target-arm/helper.c

   1 #include <stdio.h>
   2 #include <stdlib.h>
   3 #include <string.h>
   4
   5 #include "cpu.h"
   6 #include "exec-all.h"
   7 #include "gdbstub.h"
   8 #include "helpers.h"
   9 #include "qemu-common.h"
  10
  11 static uint32_t cortexa8_cp15_c0_c1[8] =
  12 { 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
  13
  14 static uint32_t cortexa8_cp15_c0_c2[8] =
  15 { 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
  16
  17 static uint32_t mpcore_cp15_c0_c1[8] =
  18 { 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
  19
  20 static uint32_t mpcore_cp15_c0_c2[8] =
  21 { 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
  22
  23 static uint32_t arm1136_cp15_c0_c1[8] =
  24 { 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
  25
  26 static uint32_t arm1136_cp15_c0_c2[8] =
  27 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
  28
  29 static uint32_t cpu_arm_find_by_name(const char *name);
  30
  31 static inline void set_feature(CPUARMState *env, int feature)
  32 {
  33     env->features |= 1u << feature;
  34 }
  35
  36 static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
  37 {
  38     env->cp15.c0_cpuid = id;
  39     switch (id) {
  40     case ARM_CPUID_ARM926:
  41         set_feature(env, ARM_FEATURE_VFP);
  42         env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
  43         env->cp15.c0_cachetype = 0x1dd20d2;
  44         env->cp15.c1_sys = 0x00090078;
  45         break;
  46     case ARM_CPUID_ARM946:
  47         set_feature(env, ARM_FEATURE_MPU);
  48         env->cp15.c0_cachetype = 0x0f004006;
  49         env->cp15.c1_sys = 0x00000078;
  50         break;
  51     case ARM_CPUID_ARM1026:
  52         set_feature(env, ARM_FEATURE_VFP);
  53         set_feature(env, ARM_FEATURE_AUXCR);
  54         env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
  55         env->cp15.c0_cachetype = 0x1dd20d2;
  56         env->cp15.c1_sys = 0x00090078;
  57         break;
  58     case ARM_CPUID_ARM1136_R2:
  59     case ARM_CPUID_ARM1136:
  60         set_feature(env, ARM_FEATURE_V6);
  61         set_feature(env, ARM_FEATURE_VFP);
  62         set_feature(env, ARM_FEATURE_AUXCR);
  63         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  64         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  65         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  66         memcpy(env->cp15.c0_c1, arm1136_cp15_c0_c1, 8 * sizeof(uint32_t));
  67         memcpy(env->cp15.c0_c2, arm1136_cp15_c0_c2, 8 * sizeof(uint32_t));
  68         env->cp15.c0_cachetype = 0x1dd20d2;
  69         break;
  70     case ARM_CPUID_ARM11MPCORE:
  71         set_feature(env, ARM_FEATURE_V6);
  72         set_feature(env, ARM_FEATURE_V6K);
  73         set_feature(env, ARM_FEATURE_VFP);
  74         set_feature(env, ARM_FEATURE_AUXCR);
  75         env->vfp.xregs[ARM_VFP_FPSID] = 0x410120b4;
  76         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11111111;
  77         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00000000;
  78         memcpy(env->cp15.c0_c1, mpcore_cp15_c0_c1, 8 * sizeof(uint32_t));
  79         memcpy(env->cp15.c0_c2, mpcore_cp15_c0_c2, 8 * sizeof(uint32_t));
  80         env->cp15.c0_cachetype = 0x1dd20d2;
  81         break;
  82     case ARM_CPUID_CORTEXA8:
  83         set_feature(env, ARM_FEATURE_V6);
  84         set_feature(env, ARM_FEATURE_V6K);
  85         set_feature(env, ARM_FEATURE_V7);
  86         set_feature(env, ARM_FEATURE_AUXCR);
  87         set_feature(env, ARM_FEATURE_THUMB2);
  88         set_feature(env, ARM_FEATURE_VFP);
  89         set_feature(env, ARM_FEATURE_VFP3);
  90         set_feature(env, ARM_FEATURE_NEON);
  91         env->vfp.xregs[ARM_VFP_FPSID] = 0x410330c0;
  92         env->vfp.xregs[ARM_VFP_MVFR0] = 0x11110222;
  93         env->vfp.xregs[ARM_VFP_MVFR1] = 0x00011100;
  94         memcpy(env->cp15.c0_c1, cortexa8_cp15_c0_c1, 8 * sizeof(uint32_t));
  95         memcpy(env->cp15.c0_c2, cortexa8_cp15_c0_c2, 8 * sizeof(uint32_t));
  96         env->cp15.c0_cachetype = 0x1dd20d2;
  97         break;
  98     case ARM_CPUID_CORTEXM3:
  99         set_feature(env, ARM_FEATURE_V6);
 100         set_feature(env, ARM_FEATURE_THUMB2);
 101         set_feature(env, ARM_FEATURE_V7);
 102         set_feature(env, ARM_FEATURE_M);
 103         set_feature(env, ARM_FEATURE_DIV);
 104         break;
 105     case ARM_CPUID_ANY: /* For userspace emulation.  */
 106         set_feature(env, ARM_FEATURE_V6);
 107         set_feature(env, ARM_FEATURE_V6K);
 108         set_feature(env, ARM_FEATURE_V7);
 109         set_feature(env, ARM_FEATURE_THUMB2);
 110         set_feature(env, ARM_FEATURE_VFP);
 111         set_feature(env, ARM_FEATURE_VFP3);
 112         set_feature(env, ARM_FEATURE_NEON);
 113         set_feature(env, ARM_FEATURE_DIV);
 114         break;
 115     case ARM_CPUID_TI915T:
 116     case ARM_CPUID_TI925T:
 117         set_feature(env, ARM_FEATURE_OMAPCP);
 118         env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
 119         env->cp15.c0_cachetype = 0x5109149;
 120         env->cp15.c1_sys = 0x00000070;
 121         env->cp15.c15_i_max = 0x000;
 122         env->cp15.c15_i_min = 0xff0;
 123         break;
 124     case ARM_CPUID_PXA250:
 125     case ARM_CPUID_PXA255:
 126     case ARM_CPUID_PXA260:
 127     case ARM_CPUID_PXA261:
 128     case ARM_CPUID_PXA262:
 129         set_feature(env, ARM_FEATURE_XSCALE);
 130         /* JTAG_ID is ((id << 28) | 0x09265013) */
 131         env->cp15.c0_cachetype = 0xd172172;
 132         env->cp15.c1_sys = 0x00000078;
 133         break;
 134     case ARM_CPUID_PXA270_A0:
 135     case ARM_CPUID_PXA270_A1:
 136     case ARM_CPUID_PXA270_B0:
 137     case ARM_CPUID_PXA270_B1:
 138     case ARM_CPUID_PXA270_C0:
 139     case ARM_CPUID_PXA270_C5:
 140         set_feature(env, ARM_FEATURE_XSCALE);
 141         /* JTAG_ID is ((id << 28) | 0x09265013) */
 142         set_feature(env, ARM_FEATURE_IWMMXT);
 143         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
 144         env->cp15.c0_cachetype = 0xd172172;
 145         env->cp15.c1_sys = 0x00000078;
 146         break;
 147     default:
 148         cpu_abort(env, "Bad CPU ID: %x\n", id);
 149         break;
 150     }
 151 }
 152
 153 void cpu_reset(CPUARMState *env)
 154 {
 155     uint32_t id;
 156     id = env->cp15.c0_cpuid;
 157     memset(env, 0, offsetof(CPUARMState, breakpoints));
 158     if (id)
 159         cpu_reset_model_id(env, id);
 160 #if defined (CONFIG_USER_ONLY)
 161     env->uncached_cpsr = ARM_CPU_MODE_USR;
 162     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
 163 #else
 164     /* SVC mode with interrupts disabled.  */
 165     env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
 166     /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
 167        clear at reset.  */
 168     if (IS_M(env))
 169         env->uncached_cpsr &= ~CPSR_I;
 170     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 171     env->cp15.c2_base_mask = 0xffffc000u;
 172 #endif
 173     env->regs[15] = 0;
 174     tlb_flush(env, 1);
 175 }
 176
 177 static int vfp_gdb_get_reg(CPUState *env, uint8_t *buf, int reg)
 178 {
 179     int nregs;
 180
 181     /* VFP data registers are always little-endian.  */
 182     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 183     if (reg < nregs) {
 184         stfq_le_p(buf, env->vfp.regs[reg]);
 185         return 8;
 186     }
 187     if (arm_feature(env, ARM_FEATURE_NEON)) {
 188         /* Aliases for Q regs.  */
 189         nregs += 16;
 190         if (reg < nregs) {
 191             stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 192             stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 193             return 16;
 194         }
 195     }
 196     switch (reg - nregs) {
 197     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
 198     case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
 199     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
 200     }
 201     return 0;
 202 }
 203
 204 static int vfp_gdb_set_reg(CPUState *env, uint8_t *buf, int reg)
 205 {
 206     int nregs;
 207
 208     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
 209     if (reg < nregs) {
 210         env->vfp.regs[reg] = ldfq_le_p(buf);
 211         return 8;
 212     }
 213     if (arm_feature(env, ARM_FEATURE_NEON)) {
 214         nregs += 16;
 215         if (reg < nregs) {
 216             env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
 217             env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
 218             return 16;
 219         }
 220     }
 221     switch (reg - nregs) {
 222     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
 223     case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
 224     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf); return 4;
 225     }
 226     return 0;
 227 }
 228
 229 CPUARMState *cpu_arm_init(const char *cpu_model)
 230 {
 231     CPUARMState *env;
 232     uint32_t id;
 233     static int inited = 0;
 234
 235     id = cpu_arm_find_by_name(cpu_model);
 236     if (id == 0)
 237         return NULL;
 238     env = qemu_mallocz(sizeof(CPUARMState));
 239     if (!env)
 240         return NULL;
 241     cpu_exec_init(env);
 242     if (!inited) {
 243         inited = 1;
 244         arm_translate_init();
 245     }
 246
 247     env->cpu_model_str = cpu_model;
 248     env->cp15.c0_cpuid = id;
 249     cpu_reset(env);
 250     if (arm_feature(env, ARM_FEATURE_NEON)) {
