Home | History | Annotate | Download | only in arm
      1 /*
      2  * Copyright (C) 2009 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #include "Dalvik.h"
     18 #include "libdex/OpCode.h"
     19 #include "libdex/OpCodeNames.h"
     20 
     21 #include "../../CompilerInternals.h"
     22 #include "ArmLIR.h"
     23 #include "Codegen.h"
     24 #include <unistd.h>             /* for cacheflush */
     25 #include <sys/mman.h>           /* for protection change */
     26 
     27 #define MAX_ASSEMBLER_RETRIES 10
     28 
     29 /*
     30  * opcode: ArmOpCode enum
     31  * skeleton: pre-designated bit-pattern for this opcode
     32  * k0: key to applying ds/de
     33  * ds: dest start bit position
     34  * de: dest end bit position
     35  * k1: key to applying s1s/s1e
     36  * s1s: src1 start bit position
     37  * s1e: src1 end bit position
     38  * k2: key to applying s2s/s2e
     39  * s2s: src2 start bit position
     40  * s2e: src2 end bit position
     41  * operands: number of operands (for sanity check purposes)
     42  * name: mnemonic name
     43  * fmt: for pretty-printing
     44  */
     45 #define ENCODING_MAP(opcode, skeleton, k0, ds, de, k1, s1s, s1e, k2, s2s, s2e, \
     46                      k3, k3s, k3e, flags, name, fmt, size) \
     47         {skeleton, {{k0, ds, de}, {k1, s1s, s1e}, {k2, s2s, s2e}, \
     48                     {k3, k3s, k3e}}, opcode, flags, name, fmt, size}
     49 
     50 /* Instruction dump string format keys: !pf, where "!" is the start
     51  * of the key, "p" is which numeric operand to use and "f" is the
     52  * print format.
     53  *
     54  * [p]ositions:
     55  *     0 -> operands[0] (dest)
     56  *     1 -> operands[1] (src1)
     57  *     2 -> operands[2] (src2)
     58  *     3 -> operands[3] (extra)
     59  *
     60  * [f]ormats:
     61  *     h -> 4-digit hex
     62  *     d -> decimal
     63  *     E -> decimal*4
     64  *     F -> decimal*2
     65  *     c -> branch condition (beq, bne, etc.)
     66  *     t -> pc-relative target
     67  *     u -> 1st half of bl[x] target
     68  *     v -> 2nd half ob bl[x] target
     69  *     R -> register list
     70  *     s -> single precision floating point register
     71  *     S -> double precision floating point register
     72  *     m -> Thumb2 modified immediate
     73  *     n -> complimented Thumb2 modified immediate
     74  *     M -> Thumb2 16-bit zero-extended immediate
     75  *     b -> 4-digit binary
     76  *     B -> dmb option string (sy, st, ish, ishst, nsh, hshst)
     77  *     H -> operand shift
     78  *
     79  *  [!] escape.  To insert "!", use "!!"
     80  */
     81 /* NOTE: must be kept in sync with enum ArmOpcode from ArmLIR.h */
     82 ArmEncodingMap EncodingMap[kArmLast] = {
     83     ENCODING_MAP(kArm16BitData,    0x0000,
     84                  kFmtBitBlt, 15, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
     85                  kFmtUnused, -1, -1, IS_UNARY_OP, "data", "0x!0h(!0d)", 1),
     86     ENCODING_MAP(kThumbAdcRR,        0x4140,
     87                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
     88                  kFmtUnused, -1, -1,
     89                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES | USES_CCODES,
     90                  "adcs", "r!0d, r!1d", 1),
     91     ENCODING_MAP(kThumbAddRRI3,      0x1c00,
     92                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
     93                  kFmtUnused, -1, -1,
     94                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
     95                  "adds", "r!0d, r!1d, #!2d", 1),
     96     ENCODING_MAP(kThumbAddRI8,       0x3000,
     97                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
     98                  kFmtUnused, -1, -1,
     99                  IS_BINARY_OP | REG_DEF0_USE0 | SETS_CCODES,
    100                  "adds", "r!0d, r!0d, #!1d", 1),
    101     ENCODING_MAP(kThumbAddRRR,       0x1800,
    102                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    103                  kFmtUnused, -1, -1,
    104                  IS_TERTIARY_OP | REG_DEF0_USE12 | SETS_CCODES,
    105                  "adds", "r!0d, r!1d, r!2d", 1),
    106     ENCODING_MAP(kThumbAddRRLH,     0x4440,
    107                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    108                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE01,
    109                  "add", "r!0d, r!1d", 1),
    110     ENCODING_MAP(kThumbAddRRHL,     0x4480,
    111                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    112                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE01,
    113                  "add", "r!0d, r!1d", 1),
    114     ENCODING_MAP(kThumbAddRRHH,     0x44c0,
    115                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    116                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE01,
    117                  "add", "r!0d, r!1d", 1),
    118     ENCODING_MAP(kThumbAddPcRel,    0xa000,
    119                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    120                  kFmtUnused, -1, -1, IS_TERTIARY_OP | IS_BRANCH,
