode) {
1412     case 0: /* RBIT */
1413         handle_rbit(s, sf, rn, rd);
1414         break;
1415     case 1: /* REV16 */
1416         handle_rev16(s, sf, rn, rd);
1417         break;
1418     case 2: /* REV32 */
1419         handle_rev32(s, sf, rn, rd);
1420         break;
1421     case 3: /* REV64 */
1422         handle_rev64(s, sf, rn, rd);
1423         break;
1424     case 4: /* CLZ */
1425         handle_clz(s, sf, rn, rd);
1426         break;
1427     case 5: /* CLS */
1428         handle_cls(s, sf, rn, rd);
1429         break;
1430     }
1431 }
1432
1433 static void handle_div(DisasContext *s, bool is_signed, unsigned int sf,
1434                        unsigned int rm, unsigned int rn, unsigned int rd)
1435 {
1436     TCGv_i64 tcg_n, tcg_m, tcg_rd;
1437     tcg_rd = cpu_reg(s, rd);
1438
1439     if (!sf && is_signed) {
1440         tcg_n = new_tmp_a64(s);
1441         tcg_m = new_tmp_a64(s);
1442         tcg_gen_ext32s_i64(tcg_n, cpu_reg(s, rn));
1443         tcg_gen_ext32s_i64(tcg_m, cpu_reg(s, rm));
1444     } else {
1445         tcg_n = read_cpu_reg(s, rn, sf);
1446         tcg_m = read_cpu_reg(s, rm, sf);
1447     }
1448
1449     if (is_signed) {
1450         gen_helper_sdiv64(tcg_rd, tcg_n, tcg_m);
1451     } else {
1452         gen_helper_udiv64(tcg_rd, tcg_n, tcg_m);
1453     }
1454
1455     if (!sf) { /* zero extend final result */
1456         tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
1457     }
1458 }
1459
1460 /* C5.6.115 LSLV, C5.6.118 LSRV, C5.6.17 ASRV, C5.6.154 RORV */
1461 static void handle_shift_reg(DisasContext *s,
1462                              enum a64_shift_type shift_type, unsigned int sf,
1463                              unsigned int rm, unsigned int rn, unsigned int rd)
1464 {
1465     TCGv_i64 tcg_shift = tcg_temp_new_i64();
1466     TCGv_i64 tcg_rd = cpu_reg(s, rd);
1467     TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);
1468
1469     tcg_gen_andi_i64(tcg_shift, cpu_reg(s, rm), sf ? 63 : 31);
1470     shift_reg(tcg_rd, tcg_rn, sf, shift_type, tcg_shift);
1471     tcg_temp_free_i64(tcg_shift);
1472 }
1473
1474 /* C3.5.8 Data-processing (2 source)
1475  *   31   30  29 28             21 20  16 15    10 9    5 4    0
1476  * +----+---+---+-----------------+------+--------+------+------+
1477  * | sf | 0 | S | 1 1 0 1 0 1 1 0 |  Rm  | opcode |  Rn  |  Rd  |
1478  * +----+---+---+-----------------+------+--------+------+------+
1479  */
1480 static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
1481 {
1482     unsigned int sf, rm, opcode, rn, rd;
1483     sf = extract32(insn, 31, 1);
1484     rm = extract32(insn, 16, 5);
1485     opcode = extract32(insn, 10, 6);
1486     rn = extract32(insn, 5, 5);
1487     rd = extract32(insn, 0, 5);
1488
1489     if (extract32(insn, 29, 1)) {
1490         unallocated_encoding(s);
1491         return;
1492     }
1493
1494     switch (opcode) {
1495     case 2: /* UDIV */
1496         handle_div(s, false, sf, rm, rn, rd);
1497         break;
1498     case 3: /* SDIV */
1499         handle_div(s, true, sf, rm, rn, rd);
1500         break;
1501     case 8: /* LSLV */
1502         handle_shift_reg(s, A64_SHIFT_TYPE_LSL, sf, rm, rn, rd);
1503         break;
1504     case 9: /* LSRV */
1505         handle_shift_reg(s, A64_SHIFT_TYPE_LSR, sf, rm, rn, rd);
1506         break;
1507     case 10: /* ASRV */
1508         handle_shift_reg(s, A64_SHIFT_TYPE_ASR, sf, rm, rn, rd);
1509         break;
1510     case 11: /* RORV */
1511         handle_shift_reg(s, A64_SHIFT_TYPE_ROR, sf, rm, rn, rd);
1512         break;
1513     case 16:
1514     case 17:
1515     case 18:
1516     case 19:
1517     case 20:
1518     case 21:
1519     case 22:
1520     case 23: /* CRC32 */
1521         unsupported_encoding(s, insn);
1522         break;
1523     default:
1524         unallocated_encoding(s);
1525         break;
1526     }
1527 }
1528
1529 /* C3.5 Data processing - register */
1530 static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
1531 {
1532     switch (extract32(insn, 24, 5)) {
1533     case 0x0a: /* Logical (shifted register) */
1534         disas_logic_reg(s, insn);
1535         break;
1536     case 0x0b: /* Add/subtract */
1537         if (insn & (1 << 21)) { /* (extended register) */
1538             disas_add_sub_ext_reg(s, insn);
1539         } else {