 251         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 252                                  51, "arm-neon.xml", 0);
 253     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
 254         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 255                                  35, "arm-vfp3.xml", 0);
 256     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 257         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
 258                                  19, "arm-vfp.xml", 0);
 259     }
 260     return env;
 261 }
 262
 263 struct arm_cpu_t {
 264     uint32_t id;
 265     const char *name;
 266 };
 267
 268 static const struct arm_cpu_t arm_cpu_names[] = {
 269     { ARM_CPUID_ARM926, "arm926"},
 270     { ARM_CPUID_ARM946, "arm946"},
 271     { ARM_CPUID_ARM1026, "arm1026"},
 272     { ARM_CPUID_ARM1136, "arm1136"},
 273     { ARM_CPUID_ARM1136_R2, "arm1136-r2"},
 274     { ARM_CPUID_ARM11MPCORE, "arm11mpcore"},
 275     { ARM_CPUID_CORTEXM3, "cortex-m3"},
 276     { ARM_CPUID_CORTEXA8, "cortex-a8"},
 277     { ARM_CPUID_TI925T, "ti925t" },
 278     { ARM_CPUID_PXA250, "pxa250" },
 279     { ARM_CPUID_PXA255, "pxa255" },
 280     { ARM_CPUID_PXA260, "pxa260" },
 281     { ARM_CPUID_PXA261, "pxa261" },
 282     { ARM_CPUID_PXA262, "pxa262" },
 283     { ARM_CPUID_PXA270, "pxa270" },
 284     { ARM_CPUID_PXA270_A0, "pxa270-a0" },
 285     { ARM_CPUID_PXA270_A1, "pxa270-a1" },
 286     { ARM_CPUID_PXA270_B0, "pxa270-b0" },
 287     { ARM_CPUID_PXA270_B1, "pxa270-b1" },
 288     { ARM_CPUID_PXA270_C0, "pxa270-c0" },
 289     { ARM_CPUID_PXA270_C5, "pxa270-c5" },
 290     { ARM_CPUID_ANY, "any"},
 291     { 0, NULL}
 292 };
 293
 294 void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
 295 {
 296     int i;
 297
 298     (*cpu_fprintf)(f, "Available CPUs:\n");
 299     for (i = 0; arm_cpu_names[i].name; i++) {
 300         (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
 301     }
 302 }
 303
 304 /* return 0 if not found */
 305 static uint32_t cpu_arm_find_by_name(const char *name)
 306 {
 307     int i;
 308     uint32_t id;
 309
 310     id = 0;
 311     for (i = 0; arm_cpu_names[i].name; i++) {
 312         if (strcmp(name, arm_cpu_names[i].name) == 0) {
 313             id = arm_cpu_names[i].id;
 314             break;
 315         }
 316     }
 317     return id;
 318 }
 319
 320 void cpu_arm_close(CPUARMState *env)
 321 {
 322     free(env);
 323 }
 324
 325 uint32_t cpsr_read(CPUARMState *env)
 326 {
 327     int ZF;
 328     ZF = (env->ZF == 0);
 329     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
 330         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
 331         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
 332         | ((env->condexec_bits & 0xfc) << 8)
 333         | (env->GE << 16);
 334 }
 335
 336 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 337 {
 338     if (mask & CPSR_NZCV) {
 339         env->ZF = (~val) & CPSR_Z;
 340         env->NF = val;
 341         env->CF = (val >> 29) & 1;
 342         env->VF = (val << 3) & 0x80000000;
 343     }
 344     if (mask & CPSR_Q)
 345         env->QF = ((val & CPSR_Q) != 0);
 346     if (mask & CPSR_T)
 347         env->thumb = ((val & CPSR_T) != 0);
 348     if (mask & CPSR_IT_0_1) {
 349         env->condexec_bits &= ~3;
 350         env->condexec_bits |= (val >> 25) & 3;
 351     }
 352     if (mask & CPSR_IT_2_7) {
 353         env->condexec_bits &= 3;
 354         env->condexec_bits |= (val >> 8) & 0xfc;
 355     }
 356     if (mask & CPSR_GE) {
 357         env->GE = (val >> 16) & 0xf;
 358     }
 359
 360     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
 361         switch_mode(env, val & CPSR_M);
 362     }
 363     mask &= ~CACHED_CPSR_BITS;
 364     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
 365 }
 366
 367 /* Sign/zero extend */
 368 uint32_t HELPER(sxtb16)(uint32_t x)
 369 {
 370     uint32_t res;
 371     res = (uint16_t)(int8_t)x;
 372     res |= (uint32_t)(int8_t)(x >> 16) << 16;
 373     return res;
 374 }
 375
 376 uint32_t HELPER(uxtb16)(uint32_t x)
 377 {
 378     uint32_t res;
 379     res = (uint16_t)(uint8_t)x;
 380     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
 381     return res;
 382 }
 383
 384 uint32_t HELPER(clz)(uint32_t x)
 385 {
 386     int count;
 387     for (count = 32; x; count--)
 388         x >>= 1;
 389     return count;
 390 }
 391
 392 int32_t HELPER(sdiv)(int32_t num, int32_t den)
 393 {
 394     if (den == 0)
 395       return 0;
 396     return num / den;
 397 }
 398
 399 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
 400 {
 401     if (den == 0)
 402       return 0;
 403     return num / den;
 404 }
 405
 406 uint32_t HELPER(rbit)(uint32_t x)
 407 {
 408     x =  ((x & 0xff000000) >> 24)
 409        | ((x & 0x00ff0000) >> 8)
 410        | ((x & 0x0000ff00) << 8)
 411        | ((x & 0x000000ff) << 24);
 412     x =  ((x & 0xf0f0f0f0) >> 4)
 413        | ((x & 0x0f0f0f0f) << 4);
 414     x =  ((x & 0x88888888) >> 3)
 415        | ((x & 0x44444444) >> 1)
 416        | ((x & 0x22222222) << 1)
 417        | ((x & 0x11111111) << 3);
 418     return x;
 419 }
 420
 421 uint32_t HELPER(abs)(uint32_t x)
 422 {
 423     return ((int32_t)x < 0) ? -x : x;
 424 }
 425
 426 #if defined(CONFIG_USER_ONLY)
 427
 428 void do_interrupt (CPUState *env)
 429 {
 430     env->exception_index = -1;
 431 }
 432
 433 /* Structure used to record exclusive memory locations.  */
 434 typedef struct mmon_state {
 435     struct mmon_state *next;
 436     CPUARMState *cpu_env;
 437     uint32_t addr;
 438 } mmon_state;
 439
 440 /* Chain of current locks.  */
 441 static mmon_state* mmon_head = NULL;
 442
 443 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
 444                               int mmu_idx, int is_softmmu)
 445 {
 446     if (rw == 2) {
 447         env->exception_index = EXCP_PREFETCH_ABORT;
 448         env->cp15.c6_insn = address;
 449     } else {
 450         env->exception_index = EXCP_DATA_ABORT;
 451         env->cp15.c6_data = address;
 452     }
 453     return 1;
 454 }
 455
 456 static void allocate_mmon_state(CPUState *env)
 457 {
 458     env->mmon_entry = malloc(sizeof (mmon_state));
 459     if (!env->mmon_entry)
 460         abort();
 461     memset (env->mmon_entry, 0, sizeof (mmon_state));
 462     env->mmon_entry->cpu_env = env;
 463     mmon_head = env->mmon_entry;
 464 }
 465
 466 /* Flush any monitor locks for the specified address.  */
 467 static void flush_mmon(uint32_t addr)
 468 {
 469     mmon_state *mon;
 470
 471     for (mon = mmon_head; mon; mon = mon->next)
 472       {
 473         if (mon->addr != addr)
 474           continue;
 475
 476         mon->addr = 0;
 477         break;
 478       }
 479 }
 480
 481 /* Mark an address for exclusive access.  */
 482 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
 483 {
 484     if (!env->mmon_entry)
 485         allocate_mmon_state(env);
 486     /* Clear any previous locks.  */
 487     flush_mmon(addr);
 488     env->mmon_entry->addr = addr;
 489 }
 490
 491 /* Test if an exclusive address is still exclusive.  Returns zero
 492    if the address is still exclusive.   */
 493 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
 494 {
 495     int res;
 496
 497     if (!env->mmon_entry)
 498         return 1;
 499     if (env->mmon_entry->addr == addr)
 500         res = 0;
 501     else
 502         res = 1;
 503     flush_mmon(addr);
 504     return res;
 505 }
 506
 507 void HELPER(clrex)(CPUState *env)
 508 {
 509     if (!(env->mmon_entry && env->mmon_entry->addr))
 510         return;
 511     flush_mmon(env->mmon_entry->addr);
 512 }
 513
 514 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 515 {
 516     return addr;
 517 }
 518
 519 /* These should probably raise undefined insn exceptions.  */
 520 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
 521 {
 522     int op1 = (insn >> 8) & 0xf;
 523     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 524     return;
 525 }
 526
 527 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
 528 {
 529     int op1 = (insn >> 8) & 0xf;
 530     cpu_abort(env, "cp%i insn %08x\n", op1, insn);
 531     return 0;
 532 }
 533
 534 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
 535 {
 536     cpu_abort(env, "cp15 insn %08x\n", insn);
 537 }
 538
 539 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
 540 {
 541     cpu_abort(env, "cp15 insn %08x\n", insn);
 542     return 0;
 543 }
 544
 545 /* These should probably raise undefined insn exceptions.  */
 546 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
 547 {
 548     cpu_abort(env, "v7m_mrs %d\n", reg);
 549 }
 550
 551 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
 552 {
 553     cpu_abort(env, "v7m_mrs %d\n", reg);
 554     return 0;
 555 }
 556
 557 void switch_mode(CPUState *env, int mode)
 558 {
 559     if (mode != ARM_CPU_MODE_USR)
 560         cpu_abort(env, "Tried to switch out of user mode\n");
 561 }
 562
 563 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
 564 {
 565     cpu_abort(env, "banked r13 write\n");
 566 }
 567
 568 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
 569 {
 570     cpu_abort(env, "banked r13 read\n");
 571     return 0;
 572 }
 573
 574 #else
 575
 576 extern int semihosting_enabled;
 577
 578 /* Map CPU modes onto saved register banks.  */
 579 static inline int bank_number (int mode)
 580 {
 581     switch (mode) {
 582     case ARM_CPU_MODE_USR:
 583     case ARM_CPU_MODE_SYS:
 584         return 0;
 585     case ARM_CPU_MODE_SVC:
 586         return 1;