    121                  "add", "r!0d, pc, #!1E", 1),
    122     ENCODING_MAP(kThumbAddSpRel,    0xa800,
    123                  kFmtBitBlt, 10, 8, kFmtUnused, -1, -1, kFmtBitBlt, 7, 0,
    124                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF_SP | REG_USE_SP,
    125                  "add", "r!0d, sp, #!2E", 1),
    126     ENCODING_MAP(kThumbAddSpI7,      0xb000,
    127                  kFmtBitBlt, 6, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    128                  kFmtUnused, -1, -1, IS_UNARY_OP | REG_DEF_SP | REG_USE_SP,
    129                  "add", "sp, #!0d*4", 1),
    130     ENCODING_MAP(kThumbAndRR,        0x4000,
    131                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    132                  kFmtUnused, -1, -1,
    133                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    134                  "ands", "r!0d, r!1d", 1),
    135     ENCODING_MAP(kThumbAsrRRI5,      0x1000,
    136                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    137                  kFmtUnused, -1, -1,
    138                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    139                  "asrs", "r!0d, r!1d, #!2d", 1),
    140     ENCODING_MAP(kThumbAsrRR,        0x4100,
    141                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    142                  kFmtUnused, -1, -1,
    143                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    144                  "asrs", "r!0d, r!1d", 1),
    145     ENCODING_MAP(kThumbBCond,        0xd000,
    146                  kFmtBitBlt, 7, 0, kFmtBitBlt, 11, 8, kFmtUnused, -1, -1,
    147                  kFmtUnused, -1, -1, IS_BINARY_OP | IS_BRANCH | USES_CCODES,
    148                  "b!1c", "!0t", 1),
    149     ENCODING_MAP(kThumbBUncond,      0xe000,
    150                  kFmtBitBlt, 10, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    151                  kFmtUnused, -1, -1, NO_OPERAND | IS_BRANCH,
    152                  "b", "!0t", 1),
    153     ENCODING_MAP(kThumbBicRR,        0x4380,
    154                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    155                  kFmtUnused, -1, -1,
    156                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    157                  "bics", "r!0d, r!1d", 1),
    158     ENCODING_MAP(kThumbBkpt,          0xbe00,
    159                  kFmtBitBlt, 7, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    160                  kFmtUnused, -1, -1, IS_UNARY_OP | IS_BRANCH,
    161                  "bkpt", "!0d", 1),
    162     ENCODING_MAP(kThumbBlx1,         0xf000,
    163                  kFmtBitBlt, 10, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    164                  kFmtUnused, -1, -1, IS_BINARY_OP | IS_BRANCH | REG_DEF_LR,
    165                  "blx_1", "!0u", 1),
    166     ENCODING_MAP(kThumbBlx2,         0xe800,
    167                  kFmtBitBlt, 10, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    168                  kFmtUnused, -1, -1, IS_BINARY_OP | IS_BRANCH | REG_DEF_LR,
    169                  "blx_2", "!0v", 1),
    170     ENCODING_MAP(kThumbBl1,          0xf000,
    171                  kFmtBitBlt, 10, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    172                  kFmtUnused, -1, -1, IS_UNARY_OP | IS_BRANCH | REG_DEF_LR,
    173                  "bl_1", "!0u", 1),
    174     ENCODING_MAP(kThumbBl2,          0xf800,
    175                  kFmtBitBlt, 10, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    176                  kFmtUnused, -1, -1, IS_UNARY_OP | IS_BRANCH | REG_DEF_LR,
    177                  "bl_2", "!0v", 1),
    178     ENCODING_MAP(kThumbBlxR,         0x4780,
    179                  kFmtBitBlt, 6, 3, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    180                  kFmtUnused, -1, -1,
    181                  IS_UNARY_OP | REG_USE0 | IS_BRANCH | REG_DEF_LR,
    182                  "blx", "r!0d", 1),
    183     ENCODING_MAP(kThumbBx,            0x4700,
    184                  kFmtBitBlt, 6, 3, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    185                  kFmtUnused, -1, -1, IS_UNARY_OP | IS_BRANCH,
    186                  "bx", "r!0d", 1),
    187     ENCODING_MAP(kThumbCmnRR,        0x42c0,
    188                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    189                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01 | SETS_CCODES,
    190                  "cmn", "r!0d, r!1d", 1),
    191     ENCODING_MAP(kThumbCmpRI8,       0x2800,
    192                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    193                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE0 | SETS_CCODES,
    194                  "cmp", "r!0d, #!1d", 1),
    195     ENCODING_MAP(kThumbCmpRR,        0x4280,
    196                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    197                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01 | SETS_CCODES,
    198                  "cmp", "r!0d, r!1d", 1),
    199     ENCODING_MAP(kThumbCmpLH,        0x4540,