1540             disas_add_sub_reg(s, insn);
1541         }
1542         break;
1543     case 0x1b: /* Data-processing (3 source) */
1544         disas_data_proc_3src(s, insn);
1545         break;
1546     case 0x1a:
1547         switch (extract32(insn, 21, 3)) {
1548         case 0x0: /* Add/subtract (with carry) */
1549             disas_adc_sbc(s, insn);
1550             break;
1551         case 0x2: /* Conditional compare */
1552             if (insn & (1 << 11)) { /* (immediate) */
1553                 disas_cc_imm(s, insn);
1554             } else {            /* (register) */
1555                 disas_cc_reg(s, insn);
1556             }
1557             break;
1558         case 0x4: /* Conditional select */
1559             disas_cond_select(s, insn);
1560             break;
1561         case 0x6: /* Data-processing */
1562             if (insn & (1 << 30)) { /* (1 source) */
1563                 disas_data_proc_1src(s, insn);
1564             } else {            /* (2 source) */
1565                 disas_data_proc_2src(s, insn);
1566             }
1567             break;
1568         default:
1569             unallocated_encoding(s);
1570             break;
1571         }
1572         break;
1573     default:
1574         unallocated_encoding(s);
1575         break;
1576     }
1577 }
1578
1579 /* C3.6 Data processing - SIMD and floating point */
1580 static void disas_data_proc_simd_fp(DisasContext *s, uint32_t insn)
1581 {
1582     unsupported_encoding(s, insn);
1583 }
1584
1585 /* C3.1 A64 instruction index by encoding */
1586 static void disas_a64_insn(CPUARMState *env, DisasContext *s)
1587 {
1588     uint32_t insn;
1589
1590     insn = arm_ldl_code(env, s->pc, s->bswap_code);
1591     s->insn = insn;
1592     s->pc += 4;
1593
1594     switch (extract32(insn, 25, 4)) {
1595     case 0x0: case 0x1: case 0x2: case 0x3: /* UNALLOCATED */
1596         unallocated_encoding(s);
1597         break;
1598     case 0x8: case 0x9: /* Data processing - immediate */
1599         disas_data_proc_imm(s, insn);
1600         break;
1601     case 0xa: case 0xb: /* Branch, exception generation and system insns */
1602         disas_b_exc_sys(s, insn);
1603         break;
1604     case 0x4:
1605     case 0x6:
1606     case 0xc:
1607     case 0xe:      /* Loads and stores */
1608         disas_ldst(s, insn);
1609         break;
1610     case 0x5:
1611     case 0xd:      /* Data processing - register */
1612         disas_data_proc_reg(s, insn);
1613         break;
1614     case 0x7:
1615     case 0xf:      /* Data processing - SIMD and floating point */
1616         disas_data_proc_simd_fp(s, insn);
1617         break;
1618     default:
1619         assert(FALSE); /* all 15 cases should be handled above */
1620         break;
1621     }
1622
1623     /* if we allocated any temporaries, free them here */
1624     free_tmp_a64(s);
1625 }
1626
1627 void gen_intermediate_code_internal_a64(ARMCPU *cpu,
1628                                         TranslationBlock *tb,
1629                                         bool search_pc)
1630 {
1631     CPUState *cs = CPU(cpu);
1632     CPUARMState *env = &cpu->env;
1633     DisasContext dc1, *dc = &dc1;
1634     CPUBreakpoint *bp;
1635     uint16_t *gen_opc_end;
1636     int j, lj;
1637     target_ulong pc_start;
1638     target_ulong next_page_start;
1639     int num_insns;
1640     int max_insns;
1641
1642     pc_start = tb->pc;
1643
1644     dc->tb = tb;
1645
1646     gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE;
1647
1648     dc->is_jmp = DISAS_NEXT;
1649     dc->pc = pc_start;
1650     dc->singlestep_enabled = cs->singlestep_enabled;
1651     dc->condjmp = 0;
1652
1653     dc->aarch64 = 1;
1654     dc->thumb = 0;
1655     dc->bswap_code = 0;
1656     dc->condexec_mask = 0;
1657     dc->condexec_cond = 0;
1658 #if !defined(CONFIG_USER_ONLY)
1659     dc->user = 0;
1660 #endif
1661     dc->vfp_enabled = 0;
1662     dc->vec_len = 0;
1663     dc->vec_stride = 0;
1664
1665     init_tmp_a64_array(dc);
1666
1667     next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
1668     lj = -1;
1669     num_insns = 0;
1670     max_insns = tb->cflags & CF_COUNT_MASK;
1671     if (max_insns == 0) {
1672         max_insns = CF_COUNT_MASK;
1673     }
1674
1675     gen_tb_start();
1676
1677     tcg_clear_temp_count();
1678
1679     do {