 587     case ARM_CPU_MODE_ABT:
 588         return 2;
 589     case ARM_CPU_MODE_UND:
 590         return 3;
 591     case ARM_CPU_MODE_IRQ:
 592         return 4;
 593     case ARM_CPU_MODE_FIQ:
 594         return 5;
 595     }
 596     cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
 597     return -1;
 598 }
 599
 600 void switch_mode(CPUState *env, int mode)
 601 {
 602     int old_mode;
 603     int i;
 604
 605     old_mode = env->uncached_cpsr & CPSR_M;
 606     if (mode == old_mode)
 607         return;
 608
 609     if (old_mode == ARM_CPU_MODE_FIQ) {
 610         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
 611         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
 612     } else if (mode == ARM_CPU_MODE_FIQ) {
 613         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
 614         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
 615     }
 616
 617     i = bank_number(old_mode);
 618     env->banked_r13[i] = env->regs[13];
 619     env->banked_r14[i] = env->regs[14];
 620     env->banked_spsr[i] = env->spsr;
 621
 622     i = bank_number(mode);
 623     env->regs[13] = env->banked_r13[i];
 624     env->regs[14] = env->banked_r14[i];
 625     env->spsr = env->banked_spsr[i];
 626 }
 627
 628 static void v7m_push(CPUARMState *env, uint32_t val)
 629 {
 630     env->regs[13] -= 4;
 631     stl_phys(env->regs[13], val);
 632 }
 633
 634 static uint32_t v7m_pop(CPUARMState *env)
 635 {
 636     uint32_t val;
 637     val = ldl_phys(env->regs[13]);
 638     env->regs[13] += 4;
 639     return val;
 640 }
 641
 642 /* Switch to V7M main or process stack pointer.  */
 643 static void switch_v7m_sp(CPUARMState *env, int process)
 644 {
 645     uint32_t tmp;
 646     if (env->v7m.current_sp != process) {
 647         tmp = env->v7m.other_sp;
 648         env->v7m.other_sp = env->regs[13];
 649         env->regs[13] = tmp;
 650         env->v7m.current_sp = process;
 651     }
 652 }
 653
 654 static void do_v7m_exception_exit(CPUARMState *env)
 655 {
 656     uint32_t type;
 657     uint32_t xpsr;
 658
 659     type = env->regs[15];
 660     if (env->v7m.exception != 0)
 661         armv7m_nvic_complete_irq(env->v7m.nvic, env->v7m.exception);
 662
 663     /* Switch to the target stack.  */
 664     switch_v7m_sp(env, (type & 4) != 0);
 665     /* Pop registers.  */
 666     env->regs[0] = v7m_pop(env);
 667     env->regs[1] = v7m_pop(env);
 668     env->regs[2] = v7m_pop(env);
 669     env->regs[3] = v7m_pop(env);
 670     env->regs[12] = v7m_pop(env);
 671     env->regs[14] = v7m_pop(env);
 672     env->regs[15] = v7m_pop(env);
 673     xpsr = v7m_pop(env);
 674     xpsr_write(env, xpsr, 0xfffffdff);
 675     /* Undo stack alignment.  */
 676     if (xpsr & 0x200)
 677         env->regs[13] |= 4;
 678     /* ??? The exception return type specifies Thread/Handler mode.  However
 679        this is also implied by the xPSR value. Not sure what to do
 680        if there is a mismatch.  */
 681     /* ??? Likewise for mismatches between the CONTROL register and the stack
 682        pointer.  */
 683 }
 684
 685 void do_interrupt_v7m(CPUARMState *env)
 686 {
 687     uint32_t xpsr = xpsr_read(env);
 688     uint32_t lr;
 689     uint32_t addr;
 690
 691     lr = 0xfffffff1;
 692     if (env->v7m.current_sp)
 693         lr |= 4;
 694     if (env->v7m.exception == 0)
 695         lr |= 8;
 696
 697     /* For exceptions we just mark as pending on the NVIC, and let that
 698        handle it.  */
 699     /* TODO: Need to escalate if the current priority is higher than the
 700        one we're raising.  */
 701     switch (env->exception_index) {
 702     case EXCP_UDEF:
 703         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_USAGE);
 704         return;
 705     case EXCP_SWI:
 706         env->regs[15] += 2;
 707         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_SVC);
 708         return;
 709     case EXCP_PREFETCH_ABORT:
 710     case EXCP_DATA_ABORT:
 711         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_MEM);
 712         return;
 713     case EXCP_BKPT:
 714         if (semihosting_enabled) {
 715             int nr;
 716             nr = lduw_code(env->regs[15]) & 0xff;
 717             if (nr == 0xab) {
 718                 env->regs[15] += 2;
 719                 env->regs[0] = do_arm_semihosting(env);
 720                 return;
 721             }
 722         }
 723         armv7m_nvic_set_pending(env->v7m.nvic, ARMV7M_EXCP_DEBUG);
 724         return;
 725     case EXCP_IRQ:
 726         env->v7m.exception = armv7m_nvic_acknowledge_irq(env->v7m.nvic);
 727         break;
 728     case EXCP_EXCEPTION_EXIT:
 729         do_v7m_exception_exit(env);
 730         return;
 731     default:
 732         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 733         return; /* Never happens.  Keep compiler happy.  */
 734     }
 735
 736     /* Align stack pointer.  */
 737     /* ??? Should only do this if Configuration Control Register
 738        STACKALIGN bit is set.  */
 739     if (env->regs[13] & 4) {
 740         env->regs[13] -= 4;
 741         xpsr |= 0x200;
 742     }
 743     /* Switch to the handler mode.  */
 744     v7m_push(env, xpsr);
 745     v7m_push(env, env->regs[15]);
 746     v7m_push(env, env->regs[14]);
 747     v7m_push(env, env->regs[12]);
 748     v7m_push(env, env->regs[3]);
 749     v7m_push(env, env->regs[2]);
 750     v7m_push(env, env->regs[1]);
 751     v7m_push(env, env->regs[0]);
 752     switch_v7m_sp(env, 0);
 753     env->uncached_cpsr &= ~CPSR_IT;
 754     env->regs[14] = lr;
 755     addr = ldl_phys(env->v7m.vecbase + env->v7m.exception * 4);
 756     env->regs[15] = addr & 0xfffffffe;
 757     env->thumb = addr & 1;
 758 }
 759
 760 /* Handle a CPU exception.  */
 761 void do_interrupt(CPUARMState *env)
 762 {
 763     uint32_t addr;
 764     uint32_t mask;
 765     int new_mode;
 766     uint32_t offset;
 767
 768     if (IS_M(env)) {
 769         do_interrupt_v7m(env);
 770         return;
 771     }
 772     /* TODO: Vectored interrupt controller.  */
 773     switch (env->exception_index) {
 774     case EXCP_UDEF:
 775         new_mode = ARM_CPU_MODE_UND;
 776         addr = 0x04;
 777         mask = CPSR_I;
 778         if (env->thumb)
 779             offset = 2;
 780         else
 781             offset = 4;
 782         break;
 783     case EXCP_SWI:
 784         if (semihosting_enabled) {
 785             /* Check for semihosting interrupt.  */
 786             if (env->thumb) {
 787                 mask = lduw_code(env->regs[15] - 2) & 0xff;
 788             } else {
 789                 mask = ldl_code(env->regs[15] - 4) & 0xffffff;
 790             }
 791             /* Only intercept calls from privileged modes, to provide some
 792                semblance of security.  */
 793             if (((mask == 0x123456 && !env->thumb)
 794                     || (mask == 0xab && env->thumb))
 795                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 796                 env->regs[0] = do_arm_semihosting(env);
 797                 return;
 798             }
 799         }
 800         new_mode = ARM_CPU_MODE_SVC;
 801         addr = 0x08;
 802         mask = CPSR_I;
 803         /* The PC already points to the next instruction.  */
 804         offset = 0;
 805         break;
 806     case EXCP_BKPT:
 807         /* See if this is a semihosting syscall.  */
 808         if (env->thumb && semihosting_enabled) {
 809             mask = lduw_code(env->regs[15]) & 0xff;
 810             if (mask == 0xab
 811                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
 812                 env->regs[15] += 2;
 813                 env->regs[0] = do_arm_semihosting(env);
 814                 return;
 815             }
 816         }
 817         /* Fall through to prefetch abort.  */
 818     case EXCP_PREFETCH_ABORT:
 819         new_mode = ARM_CPU_MODE_ABT;
 820         addr = 0x0c;
 821         mask = CPSR_A | CPSR_I;
 822         offset = 4;
 823         break;
 824     case EXCP_DATA_ABORT:
 825         new_mode = ARM_CPU_MODE_ABT;
 826         addr = 0x10;
 827         mask = CPSR_A | CPSR_I;
 828         offset = 8;
 829         break;
 830     case EXCP_IRQ:
 831         new_mode = ARM_CPU_MODE_IRQ;
 832         addr = 0x18;
 833         /* Disable IRQ and imprecise data aborts.  */
 834         mask = CPSR_A | CPSR_I;
 835         offset = 4;
 836         break;
 837     case EXCP_FIQ:
 838         new_mode = ARM_CPU_MODE_FIQ;
 839         addr = 0x1c;
 840         /* Disable FIQ, IRQ and imprecise data aborts.  */
 841         mask = CPSR_A | CPSR_I | CPSR_F;
 842         offset = 4;
 843         break;
 844     default:
 845         cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
 846         return; /* Never happens.  Keep compiler happy.  */
 847     }
 848     /* High vectors.  */
 849     if (env->cp15.c1_sys & (1 << 13)) {
 850         addr += 0xffff0000;
 851     }
 852     switch_mode (env, new_mode);
 853     env->spsr = cpsr_read(env);
 854     /* Clear IT bits.  */
 855     env->condexec_bits = 0;
 856     /* Switch to the new mode, and switch to Arm mode.  */
 857     /* ??? Thumb interrupt handlers not implemented.  */
 858     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
 859     env->uncached_cpsr |= mask;
 860     env->thumb = 0;
 861     env->regs[14] = env->regs[15] + offset;
 862     env->regs[15] = addr;
 863     env->interrupt_request |= CPU_INTERRUPT_EXITTB;
 864 }
 865
 866 /* Check section/page access permissions.