    200                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    201                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01 | SETS_CCODES,
    202                  "cmp", "r!0d, r!1d", 1),
    203     ENCODING_MAP(kThumbCmpHL,        0x4580,
    204                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    205                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01 | SETS_CCODES,
    206                  "cmp", "r!0d, r!1d", 1),
    207     ENCODING_MAP(kThumbCmpHH,        0x45c0,
    208                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    209                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01 | SETS_CCODES,
    210                  "cmp", "r!0d, r!1d", 1),
    211     ENCODING_MAP(kThumbEorRR,        0x4040,
    212                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    213                  kFmtUnused, -1, -1,
    214                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    215                  "eors", "r!0d, r!1d", 1),
    216     ENCODING_MAP(kThumbLdmia,         0xc800,
    217                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    218                  kFmtUnused, -1, -1,
    219                  IS_BINARY_OP | REG_DEF0_USE0 | REG_DEF_LIST1 | IS_LOAD,
    220                  "ldmia", "r!0d!!, <!1R>", 1),
    221     ENCODING_MAP(kThumbLdrRRI5,      0x6800,
    222                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    223                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    224                  "ldr", "r!0d, [r!1d, #!2E]", 1),
    225     ENCODING_MAP(kThumbLdrRRR,       0x5800,
    226                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    227                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12 | IS_LOAD,
    228                  "ldr", "r!0d, [r!1d, r!2d]", 1),
    229     ENCODING_MAP(kThumbLdrPcRel,    0x4800,
    230                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    231                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0 | REG_USE_PC
    232                  | IS_LOAD, "ldr", "r!0d, [pc, #!1E]", 1),
    233     ENCODING_MAP(kThumbLdrSpRel,    0x9800,
    234                  kFmtBitBlt, 10, 8, kFmtUnused, -1, -1, kFmtBitBlt, 7, 0,
    235                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0 | REG_USE_SP
    236                  | IS_LOAD, "ldr", "r!0d, [sp, #!2E]", 1),
    237     ENCODING_MAP(kThumbLdrbRRI5,     0x7800,
    238                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    239                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    240                  "ldrb", "r!0d, [r!1d, #2d]", 1),
    241     ENCODING_MAP(kThumbLdrbRRR,      0x5c00,
    242                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    243                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12 | IS_LOAD,
    244                  "ldrb", "r!0d, [r!1d, r!2d]", 1),
    245     ENCODING_MAP(kThumbLdrhRRI5,     0x8800,
    246                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    247                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    248                  "ldrh", "r!0d, [r!1d, #!2F]", 1),
    249     ENCODING_MAP(kThumbLdrhRRR,      0x5a00,
    250                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    251                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12 | IS_LOAD,
    252                  "ldrh", "r!0d, [r!1d, r!2d]", 1),
    253     ENCODING_MAP(kThumbLdrsbRRR,     0x5600,
    254                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    255                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12 | IS_LOAD,
    256                  "ldrsb", "r!0d, [r!1d, r!2d]", 1),
    257     ENCODING_MAP(kThumbLdrshRRR,     0x5e00,
    258                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    259                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12 | IS_LOAD,
    260                  "ldrsh", "r!0d, [r!1d, r!2d]", 1),
    261     ENCODING_MAP(kThumbLslRRI5,      0x0000,
    262                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    263                  kFmtUnused, -1, -1,
    264                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    265                  "lsls", "r!0d, r!1d, #!2d", 1),
    266     ENCODING_MAP(kThumbLslRR,        0x4080,
    267                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    268                  kFmtUnused, -1, -1,
    269                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    270                  "lsls", "r!0d, r!1d", 1),
    271     ENCODING_MAP(kThumbLsrRRI5,      0x0800,
    272                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    273                  kFmtUnused, -1, -1,
    274                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    275                  "lsrs", "r!0d, r!1d, #!2d", 1),
    276     ENCODING_MAP(kThumbLsrRR,        0x40c0,
    277                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    278                  kFmtUnused, -1, -1,