1680         if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {
1681             QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
1682                 if (bp->pc == dc->pc) {
1683                     gen_exception_insn(dc, 0, EXCP_DEBUG);
1684                     /* Advance PC so that clearing the breakpoint will
1685                        invalidate this TB.  */
1686                     dc->pc += 2;
1687                     goto done_generating;
1688                 }
1689             }
1690         }
1691
1692         if (search_pc) {
1693             j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
1694             if (lj < j) {
1695                 lj++;
1696                 while (lj < j) {
1697                     tcg_ctx.gen_opc_instr_start[lj++] = 0;
1698                 }
1699             }
1700             tcg_ctx.gen_opc_pc[lj] = dc->pc;
1701             tcg_ctx.gen_opc_instr_start[lj] = 1;
1702             tcg_ctx.gen_opc_icount[lj] = num_insns;
1703         }
1704
1705         if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO)) {
1706             gen_io_start();
1707         }
1708
1709         if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT))) {
1710             tcg_gen_debug_insn_start(dc->pc);
1711         }
1712
1713         disas_a64_insn(env, dc);
1714
1715         if (tcg_check_temp_count()) {
1716             fprintf(stderr, "TCG temporary leak before "TARGET_FMT_lx"\n",
1717                     dc->pc);
1718         }
1719
1720         /* Translation stops when a conditional branch is encountered.
1721          * Otherwise the subsequent code could get translated several times.
1722          * Also stop translation when a page boundary is reached.  This
1723          * ensures prefetch aborts occur at the right place.
1724          */
1725         num_insns++;
1726     } while (!dc->is_jmp && tcg_ctx.gen_opc_ptr < gen_opc_end &&
1727              !cs->singlestep_enabled &&
1728              !singlestep &&
1729              dc->pc < next_page_start &&
1730              num_insns < max_insns);
1731
1732     if (tb->cflags & CF_LAST_IO) {
1733         gen_io_end();
1734     }
1735
1736     if (unlikely(cs->singlestep_enabled) && dc->is_jmp != DISAS_EXC) {
1737         /* Note that this means single stepping WFI doesn't halt the CPU.
1738          * For conditional branch insns this is harmless unreachable code as
1739          * gen_goto_tb() has already handled emitting the debug exception
1740          * (and thus a tb-jump is not possible when singlestepping).
1741          */
1742         assert(dc->is_jmp != DISAS_TB_JUMP);
1743         if (dc->is_jmp != DISAS_JUMP) {
1744             gen_a64_set_pc_im(dc->pc);
1745         }
1746         gen_exception(EXCP_DEBUG);
1747     } else {
1748         switch (dc->is_jmp) {
1749         case DISAS_NEXT:
1750             gen_goto_tb(dc, 1, dc->pc);
1751             break;
1752         default:
1753         case DISAS_JUMP:
1754         case DISAS_UPDATE:
1755             /* indicate that the hash table must be used to find the next TB */
1756             tcg_gen_exit_tb(0);
1757             break;
1758         case DISAS_TB_JUMP:
1759         case DISAS_EXC:
1760         case DISAS_SWI:
1761             break;
1762         case DISAS_WFI:
1763             /* This is a special case because we don't want to just halt the CPU
1764              * if trying to debug across a WFI.
1765              */
1766             gen_helper_wfi(cpu_env);
1767             break;
1768         }
1769     }
1770
1771 done_generating:
1772     gen_tb_end(tb, num_insns);
1773     *tcg_ctx.gen_opc_ptr = INDEX_op_end;
1774
1775 #ifdef DEBUG_DISAS
1776     if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {
1777         qemu_log("----------------\n");
1778         qemu_log("IN: %s\n", lookup_symbol(pc_start));
1779         log_target_disas(env, pc_start, dc->pc - pc_start,
1780                          dc->thumb | (dc->bswap_code << 1));
1781         qemu_log("\n");
1782     }
1783 #endif
1784     if (search_pc) {
1785         j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf;
1786         lj++;
1787         while (lj <= j) {
1788             tcg_ctx.gen_opc_instr_start[lj++] = 0;
1789         }
1790     } else {
1791         tb->size = dc->pc - pc_start;
1792         tb->icount = num_insns;
1793     }
1794 }