 867    Returns the page protection flags, or zero if the access is not
 868    permitted.  */
 869 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
 870                            int is_user)
 871 {
 872   int prot_ro;
 873
 874   if (domain == 3)
 875     return PAGE_READ | PAGE_WRITE;
 876
 877   if (access_type == 1)
 878       prot_ro = 0;
 879   else
 880       prot_ro = PAGE_READ;
 881
 882   switch (ap) {
 883   case 0:
 884       if (access_type == 1)
 885           return 0;
 886       switch ((env->cp15.c1_sys >> 8) & 3) {
 887       case 1:
 888           return is_user ? 0 : PAGE_READ;
 889       case 2:
 890           return PAGE_READ;
 891       default:
 892           return 0;
 893       }
 894   case 1:
 895       return is_user ? 0 : PAGE_READ | PAGE_WRITE;
 896   case 2:
 897       if (is_user)
 898           return prot_ro;
 899       else
 900           return PAGE_READ | PAGE_WRITE;
 901   case 3:
 902       return PAGE_READ | PAGE_WRITE;
 903   case 4: /* Reserved.  */
 904       return 0;
 905   case 5:
 906       return is_user ? 0 : prot_ro;
 907   case 6:
 908       return prot_ro;
 909   case 7:
 910       if (!arm_feature (env, ARM_FEATURE_V7))
 911           return 0;
 912       return prot_ro;
 913   default:
 914       abort();
 915   }
 916 }
 917
 918 static uint32_t get_level1_table_address(CPUState *env, uint32_t address)
 919 {
 920     uint32_t table;
 921
 922     if (address & env->cp15.c2_mask)
 923         table = env->cp15.c2_base1 & 0xffffc000;
 924     else
 925         table = env->cp15.c2_base0 & env->cp15.c2_base_mask;
 926
 927     table |= (address >> 18) & 0x3ffc;
 928     return table;
 929 }
 930
 931 static int get_phys_addr_v5(CPUState *env, uint32_t address, int access_type,
 932                             int is_user, uint32_t *phys_ptr, int *prot)
 933 {
 934     int code;
 935     uint32_t table;
 936     uint32_t desc;
 937     int type;
 938     int ap;
 939     int domain;
 940     uint32_t phys_addr;
 941
 942     /* Pagetable walk.  */
 943     /* Lookup l1 descriptor.  */
 944     table = get_level1_table_address(env, address);
 945     desc = ldl_phys(table);
 946     type = (desc & 3);
 947     domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
 948     if (type == 0) {
 949         /* Section translation fault.  */
 950         code = 5;
 951         goto do_fault;
 952     }
 953     if (domain == 0 || domain == 2) {
 954         if (type == 2)
 955             code = 9; /* Section domain fault.  */
 956         else
 957             code = 11; /* Page domain fault.  */
 958         goto do_fault;
 959     }
 960     if (type == 2) {
 961         /* 1Mb section.  */
 962         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
 963         ap = (desc >> 10) & 3;
 964         code = 13;
 965     } else {
 966         /* Lookup l2 entry.  */
 967         if (type == 1) {
 968             /* Coarse pagetable.  */
 969             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
 970         } else {
 971             /* Fine pagetable.  */
 972             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
 973         }
 974         desc = ldl_phys(table);
 975         switch (desc & 3) {
 976         case 0: /* Page translation fault.  */
 977             code = 7;
 978             goto do_fault;
 979         case 1: /* 64k page.  */
 980             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
 981             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 982             break;
 983         case 2: /* 4k page.  */
 984             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 985             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 986             break;
 987         case 3: /* 1k page.  */
 988             if (type == 1) {
 989                 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
 990                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 991                 } else {
 992                     /* Page translation fault.  */
 993                     code = 7;
 994                     goto do_fault;
 995                 }
 996             } else {
 997                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
 998             }
 999             ap = (desc >> 4) & 3;
1000             break;
1001         default:
1002             /* Never happens, but compiler isn't smart enough to tell.  */
1003             abort();
1004         }
1005         code = 15;
1006     }
1007     *prot = check_ap(env, ap, domain, access_type, is_user);
1008     if (!*prot) {
1009         /* Access permission fault.  */
1010         goto do_fault;
1011     }
1012     *phys_ptr = phys_addr;
1013     return 0;
1014 do_fault:
1015     return code | (domain << 4);
1016 }
1017
1018 static int get_phys_addr_v6(CPUState *env, uint32_t address, int access_type,
1019                             int is_user, uint32_t *phys_ptr, int *prot)
1020 {
1021     int code;
1022     uint32_t table;
1023     uint32_t desc;
1024     uint32_t xn;
1025     int type;
1026     int ap;
1027     int domain;
1028     uint32_t phys_addr;
1029
1030     /* Pagetable walk.  */
1031     /* Lookup l1 descriptor.  */
1032     table = get_level1_table_address(env, address);
1033     desc = ldl_phys(table);
1034     type = (desc & 3);
1035     if (type == 0) {
1036         /* Section translation fault.  */
1037         code = 5;
1038         domain = 0;
1039         goto do_fault;
1040     } else if (type == 2 && (desc & (1 << 18))) {
1041         /* Supersection.  */
1042         domain = 0;
1043     } else {
1044         /* Section or page.  */
1045         domain = (desc >> 4) & 0x1e;
1046     }
1047     domain = (env->cp15.c3 >> domain) & 3;
1048     if (domain == 0 || domain == 2) {
1049         if (type == 2)
1050             code = 9; /* Section domain fault.  */
1051         else
1052             code = 11; /* Page domain fault.  */
1053         goto do_fault;
1054     }
1055     if (type == 2) {
1056         if (desc & (1 << 18)) {
1057             /* Supersection.  */
1058             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1059         } else {
1060             /* Section.  */
1061             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1062         }
1063         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1064         xn = desc & (1 << 4);
1065         code = 13;
1066     } else {
1067         /* Lookup l2 entry.  */
1068         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1069         desc = ldl_phys(table);
1070         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1071         switch (desc & 3) {
1072         case 0: /* Page translation fault.  */
1073             code = 7;
1074             goto do_fault;
1075         case 1: /* 64k page.  */
1076             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1077             xn = desc & (1 << 15);
1078             break;
1079         case 2: case 3: /* 4k page.  */
1080             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1081             xn = desc & 1;
1082             break;
1083         default:
1084             /* Never happens, but compiler isn't smart enough to tell.  */
1085             abort();
1086         }
1087         code = 15;
1088     }
1089     if (xn && access_type == 2)
1090         goto do_fault;
1091
1092     /* The simplified model uses AP[0] as an access control bit.  */
1093     if ((env->cp15.c1_sys & (1 << 29)) && (ap & 1) == 0) {
1094         /* Access flag fault.  */
1095         code = (code == 15) ? 6 : 3;
1096         goto do_fault;
1097     }
1098     *prot = check_ap(env, ap, domain, access_type, is_user);
1099     if (!*prot) {
1100         /* Access permission fault.  */
1101         goto do_fault;
1102     }
1103     *phys_ptr = phys_addr;
1104     return 0;
1105 do_fault:
1106     return code | (domain << 4);
1107 }
1108
1109 static int get_phys_addr_mpu(CPUState *env, uint32_t address, int access_type,
1110                              int is_user, uint32_t *phys_ptr, int *prot)
1111 {
1112     int n;
1113     uint32_t mask;
1114     uint32_t base;
1115
1116     *phys_ptr = address;
1117     for (n = 7; n >= 0; n--) {
1118         base = env->cp15.c6_region[n];
1119         if ((base & 1) == 0)
1120             continue;
1121         mask = 1 << ((base >> 1) & 0x1f);
1122         /* Keep this shift separate from the above to avoid an
1123            (undefined) << 32.  */
1124         mask = (mask << 1) - 1;
1125         if (((base ^ address) & ~mask) == 0)
1126             break;
1127     }
1128     if (n < 0)
1129         return 2;
1130
1131     if (access_type == 2) {
1132         mask = env->cp15.c5_insn;
1133     } else {
1134         mask = env->cp15.c5_data;
1135     }
1136     mask = (mask >> (n * 4)) & 0xf;
1137     switch (mask) {
1138     case 0:
1139         return 1;
1140     case 1:
1141         if (is_user)
1142           return 1;
1143         *prot = PAGE_READ | PAGE_WRITE;
1144         break;
1145     case 2:
1146         *prot = PAGE_READ;
1147         if (!is_user)
1148             *prot |= PAGE_WRITE;
1149         break;
1150     case 3:
1151         *prot = PAGE_READ | PAGE_WRITE;
1152         break;
1153     case 5:
1154         if (is_user)
1155             return 1;
1156         *prot = PAGE_READ;
1157         break;
1158     case 6:
1159         *prot = PAGE_READ;
1160         break;
1161     default:
1162         /* Bad permission.  */
1163         return 1;
1164     }
1165     return 0;
1166 }
1167
1168 static inline int get_phys_addr(CPUState *env, uint32_t address,
1169                                 int access_type, int is_user,
1170                                 uint32_t *phys_ptr, int *prot)
1171 {
1172     /* Fast Context Switch Extension.  */
1173     if (address < 0x02000000)
1174         address += env->cp15.c13_fcse;
1175
1176     if ((env->cp15.c1_sys & 1) == 0) {
1177         /* MMU/MPU disabled.  */
1178         *phys_ptr = address;
1179         *prot = PAGE_READ | PAGE_WRITE;
1180         return 0;
1181     } else if (arm_feature(env, ARM_FEATURE_MPU)) {
1182         return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
1183                                  prot);
1184     } else if (env->cp15.c1_sys & (1 << 23)) {
1185         return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
1186                                 prot);
1187     } else {
1188         return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
1189                                 prot);
1190     }
1191 }
1192
1193 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
1194                               int access_type, int mmu_idx, int is_softmmu)
1195 {
1196     uint32_t phys_addr;
1197     int prot;
1198     int ret, is_user;
1199
1200     is_user = mmu_idx == MMU_USER_IDX;
1201     ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
1202     if (ret == 0) {
1203         /* Map a single [sub]page.  */
1204         phys_addr &= ~(uint32_t)0x3ff;
1205         address &= ~(uint32_t)0x3ff;
1206         return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
1207                              is_softmmu);
1208     }
1209
1210     if (access_type == 2) {
1211         env->cp15.c5_insn = ret;
1212         env->cp15.c6_insn = address;
1213         env->exception_index = EXCP_PREFETCH_ABORT;
1214     } else {
1215         env->cp15.c5_data = ret;
1216         if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6))
1217             env->cp15.c5_data |= (1 << 11);
1218         env->cp15.c6_data = address;
1219         env->exception_index = EXCP_DATA_ABORT;
1220     }
1221     return 1;
1222 }
1223
1224 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
1225 {
1226     uint32_t phys_addr;
1227     int prot;
1228     int ret;
1229
1230     ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
1231
1232     if (ret != 0)
1233         return -1;
1234
1235     return phys_addr;
1236 }
1237
1238 /* Not really implemented.  Need to figure out a sane way of doing this.