    279                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    280                  "lsrs", "r!0d, r!1d", 1),
    281     ENCODING_MAP(kThumbMovImm,       0x2000,
    282                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    283                  kFmtUnused, -1, -1,
    284                  IS_BINARY_OP | REG_DEF0 | SETS_CCODES,
    285                  "movs", "r!0d, #!1d", 1),
    286     ENCODING_MAP(kThumbMovRR,        0x1c00,
    287                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    288                  kFmtUnused, -1, -1,
    289                  IS_BINARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    290                  "movs", "r!0d, r!1d", 1),
    291     ENCODING_MAP(kThumbMovRR_H2H,    0x46c0,
    292                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    293                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    294                  "mov", "r!0d, r!1d", 1),
    295     ENCODING_MAP(kThumbMovRR_H2L,    0x4640,
    296                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    297                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    298                  "mov", "r!0d, r!1d", 1),
    299     ENCODING_MAP(kThumbMovRR_L2H,    0x4680,
    300                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    301                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    302                  "mov", "r!0d, r!1d", 1),
    303     ENCODING_MAP(kThumbMul,           0x4340,
    304                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    305                  kFmtUnused, -1, -1,
    306                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    307                  "muls", "r!0d, r!1d", 1),
    308     ENCODING_MAP(kThumbMvn,           0x43c0,
    309                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    310                  kFmtUnused, -1, -1,
    311                  IS_BINARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    312                  "mvns", "r!0d, r!1d", 1),
    313     ENCODING_MAP(kThumbNeg,           0x4240,
    314                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    315                  kFmtUnused, -1, -1,
    316                  IS_BINARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    317                  "negs", "r!0d, r!1d", 1),
    318     ENCODING_MAP(kThumbOrr,           0x4300,
    319                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    320                  kFmtUnused, -1, -1,
    321                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    322                  "orrs", "r!0d, r!1d", 1),
    323     ENCODING_MAP(kThumbPop,           0xbc00,
    324                  kFmtBitBlt, 8, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    325                  kFmtUnused, -1, -1,
    326                  IS_UNARY_OP | REG_DEF_SP | REG_USE_SP | REG_DEF_LIST0
    327                  | IS_LOAD, "pop", "<!0R>", 1),
    328     ENCODING_MAP(kThumbPush,          0xb400,
    329                  kFmtBitBlt, 8, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    330                  kFmtUnused, -1, -1,
    331                  IS_UNARY_OP | REG_DEF_SP | REG_USE_SP | REG_USE_LIST0
    332                  | IS_STORE, "push", "<!0R>", 1),
    333     ENCODING_MAP(kThumbRorRR,        0x41c0,
    334                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    335                  kFmtUnused, -1, -1,
    336                  IS_BINARY_OP | REG_DEF0_USE01 | SETS_CCODES,
    337                  "rors", "r!0d, r!1d", 1),
    338     ENCODING_MAP(kThumbSbc,           0x4180,
    339                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    340                  kFmtUnused, -1, -1,
    341                  IS_BINARY_OP | REG_DEF0_USE01 | USES_CCODES | SETS_CCODES,
    342                  "sbcs", "r!0d, r!1d", 1),
    343     ENCODING_MAP(kThumbStmia,         0xc000,
    344                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    345                  kFmtUnused, -1, -1,
    346                  IS_BINARY_OP | REG_DEF0 | REG_USE0 | REG_USE_LIST1 | IS_STORE,
    347                  "stmia", "r!0d!!, <!1R>", 1),
    348     ENCODING_MAP(kThumbStrRRI5,      0x6000,
    349                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    350                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    351                  "str", "r!0d, [r!1d, #!2E]", 1),
    352     ENCODING_MAP(kThumbStrRRR,       0x5000,
    353                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    354                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE012 | IS_STORE,
    355                  "str", "r!0d, [r!1d, r!2d]", 1),
    356     ENCODING_MAP(kThumbStrSpRel,    0x9000,
    357                  kFmtBitBlt, 10, 8, kFmtUnused, -1, -1, kFmtBitBlt, 7, 0,
    358                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE0 | REG_USE_SP
    359                  | IS_STORE, "str", "r!0d, [sp, #!2E]", 1),
    360     ENCODING_MAP(kThumbStrbRRI5,     0x7000,