1239    Maybe add generic watchpoint support and use that.  */
1240
1241 void HELPER(mark_exclusive)(CPUState *env, uint32_t addr)
1242 {
1243     env->mmon_addr = addr;
1244 }
1245
1246 uint32_t HELPER(test_exclusive)(CPUState *env, uint32_t addr)
1247 {
1248     return (env->mmon_addr != addr);
1249 }
1250
1251 void HELPER(clrex)(CPUState *env)
1252 {
1253     env->mmon_addr = -1;
1254 }
1255
1256 void HELPER(set_cp)(CPUState *env, uint32_t insn, uint32_t val)
1257 {
1258     int cp_num = (insn >> 8) & 0xf;
1259     int cp_info = (insn >> 5) & 7;
1260     int src = (insn >> 16) & 0xf;
1261     int operand = insn & 0xf;
1262
1263     if (env->cp[cp_num].cp_write)
1264         env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
1265                                  cp_info, src, operand, val);
1266 }
1267
1268 uint32_t HELPER(get_cp)(CPUState *env, uint32_t insn)
1269 {
1270     int cp_num = (insn >> 8) & 0xf;
1271     int cp_info = (insn >> 5) & 7;
1272     int dest = (insn >> 16) & 0xf;
1273     int operand = insn & 0xf;
1274
1275     if (env->cp[cp_num].cp_read)
1276         return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
1277                                        cp_info, dest, operand);
1278     return 0;
1279 }
1280
1281 /* Return basic MPU access permission bits.  */
1282 static uint32_t simple_mpu_ap_bits(uint32_t val)
1283 {
1284     uint32_t ret;
1285     uint32_t mask;
1286     int i;
1287     ret = 0;
1288     mask = 3;
1289     for (i = 0; i < 16; i += 2) {
1290         ret |= (val >> i) & mask;
1291         mask <<= 2;
1292     }
1293     return ret;
1294 }
1295
1296 /* Pad basic MPU access permission bits to extended format.  */
1297 static uint32_t extended_mpu_ap_bits(uint32_t val)
1298 {
1299     uint32_t ret;
1300     uint32_t mask;
1301     int i;
1302     ret = 0;
1303     mask = 3;
1304     for (i = 0; i < 16; i += 2) {
1305         ret |= (val & mask) << i;
1306         mask <<= 2;
1307     }
1308     return ret;
1309 }
1310
1311 void HELPER(set_cp15)(CPUState *env, uint32_t insn, uint32_t val)
1312 {
1313     int op1;
1314     int op2;
1315     int crm;
1316
1317     op1 = (insn >> 21) & 7;
1318     op2 = (insn >> 5) & 7;
1319     crm = insn & 0xf;
1320     switch ((insn >> 16) & 0xf) {
1321     case 0:
1322         if (((insn >> 21) & 7) == 2) {
1323             /* ??? Select cache level.  Ignore.  */
1324             return;
1325         }
1326         /* ID codes.  */
1327         if (arm_feature(env, ARM_FEATURE_XSCALE))
1328             break;
1329         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1330             break;
1331         goto bad_reg;
1332     case 1: /* System configuration.  */
1333         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1334             op2 = 0;
1335         switch (op2) {
1336         case 0:
1337             if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
1338                 env->cp15.c1_sys = val;
1339             /* ??? Lots of these bits are not implemented.  */
1340             /* This may enable/disable the MMU, so do a TLB flush.  */
1341             tlb_flush(env, 1);
1342             break;
1343         case 1: /* Auxiliary cotrol register.  */
1344             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1345                 env->cp15.c1_xscaleauxcr = val;
1346                 break;
1347             }
1348             /* Not implemented.  */
1349             break;
1350         case 2:
1351             if (arm_feature(env, ARM_FEATURE_XSCALE))
1352                 goto bad_reg;
1353             if (env->cp15.c1_coproc != val) {
1354                 env->cp15.c1_coproc = val;
1355                 /* ??? Is this safe when called from within a TB?  */
1356                 tb_flush(env);
1357             }
1358             break;
1359         default:
1360             goto bad_reg;
1361         }
1362         break;
1363     case 2: /* MMU Page table control / MPU cache control.  */
1364         if (arm_feature(env, ARM_FEATURE_MPU)) {
1365             switch (op2) {
1366             case 0:
1367                 env->cp15.c2_data = val;
1368                 break;
1369             case 1:
1370                 env->cp15.c2_insn = val;
1371                 break;
1372             default:
1373                 goto bad_reg;
1374             }
1375         } else {
1376             switch (op2) {
1377             case 0:
1378                 env->cp15.c2_base0 = val;
1379                 break;
1380             case 1:
1381                 env->cp15.c2_base1 = val;
1382                 break;
1383             case 2:
1384                 val &= 7;
1385                 env->cp15.c2_control = val;
1386                 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> val);
1387                 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> val);
1388                 break;
1389             default:
1390                 goto bad_reg;
1391             }
1392         }
1393         break;
1394     case 3: /* MMU Domain access control / MPU write buffer control.  */
1395         env->cp15.c3 = val;
1396         tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */
1397         break;
1398     case 4: /* Reserved.  */
1399         goto bad_reg;
1400     case 5: /* MMU Fault status / MPU access permission.  */
1401         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1402             op2 = 0;
1403         switch (op2) {
1404         case 0:
1405             if (arm_feature(env, ARM_FEATURE_MPU))
1406                 val = extended_mpu_ap_bits(val);
1407             env->cp15.c5_data = val;
1408             break;
1409         case 1:
1410             if (arm_feature(env, ARM_FEATURE_MPU))
1411                 val = extended_mpu_ap_bits(val);
1412             env->cp15.c5_insn = val;
1413             break;
1414         case 2:
1415             if (!arm_feature(env, ARM_FEATURE_MPU))
1416                 goto bad_reg;
1417             env->cp15.c5_data = val;
1418             break;
1419         case 3:
1420             if (!arm_feature(env, ARM_FEATURE_MPU))
1421                 goto bad_reg;
1422             env->cp15.c5_insn = val;
1423             break;
1424         default:
1425             goto bad_reg;
1426         }
1427         break;
1428     case 6: /* MMU Fault address / MPU base/size.  */
1429         if (arm_feature(env, ARM_FEATURE_MPU)) {
1430             if (crm >= 8)
1431                 goto bad_reg;
1432             env->cp15.c6_region[crm] = val;
1433         } else {
1434             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1435                 op2 = 0;
1436             switch (op2) {
1437             case 0:
1438                 env->cp15.c6_data = val;
1439                 break;
1440             case 1: /* ??? This is WFAR on armv6 */
1441             case 2:
1442                 env->cp15.c6_insn = val;
1443                 break;
1444             default:
1445                 goto bad_reg;
1446             }
1447         }
1448         break;
1449     case 7: /* Cache control.  */
1450         env->cp15.c15_i_max = 0x000;
1451         env->cp15.c15_i_min = 0xff0;
1452         /* No cache, so nothing to do.  */
1453         /* ??? MPCore has VA to PA translation functions.  */
1454         break;
1455     case 8: /* MMU TLB control.  */
1456         switch (op2) {
1457         case 0: /* Invalidate all.  */
1458             tlb_flush(env, 0);
1459             break;
1460         case 1: /* Invalidate single TLB entry.  */
1461 #if 0
1462             /* ??? This is wrong for large pages and sections.  */
1463             /* As an ugly hack to make linux work we always flush a 4K
1464                pages.  */
1465             val &= 0xfffff000;
1466             tlb_flush_page(env, val);
1467             tlb_flush_page(env, val + 0x400);
1468             tlb_flush_page(env, val + 0x800);
1469             tlb_flush_page(env, val + 0xc00);
1470 #else
1471             tlb_flush(env, 1);
1472 #endif
1473             break;
1474         case 2: /* Invalidate on ASID.  */
1475             tlb_flush(env, val == 0);
1476             break;
1477         case 3: /* Invalidate single entry on MVA.  */
1478             /* ??? This is like case 1, but ignores ASID.  */
1479             tlb_flush(env, 1);
1480             break;
1481         default:
1482             goto bad_reg;
1483         }
1484         break;
1485     case 9:
1486         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1487             break;
1488         switch (crm) {
1489         case 0: /* Cache lockdown.  */
1490             switch (op1) {
1491             case 0: /* L1 cache.  */
1492                 switch (op2) {
1493                 case 0:
1494                     env->cp15.c9_data = val;
1495                     break;
1496                 case 1:
1497                     env->cp15.c9_insn = val;
1498                     break;
1499                 default:
1500                     goto bad_reg;
1501                 }
1502                 break;
1503             case 1: /* L2 cache.  */
1504                 /* Ignore writes to L2 lockdown/auxiliary registers.  */
1505                 break;
1506             default:
1507                 goto bad_reg;
1508             }
1509             break;
1510         case 1: /* TCM memory region registers.  */
1511             /* Not implemented.  */
1512             goto bad_reg;
1513         default:
1514             goto bad_reg;
1515         }
1516         break;
1517     case 10: /* MMU TLB lockdown.  */
1518         /* ??? TLB lockdown not implemented.  */
1519         break;
1520     case 12: /* Reserved.  */
1521         goto bad_reg;
1522     case 13: /* Process ID.  */
1523         switch (op2) {
1524         case 0:
1525             /* Unlike real hardware the qemu TLB uses virtual addresses,
1526                not modified virtual addresses, so this causes a TLB flush.
1527              */
1528             if (env->cp15.c13_fcse != val)
1529               tlb_flush(env, 1);
1530             env->cp15.c13_fcse = val;
1531             break;
1532         case 1:
1533             /* This changes the ASID, so do a TLB flush.  */
1534             if (env->cp15.c13_context != val
1535                 && !arm_feature(env, ARM_FEATURE_MPU))
1536               tlb_flush(env, 0);
1537             env->cp15.c13_context = val;
1538             break;
1539         case 2:
1540             env->cp15.c13_tls1 = val;
1541             break;
1542         case 3:
1543             env->cp15.c13_tls2 = val;
1544             break;
1545         case 4:
1546             env->cp15.c13_tls3 = val;
1547             break;
1548         default:
1549             goto bad_reg;
1550         }
1551         break;
1552     case 14: /* Reserved.  */
1553         goto bad_reg;
1554     case 15: /* Implementation specific.  */
1555         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1556             if (op2 == 0 && crm == 1) {
1557                 if (env->cp15.c15_cpar != (val & 0x3fff)) {
1558                     /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
1559                     tb_flush(env);
1560                     env->cp15.c15_cpar = val & 0x3fff;
1561                 }
1562                 break;
1563             }
1564             goto bad_reg;
1565         }
1566         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1567             switch (crm) {
1568             case 0:
1569                 break;
1570             case 1: /* Set TI925T configuration.  */
1571                 env->cp15.c15_ticonfig = val & 0xe7;
1572                 env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
1573                         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1574                 break;
1575             case 2: /* Set I_max.  */
1576                 env->cp15.c15_i_max = val;
1577                 break;
1578             case 3: /* Set I_min.  */
1579                 env->cp15.c15_i_min = val;
1580                 break;
1581             case 4: /* Set thread-ID.  */
1582                 env->cp15.c15_threadid = val & 0xffff;
1583                 break;
1584             case 8: /* Wait-for-interrupt (deprecated).  */
1585                 cpu_interrupt(env, CPU_INTERRUPT_HALT);
1586                 break;
1587             default:
1588                 goto bad_reg;
1589             }
1590         }
1591         break;
1592     }
1593     return;
1594 bad_reg:
1595     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1596     cpu_abort(env, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
1597               (insn >> 16) & 0xf, crm, op1, op2);
1598 }
1599
1600 uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)
1601 {
1602     int op1;
1603     int op2;
1604     int crm;
1605
1606     op1 = (insn >> 21) & 7;
1607     op2 = (insn >> 5) & 7;
1608     crm = insn & 0xf;
1609     switch ((insn >> 16) & 0xf) {
1610     case 0: /* ID codes.  */
1611         switch (op1) {
1612         case 0:
1613             switch (crm) {
1614             case 0:
1615                 switch (op2) {
1616                 case 0: /* Device ID.  */
1617                     return env->cp15.c0_cpuid;
1618                 case 1: /* Cache Type.  */
1619                     return env->cp15.c0_cachetype;
1620                 case 2: /* TCM status.  */
1621                     return 0;
1622                 case 3: /* TLB type register.  */
1623                     return 0; /* No lockable TLB entries.  */
1624                 case 5: /* CPU ID */
1625                     return env->cpu_index;
1626                 default:
1627                     goto bad_reg;
1628                 }
1629             case 1:
1630                 if (!arm_feature(env, ARM_FEATURE_V6))
1631                     goto bad_reg;
1632                 return env->cp15.c0_c1[op2];
1633             case 2:
1634                 if (!arm_feature(env, ARM_FEATURE_V6))
1635                     goto bad_reg;
1636                 return env->cp15.c0_c2[op2];
1637             case 3: case 4: case 5: case 6: case 7:
1638                 return 0;
1639             default:
1640                 goto bad_reg;
1641             }
1642         case 1:
1643             /* These registers aren't documented on arm11 cores.  However
1644                Linux looks at them anyway.  */
1645             if (!arm_feature(env, ARM_FEATURE_V6))
1646                 goto bad_reg;
1647             if (crm != 0)
1648                 goto bad_reg;
1649             if (arm_feature(env, ARM_FEATURE_XSCALE))
1650                 goto bad_reg;
1651             return 0;
1652         default:
1653             goto bad_reg;
1654         }
1655     case 1: /* System configuration.  */
1656         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1657             op2 = 0;
1658         switch (op2) {
1659         case 0: /* Control register.  */
1660             return env->cp15.c1_sys;
1661         case 1: /* Auxiliary control register.  */
1662             if (arm_feature(env, ARM_FEATURE_XSCALE))
1663                 return env->cp15.c1_xscaleauxcr;
1664             if (!arm_feature(env, ARM_FEATURE_AUXCR))
1665                 goto bad_reg;
1666             switch (ARM_CPUID(env)) {
1667             case ARM_CPUID_ARM1026:
1668                 return 1;
1669             case ARM_CPUID_ARM1136:
1670             case ARM_CPUID_ARM1136_R2:
1671                 return 7;
1672             case ARM_CPUID_ARM11MPCORE:
1673                 return 1;
1674             case ARM_CPUID_CORTEXA8:
1675                 return 0;
1676             default:
1677                 goto bad_reg;
1678             }
1679         case 2: /* Coprocessor access register.  */
1680             if (arm_feature(env, ARM_FEATURE_XSCALE))
1681                 goto bad_reg;
1682             return env->cp15.c1_coproc;
1683         default:
1684             goto bad_reg;
1685         }
1686     case 2: /* MMU Page table control / MPU cache control.  */
1687         if (arm_feature(env, ARM_FEATURE_MPU)) {
1688             switch (op2) {
1689             case 0:
1690                 return env->cp15.c2_data;
1691                 break;
1692             case 1:
1693                 return env->cp15.c2_insn;
1694                 break;
1695             default:
1696                 goto bad_reg;
1697             }
1698         } else {
1699             switch (op2) {
1700             case 0:
1701                 return env->cp15.c2_base0;
1702             case 1:
1703                 return env->cp15.c2_base1;
1704             case 2:
1705                 return env->cp15.c2_control;
1706             default:
1707                 goto bad_reg;
1708             }
1709         }
1710     case 3: /* MMU Domain access control / MPU write buffer control.  */
1711         return env->cp15.c3;
1712     case 4: /* Reserved.  */
1713         goto bad_reg;
1714     case 5: /* MMU Fault status / MPU access permission.  */
1715         if (arm_feature(env, ARM_FEATURE_OMAPCP))
1716             op2 = 0;
1717         switch (op2) {
1718         case 0:
1719             if (arm_feature(env, ARM_FEATURE_MPU))
1720                 return simple_mpu_ap_bits(env->cp15.c5_data);
1721             return env->cp15.c5_data;
1722         case 1:
1723             if (arm_feature(env, ARM_FEATURE_MPU))
1724                 return simple_mpu_ap_bits(env->cp15.c5_data);
1725             return env->cp15.c5_insn;
1726         case 2:
1727             if (!arm_feature(env, ARM_FEATURE_MPU))
1728                 goto bad_reg;
1729             return env->cp15.c5_data;
1730         case 3:
1731             if (!arm_feature(env, ARM_FEATURE_MPU))
1732                 goto bad_reg;
1733             return env->cp15.c5_insn;
1734         default:
1735             goto bad_reg;
1736         }
1737     case 6: /* MMU Fault address.  */
1738         if (arm_feature(env, ARM_FEATURE_MPU)) {
1739             if (crm >= 8)
1740                 goto bad_reg;
1741             return env->cp15.c6_region[crm];
1742         } else {
1743             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1744                 op2 = 0;
1745             switch (op2) {
1746             case 0:
1747                 return env->cp15.c6_data;
1748             case 1:
1749                 if (arm_feature(env, ARM_FEATURE_V6)) {
1750                     /* Watchpoint Fault Adrress.  */
1751                     return 0; /* Not implemented.  */
1752                 } else {
1753                     /* Instruction Fault Adrress.  */
1754                     /* Arm9 doesn't have an IFAR, but implementing it anyway
1755                        shouldn't do any harm.  */
1756                     return env->cp15.c6_insn;
1757                 }
1758             case 2:
1759                 if (arm_feature(env, ARM_FEATURE_V6)) {
1760                     /* Instruction Fault Adrress.  */
1761                     return env->cp15.c6_insn;
1762                 } else {
1763                     goto bad_reg;
1764                 }
1765             default:
1766                 goto bad_reg;
1767             }
1768         }
1769     case 7: /* Cache control.  */
1770         /* FIXME: Should only clear Z flag if destination is r15.  */
1771         env->ZF = 0;
1772         return 0;
1773     case 8: /* MMU TLB control.  */
1774         goto bad_reg;
1775     case 9: /* Cache lockdown.  */
1776         switch (op1) {
1777         case 0: /* L1 cache.  */
1778             if (arm_feature(env, ARM_FEATURE_OMAPCP))
1779                 return 0;
1780             switch (op2) {
1781             case 0:
1782                 return env->cp15.c9_data;
1783             case 1:
1784                 return env->cp15.c9_insn;
1785             default:
1786                 goto bad_reg;
1787             }
1788         case 1: /* L2 cache */
1789             if (crm != 0)
1790                 goto bad_reg;
1791             /* L2 Lockdown and Auxiliary control.  */
1792             return 0;
1793         default:
1794             goto bad_reg;
1795         }
1796     case 10: /* MMU TLB lockdown.  */
1797         /* ??? TLB lockdown not implemented.  */
1798         return 0;
1799     case 11: /* TCM DMA control.  */
1800     case 12: /* Reserved.  */
1801         goto bad_reg;
1802     case 13: /* Process ID.  */
1803         switch (op2) {
1804         case 0:
1805             return env->cp15.c13_fcse;
1806         case 1:
1807             return env->cp15.c13_context;
1808         case 2:
1809             return env->cp15.c13_tls1;
1810         case 3:
1811             return env->cp15.c13_tls2;
1812         case 4:
1813             return env->cp15.c13_tls3;
1814         default:
1815             goto bad_reg;
1816         }
1817     case 14: /* Reserved.  */
1818         goto bad_reg;
1819     case 15: /* Implementation specific.  */
1820         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1821             if (op2 == 0 && crm == 1)
1822                 return env->cp15.c15_cpar;
1823
1824             goto bad_reg;
1825         }
1826         if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1827             switch (crm) {
1828             case 0:
1829                 return 0;
1830             case 1: /* Read TI925T configuration.  */
1831                 return env->cp15.c15_ticonfig;
1832             case 2: /* Read I_max.  */
1833                 return env->cp15.c15_i_max;
1834             case 3: /* Read I_min.  */
1835                 return env->cp15.c15_i_min;
1836             case 4: /* Read thread-ID.  */
1837                 return env->cp15.c15_threadid;
1838             case 8: /* TI925T_status */
1839                 return 0;
1840             }
1841             /* TODO: Peripheral port remap register:
1842              * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
1843              * controller base address at $rn & ~0xfff and map size of
1844              * 0x200 << ($rn & 0xfff), when MMU is off.  */
1845             goto bad_reg;
1846         }
1847         return 0;
1848     }
1849 bad_reg:
1850     /* ??? For debugging only.  Should raise illegal instruction exception.  */
1851     cpu_abort(env, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
1852               (insn >> 16) & 0xf, crm, op1, op2);
1853     return 0;
1854 }
1855
1856 void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)
1857 {
1858     env->banked_r13[bank_number(mode)] = val;
1859 }
1860
1861 uint32_t HELPER(get_r13_banked)(CPUState *env, uint32_t mode)
1862 {
1863     return env->banked_r13[bank_number(mode)];
1864 }
1865
1866 uint32_t HELPER(v7m_mrs)(CPUState *env, uint32_t reg)
1867 {
1868     switch (reg) {
1869     case 0: /* APSR */
1870         return xpsr_read(env) & 0xf8000000;
1871     case 1: /* IAPSR */
1872         return xpsr_read(env) & 0xf80001ff;
1873     case 2: /* EAPSR */
1874         return xpsr_read(env) & 0xff00fc00;
1875     case 3: /* xPSR */
1876         return xpsr_read(env) & 0xff00fdff;
1877     case 5: /* IPSR */
1878         return xpsr_read(env) & 0x000001ff;
1879     case 6: /* EPSR */
1880         return xpsr_read(env) & 0x0700fc00;
1881     case 7: /* IEPSR */
1882         return xpsr_read(env) & 0x0700edff;
1883     case 8: /* MSP */
1884         return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
1885     case 9: /* PSP */
1886         return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
1887     case 16: /* PRIMASK */
1888         return (env->uncached_cpsr & CPSR_I) != 0;
1889     case 17: /* FAULTMASK */
1890         return (env->uncached_cpsr & CPSR_F) != 0;
1891     case 18: /* BASEPRI */
1892     case 19: /* BASEPRI_MAX */
1893         return env->v7m.basepri;
1894     case 20: /* CONTROL */
1895         return env->v7m.control;
1896     default:
1897         /* ??? For debugging only.  */
1898         cpu_abort(env, "Unimplemented system register read (%d)\n", reg);
1899         return 0;
1900     }
1901 }
1902
1903 void HELPER(v7m_msr)(CPUState *env, uint32_t reg, uint32_t val)
1904 {
1905     switch (reg) {
1906     case 0: /* APSR */
1907         xpsr_write(env, val, 0xf8000000);
1908         break;
1909     case 1: /* IAPSR */
1910         xpsr_write(env, val, 0xf8000000);
1911         break;
1912     case 2: /* EAPSR */
1913         xpsr_write(env, val, 0xfe00fc00);
1914         break;
1915     case 3: /* xPSR */
1916         xpsr_write(env, val, 0xfe00fc00);
1917         break;
1918     case 5: /* IPSR */
1919         /* IPSR bits are readonly.  */
1920         break;
1921     case 6: /* EPSR */
1922         xpsr_write(env, val, 0x0600fc00);
1923         break;
1924     case 7: /* IEPSR */
1925         xpsr_write(env, val, 0x0600fc00);
1926         break;
1927     case 8: /* MSP */
1928         if (env->v7m.current_sp)
1929             env->v7m.other_sp = val;
1930         else
1931             env->regs[13] = val;
1932         break;
1933     case 9: /* PSP */
1934         if (env->v7m.current_sp)
1935             env->regs[13] = val;
1936         else
1937             env->v7m.other_sp = val;
1938         break;
1939     case 16: /* PRIMASK */
1940         if (val & 1)
1941             env->uncached_cpsr |= CPSR_I;
1942         else
1943             env->uncached_cpsr &= ~CPSR_I;
1944         break;
1945     case 17: /* FAULTMASK */
1946         if (val & 1)
1947             env->uncached_cpsr |= CPSR_F;
1948         else
1949             env->uncached_cpsr &= ~CPSR_F;
1950         break;
1951     case 18: /* BASEPRI */
1952         env->v7m.basepri = val & 0xff;
1953         break;
1954     case 19: /* BASEPRI_MAX */
1955         val &= 0xff;
1956         if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
1957             env->v7m.basepri = val;
1958         break;
1959     case 20: /* CONTROL */
1960         env->v7m.control = val & 3;
1961         switch_v7m_sp(env, (val & 2) != 0);
1962         break;
1963     default:
1964         /* ??? For debugging only.  */
1965         cpu_abort(env, "Unimplemented system register write (%d)\n", reg);
1966         return;
1967     }
1968 }
1969
1970 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
1971                 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
1972                 void *opaque)
1973 {
1974     if (cpnum < 0 || cpnum > 14) {
1975         cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
1976         return;
1977     }
1978
1979     env->cp[cpnum].cp_read = cp_read;
1980     env->cp[cpnum].cp_write = cp_write;
1981     env->cp[cpnum].opaque = opaque;
1982 }
1983
1984 #endif
1985
1986 /* Note that signed overflow is undefined in C.  The following routines are
1987    careful to use unsigned types where modulo arithmetic is required.
1988    Failure to do so _will_ break on newer gcc.  */
1989
1990 /* Signed saturating arithmetic.  */
1991
1992 /* Perform 16-bit signed saturating addition.  */
1993 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
1994 {
1995     uint16_t res;
1996
1997     res = a + b;
1998     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
1999         if (a & 0x8000)
2000             res = 0x8000;
2001         else
2002             res = 0x7fff;
2003     }
2004     return res;
2005 }
2006
2007 /* Perform 8-bit signed saturating addition.  */
2008 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
2009 {
2010     uint8_t res;
2011
2012     res = a + b;
2013     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
2014         if (a & 0x80)
2015             res = 0x80;
2016         else
2017             res = 0x7f;
2018     }
2019     return res;
2020 }
2021
2022 /* Perform 16-bit signed saturating subtraction.  */
2023 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
2024 {
2025     uint16_t res;
2026
2027     res = a - b;
2028     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
2029         if (a & 0x8000)
2030             res = 0x8000;
2031         else
2032             res = 0x7fff;
2033     }
2034     return res;
2035 }
2036
2037 /* Perform 8-bit signed saturating subtraction.  */
2038 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
2039 {
2040     uint8_t res;
2041
2042     res = a - b;
2043     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
2044         if (a & 0x80)
2045             res = 0x80;
2046         else
2047             res = 0x7f;
2048     }
2049     return res;
2050 }
2051
2052 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
2053 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
2054 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
2055 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
2056 #define PFX q
2057
2058 #include "op_addsub.h"
2059
2060 /* Unsigned saturating arithmetic.  */
2061 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
2062 {
2063     uint16_t res;
2064     res = a + b;
2065     if (res < a)
2066         res = 0xffff;
2067     return res;
2068 }
2069
2070 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
2071 {
2072     if (a < b)
2073         return a - b;
2074     else
2075         return 0;
2076 }
2077
2078 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
2079 {
2080     uint8_t res;
2081     res = a + b;
2082     if (res < a)
2083         res = 0xff;
2084     return res;
2085 }
2086
2087 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
2088 {
2089     if (a < b)
2090         return a - b;
2091     else
2092         return 0;
2093 }
2094
2095 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
2096 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
2097 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
2098 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
2099 #define PFX uq
2100
2101 #include "op_addsub.h"
2102
2103 /* Signed modulo arithmetic.  */
2104 #define SARITH16(a, b, n, op) do { \
2105     int32_t sum; \
2106     sum = (int16_t)((uint16_t)(a) op (uint16_t)(b)); \
2107     RESULT(sum, n, 16); \
2108     if (sum >= 0) \
2109         ge |= 3 << (n * 2); \
2110     } while(0)
2111
2112 #define SARITH8(a, b, n, op) do { \
2113     int32_t sum; \
2114     sum = (int8_t)((uint8_t)(a) op (uint8_t)(b)); \
2115     RESULT(sum, n, 8); \
2116     if (sum >= 0) \
2117         ge |= 1 << n; \
2118     } while(0)
2119
2120
2121 #define ADD16(a, b, n) SARITH16(a, b, n, +)
2122 #define SUB16(a, b, n) SARITH16(a, b, n, -)
2123 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
2124 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
2125 #define PFX s
2126 #define ARITH_GE
2127
2128 #include "op_addsub.h"
2129
2130 /* Unsigned modulo arithmetic.  */
2131 #define ADD16(a, b, n) do { \
2132     uint32_t sum; \
2133     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
2134     RESULT(sum, n, 16); \
2135     if ((sum >> 16) == 1) \
2136         ge |= 3 << (n * 2); \
2137     } while(0)
2138
2139 #define ADD8(a, b, n) do { \
2140     uint32_t sum; \
2141     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
2142     RESULT(sum, n, 8); \
2143     if ((sum >> 8) == 1) \
2144         ge |= 1 << n; \
2145     } while(0)
2146
2147 #define SUB16(a, b, n) do { \
2148     uint32_t sum; \
2149     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
2150     RESULT(sum, n, 16); \
2151     if ((sum >> 16) == 0) \
2152         ge |= 3 << (n * 2); \
2153     } while(0)
2154
2155 #define SUB8(a, b, n) do { \
2156     uint32_t sum; \
2157     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
2158     RESULT(sum, n, 8); \
2159     if ((sum >> 8) == 0) \
2160         ge |= 1 << n; \
2161     } while(0)
2162
2163 #define PFX u
2164 #define ARITH_GE
2165
2166 #include "op_addsub.h"
2167
2168 /* Halved signed arithmetic.  */
2169 #define ADD16(a, b, n) \
2170   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
2171 #define SUB16(a, b, n) \
2172   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
2173 #define ADD8(a, b, n) \
2174   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
2175 #define SUB8(a, b, n) \
2176   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
2177 #define PFX sh
2178
2179 #include "op_addsub.h"
2180
2181 /* Halved unsigned arithmetic.  */
2182 #define ADD16(a, b, n) \
2183   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2184 #define SUB16(a, b, n) \
2185   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2186 #define ADD8(a, b, n) \
2187   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2188 #define SUB8(a, b, n) \
2189   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2190 #define PFX uh
2191
2192 #include "op_addsub.h"
2193
2194 static inline uint8_t do_usad(uint8_t a, uint8_t b)
2195 {
2196     if (a > b)
2197         return a - b;
2198     else
2199         return b - a;
2200 }
2201
2202 /* Unsigned sum of absolute byte differences.  */
2203 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
2204 {
2205     uint32_t sum;
2206     sum = do_usad(a, b);
2207     sum += do_usad(a >> 8, b >> 8);
2208     sum += do_usad(a >> 16, b >>16);
2209     sum += do_usad(a >> 24, b >> 24);
2210     return sum;
2211 }
2212
2213 /* For ARMv6 SEL instruction.  */
2214 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
2215 {
2216     uint32_t mask;
2217
2218     mask = 0;
2219     if (flags & 1)
2220         mask |= 0xff;
2221     if (flags & 2)
2222         mask |= 0xff00;
2223     if (flags & 4)
2224         mask |= 0xff0000;
2225     if (flags & 8)
2226         mask |= 0xff000000;
2227     return (a & mask) | (b & ~mask);
2228 }
2229
2230 uint32_t HELPER(logicq_cc)(uint64_t val)
2231 {
2232     return (val >> 32) | (val != 0);
2233 }
2234
2235 /* VFP support.  We follow the convention used for VFP instrunctions:
2236    Single precition routines have a "s" suffix, double precision a
2237    "d" suffix.  */
2238
2239 /* Convert host exception flags to vfp form.  */
2240 static inline int vfp_exceptbits_from_host(int host_bits)
2241 {
2242     int target_bits = 0;
2243
2244     if (host_bits & float_flag_invalid)
2245         target_bits |= 1;
2246     if (host_bits & float_flag_divbyzero)
2247         target_bits |= 2;
2248     if (host_bits & float_flag_overflow)
2249         target_bits |= 4;
2250     if (host_bits & float_flag_underflow)
2251         target_bits |= 8;
2252     if (host_bits & float_flag_inexact)
2253         target_bits |= 0x10;
2254     return target_bits;
2255 }
2256
2257 uint32_t HELPER(vfp_get_fpscr)(CPUState *env)
2258 {
2259     int i;
2260     uint32_t fpscr;
2261
2262     fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
2263             | (env->vfp.vec_len << 16)
2264             | (env->vfp.vec_stride << 20);
2265     i = get_float_exception_flags(&env->vfp.fp_status);
2266     fpscr |= vfp_exceptbits_from_host(i);
2267     return fpscr;
2268 }
2269
2270 /* Convert vfp exception flags to target form.  */
2271 static inline int vfp_exceptbits_to_host(int target_bits)
2272 {
2273     int host_bits = 0;
2274
2275     if (target_bits & 1)
2276         host_bits |= float_flag_invalid;
2277     if (target_bits & 2)
2278         host_bits |= float_flag_divbyzero;
2279     if (target_bits & 4)
2280         host_bits |= float_flag_overflow;
2281     if (target_bits & 8)
2282         host_bits |= float_flag_underflow;
2283     if (target_bits & 0x10)
2284         host_bits |= float_flag_inexact;
2285     return host_bits;
2286 }
2287
2288 void HELPER(vfp_set_fpscr)(CPUState *env, uint32_t val)
2289 {
2290     int i;
2291     uint32_t changed;
2292
2293     changed = env->vfp.xregs[ARM_VFP_FPSCR];
2294     env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
2295     env->vfp.vec_len = (val >> 16) & 7;
2296     env->vfp.vec_stride = (val >> 20) & 3;
2297
2298     changed ^= val;
2299     if (changed & (3 << 22)) {
2300         i = (val >> 22) & 3;
2301         switch (i) {
2302         case 0:
2303             i = float_round_nearest_even;
2304             break;
2305         case 1:
2306             i = float_round_up;
2307             break;
2308         case 2:
2309             i = float_round_down;
2310             break;
2311         case 3:
2312             i = float_round_to_zero;
2313             break;
2314         }
2315         set_float_rounding_mode(i, &env->vfp.fp_status);
2316     }
2317
2318     i = vfp_exceptbits_to_host((val >> 8) & 0x1f);
2319     set_float_exception_flags(i, &env->vfp.fp_status);
2320     /* XXX: FZ and DN are not implemented.  */
2321 }
2322
2323 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
2324
2325 #define VFP_BINOP(name) \
2326 float32 VFP_HELPER(name, s)(float32 a, float32 b, CPUState *env) \
2327 { \
2328     return float32_ ## name (a, b, &env->vfp.fp_status); \
2329 } \
2330 float64 VFP_HELPER(name, d)(float64 a, float64 b, CPUState *env) \
2331 { \
2332     return float64_ ## name (a, b, &env->vfp.fp_status); \
2333 }
2334 VFP_BINOP(add)
2335 VFP_BINOP(sub)
2336 VFP_BINOP(mul)
2337 VFP_BINOP(div)
2338 #undef VFP_BINOP
2339
2340 float32 VFP_HELPER(neg, s)(float32 a)
2341 {
2342     return float32_chs(a);
2343 }
2344
2345 float64 VFP_HELPER(neg, d)(float64 a)
2346 {
2347     return float64_chs(a);
2348 }
2349
2350 float32 VFP_HELPER(abs, s)(float32 a)
2351 {
2352     return float32_abs(a);
2353 }
2354
2355 float64 VFP_HELPER(abs, d)(float64 a)
2356 {
2357     return float64_abs(a);
2358 }
2359
2360 float32 VFP_HELPER(sqrt, s)(float32 a, CPUState *env)
2361 {
2362     return float32_sqrt(a, &env->vfp.fp_status);
2363 }
2364
2365 float64 VFP_HELPER(sqrt, d)(float64 a, CPUState *env)
2366 {
2367     return float64_sqrt(a, &env->vfp.fp_status);
2368 }
2369
2370 /* XXX: check quiet/signaling case */
2371 #define DO_VFP_cmp(p, type) \
2372 void VFP_HELPER(cmp, p)(type a, type b, CPUState *env)  \
2373 { \
2374     uint32_t flags; \
2375     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
2376     case 0: flags = 0x6; break; \
2377     case -1: flags = 0x8; break; \
2378     case 1: flags = 0x2; break; \
2379     default: case 2: flags = 0x3; break; \
2380     } \
2381     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2382         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2383 } \
2384 void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
2385 { \
2386     uint32_t flags; \
2387     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
2388     case 0: flags = 0x6; break; \
2389     case -1: flags = 0x8; break; \
2390     case 1: flags = 0x2; break; \
2391     default: case 2: flags = 0x3; break; \
2392     } \
2393     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2394         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2395 }
2396 DO_VFP_cmp(s, float32)
2397 DO_VFP_cmp(d, float64)
2398 #undef DO_VFP_cmp
2399
2400 /* Helper routines to perform bitwise copies between float and int.  */
2401 static inline float32 vfp_itos(uint32_t i)
2402 {
2403     union {
2404         uint32_t i;
2405         float32 s;
2406     } v;
2407
2408     v.i = i;
2409     return v.s;
2410 }
2411
2412 static inline uint32_t vfp_stoi(float32 s)
2413 {
2414     union {
2415         uint32_t i;
2416         float32 s;
2417     } v;
2418
2419     v.s = s;
2420     return v.i;
2421 }
2422
2423 static inline float64 vfp_itod(uint64_t i)
2424 {
2425     union {
2426         uint64_t i;
2427         float64 d;
2428     } v;
2429
2430     v.i = i;
2431     return v.d;
2432 }
2433
2434 static inline uint64_t vfp_dtoi(float64 d)
2435 {
2436     union {
2437         uint64_t i;
2438         float64 d;
2439     } v;
2440
2441     v.d = d;
2442     return v.i;
2443 }
2444
2445 /* Integer to float conversion.  */
2446 float32 VFP_HELPER(uito, s)(float32 x, CPUState *env)
2447 {
2448     return uint32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2449 }
2450
2451 float64 VFP_HELPER(uito, d)(float32 x, CPUState *env)
2452 {
2453     return uint32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2454 }
2455
2456 float32 VFP_HELPER(sito, s)(float32 x, CPUState *env)
2457 {
2458     return int32_to_float32(vfp_stoi(x), &env->vfp.fp_status);
2459 }
2460
2461 float64 VFP_HELPER(sito, d)(float32 x, CPUState *env)
2462 {
2463     return int32_to_float64(vfp_stoi(x), &env->vfp.fp_status);
2464 }
2465
2466 /* Float to integer conversion.  */
2467 float32 VFP_HELPER(toui, s)(float32 x, CPUState *env)
2468 {
2469     return vfp_itos(float32_to_uint32(x, &env->vfp.fp_status));
2470 }
2471
2472 float32 VFP_HELPER(toui, d)(float64 x, CPUState *env)
2473 {
2474     return vfp_itos(float64_to_uint32(x, &env->vfp.fp_status));
2475 }
2476
2477 float32 VFP_HELPER(tosi, s)(float32 x, CPUState *env)
2478 {
2479     return vfp_itos(float32_to_int32(x, &env->vfp.fp_status));
2480 }
2481
2482 float32 VFP_HELPER(tosi, d)(float64 x, CPUState *env)
2483 {
2484     return vfp_itos(float64_to_int32(x, &env->vfp.fp_status));
2485 }
2486
2487 float32 VFP_HELPER(touiz, s)(float32 x, CPUState *env)
2488 {
2489     return vfp_itos(float32_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2490 }
2491
2492 float32 VFP_HELPER(touiz, d)(float64 x, CPUState *env)
2493 {
2494     return vfp_itos(float64_to_uint32_round_to_zero(x, &env->vfp.fp_status));
2495 }
2496
2497 float32 VFP_HELPER(tosiz, s)(float32 x, CPUState *env)
2498 {
2499     return vfp_itos(float32_to_int32_round_to_zero(x, &env->vfp.fp_status));
2500 }
2501
2502 float32 VFP_HELPER(tosiz, d)(float64 x, CPUState *env)
2503 {
2504     return vfp_itos(float64_to_int32_round_to_zero(x, &env->vfp.fp_status));
2505 }
2506
2507 /* floating point conversion */
2508 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUState *env)
2509 {
2510     return float32_to_float64(x, &env->vfp.fp_status);
2511 }
2512
2513 float32 VFP_HELPER(fcvts, d)(float64 x, CPUState *env)
2514 {
2515     return float64_to_float32(x, &env->vfp.fp_status);
2516 }
2517
2518 /* VFP3 fixed point conversion.  */
2519 #define VFP_CONV_FIX(name, p, ftype, itype, sign) \
2520 ftype VFP_HELPER(name##to, p)(ftype x, uint32_t shift, CPUState *env) \
2521 { \
2522     ftype tmp; \
2523     tmp = sign##int32_to_##ftype ((itype)vfp_##p##toi(x), \
2524                                   &env->vfp.fp_status); \
2525     return ftype##_scalbn(tmp, -(int)shift, &env->vfp.fp_status); \
2526 } \
2527 ftype VFP_HELPER(to##name, p)(ftype x, uint32_t shift, CPUState *env) \
2528 { \
2529     ftype tmp; \
2530     tmp = ftype##_scalbn(x, shift, &env->vfp.fp_status); \
2531     return vfp_ito##p((itype)ftype##_to_##sign##int32_round_to_zero(tmp, \
2532         &env->vfp.fp_status)); \
2533 }
2534
2535 VFP_CONV_FIX(sh, d, float64, int16, )
2536 VFP_CONV_FIX(sl, d, float64, int32, )
2537 VFP_CONV_FIX(uh, d, float64, uint16, u)
2538 VFP_CONV_FIX(ul, d, float64, uint32, u)
2539 VFP_CONV_FIX(sh, s, float32, int16, )
2540 VFP_CONV_FIX(sl, s, float32, int32, )
2541 VFP_CONV_FIX(uh, s, float32, uint16, u)
2542 VFP_CONV_FIX(ul, s, float32, uint32, u)
2543 #undef VFP_CONV_FIX
2544
2545 float32 HELPER(recps_f32)(float32 a, float32 b, CPUState *env)
2546 {
2547     float_status *s = &env->vfp.fp_status;
2548     float32 two = int32_to_float32(2, s);
2549     return float32_sub(two, float32_mul(a, b, s), s);
2550 }
2551
2552 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUState *env)
2553 {
2554     float_status *s = &env->vfp.fp_status;
2555     float32 three = int32_to_float32(3, s);
2556     return float32_sub(three, float32_mul(a, b, s), s);
2557 }
2558
2559 /* NEON helpers.  */
2560
2561 /* TODO: The architecture specifies the value that the estimate functions
2562    should return.  We return the exact reciprocal/root instead.  */
2563 float32 HELPER(recpe_f32)(float32 a, CPUState *env)
2564 {
2565     float_status *s = &env->vfp.fp_status;
2566     float32 one = int32_to_float32(1, s);
2567     return float32_div(one, a, s);
2568 }
2569
2570 float32 HELPER(rsqrte_f32)(float32 a, CPUState *env)
2571 {
2572     float_status *s = &env->vfp.fp_status;
2573     float32 one = int32_to_float32(1, s);
2574     return float32_div(one, float32_sqrt(a, s), s);
2575 }
2576
2577 uint32_t HELPER(recpe_u32)(uint32_t a, CPUState *env)
2578 {
2579     float_status *s = &env->vfp.fp_status;
2580     float32 tmp;
2581     tmp = int32_to_float32(a, s);
2582     tmp = float32_scalbn(tmp, -32, s);
2583     tmp = helper_recpe_f32(tmp, env);
2584     tmp = float32_scalbn(tmp, 31, s);
2585     return float32_to_int32(tmp, s);
2586 }
2587
2588 uint32_t HELPER(rsqrte_u32)(uint32_t a, CPUState *env)
2589 {
2590     float_status *s = &env->vfp.fp_status;
2591     float32 tmp;
2592     tmp = int32_to_float32(a, s);
2593     tmp = float32_scalbn(tmp, -32, s);
2594     tmp = helper_rsqrte_f32(tmp, env);
2595     tmp = float32_scalbn(tmp, 31, s);
2596     return float32_to_int32(tmp, s);
2597 }