    361                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    362                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    363                  "strb", "r!0d, [r!1d, #!2d]", 1),
    364     ENCODING_MAP(kThumbStrbRRR,      0x5400,
    365                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    366                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE012 | IS_STORE,
    367                  "strb", "r!0d, [r!1d, r!2d]", 1),
    368     ENCODING_MAP(kThumbStrhRRI5,     0x8000,
    369                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 10, 6,
    370                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    371                  "strh", "r!0d, [r!1d, #!2F]", 1),
    372     ENCODING_MAP(kThumbStrhRRR,      0x5200,
    373                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    374                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE012 | IS_STORE,
    375                  "strh", "r!0d, [r!1d, r!2d]", 1),
    376     ENCODING_MAP(kThumbSubRRI3,      0x1e00,
    377                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    378                  kFmtUnused, -1, -1,
    379                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    380                  "subs", "r!0d, r!1d, #!2d]", 1),
    381     ENCODING_MAP(kThumbSubRI8,       0x3800,
    382                  kFmtBitBlt, 10, 8, kFmtBitBlt, 7, 0, kFmtUnused, -1, -1,
    383                  kFmtUnused, -1, -1,
    384                  IS_BINARY_OP | REG_DEF0_USE0 | SETS_CCODES,
    385                  "subs", "r!0d, #!1d", 1),
    386     ENCODING_MAP(kThumbSubRRR,       0x1a00,
    387                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtBitBlt, 8, 6,
    388                  kFmtUnused, -1, -1,
    389                  IS_TERTIARY_OP | REG_DEF0_USE12 | SETS_CCODES,
    390                  "subs", "r!0d, r!1d, r!2d", 1),
    391     ENCODING_MAP(kThumbSubSpI7,      0xb080,
    392                  kFmtBitBlt, 6, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    393                  kFmtUnused, -1, -1,
    394                  IS_UNARY_OP | REG_DEF_SP | REG_USE_SP,
    395                  "sub", "sp, #!0d", 1),
    396     ENCODING_MAP(kThumbSwi,           0xdf00,
    397                  kFmtBitBlt, 7, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,                       kFmtUnused, -1, -1, IS_UNARY_OP | IS_BRANCH,
    398                  "swi", "!0d", 1),
    399     ENCODING_MAP(kThumbTst,           0x4200,
    400                  kFmtBitBlt, 2, 0, kFmtBitBlt, 5, 3, kFmtUnused, -1, -1,
    401                  kFmtUnused, -1, -1, IS_UNARY_OP | REG_USE01 | SETS_CCODES,
    402                  "tst", "r!0d, r!1d", 1),
    403     ENCODING_MAP(kThumb2Vldrs,       0xed900a00,
    404                  kFmtSfp, 22, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 7, 0,
    405                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    406                  "vldr", "!0s, [r!1d, #!2E]", 2),
    407     ENCODING_MAP(kThumb2Vldrd,       0xed900b00,
    408                  kFmtDfp, 22, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 7, 0,
    409                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    410                  "vldr", "!0S, [r!1d, #!2E]", 2),
    411     ENCODING_MAP(kThumb2Vmuls,        0xee200a00,
    412                  kFmtSfp, 22, 12, kFmtSfp, 7, 16, kFmtSfp, 5, 0,
    413                  kFmtUnused, -1, -1,
    414                  IS_TERTIARY_OP | REG_DEF0_USE12,
    415                  "vmuls", "!0s, !1s, !2s", 2),
    416     ENCODING_MAP(kThumb2Vmuld,        0xee200b00,
    417                  kFmtDfp, 22, 12, kFmtDfp, 7, 16, kFmtDfp, 5, 0,
    418                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    419                  "vmuld", "!0S, !1S, !2S", 2),
    420     ENCODING_MAP(kThumb2Vstrs,       0xed800a00,
    421                  kFmtSfp, 22, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 7, 0,
    422                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    423                  "vstr", "!0s, [r!1d, #!2E]", 2),
    424     ENCODING_MAP(kThumb2Vstrd,       0xed800b00,
    425                  kFmtDfp, 22, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 7, 0,
    426                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    427                  "vstr", "!0S, [r!1d, #!2E]", 2),
    428     ENCODING_MAP(kThumb2Vsubs,        0xee300a40,
    429                  kFmtSfp, 22, 12, kFmtSfp, 7, 16, kFmtSfp, 5, 0,
    430                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    431                  "vsub", "!0s, !1s, !2s", 2),
    432     ENCODING_MAP(kThumb2Vsubd,        0xee300b40,
    433                  kFmtDfp, 22, 12, kFmtDfp, 7, 16, kFmtDfp, 5, 0,
    434                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    435                  "vsub", "!0S, !1S, !2S", 2),
    436     ENCODING_MAP(kThumb2Vadds,        0xee300a00,
    437                  kFmtSfp, 22, 12, kFmtSfp, 7, 16, kFmtSfp, 5, 0,
    438                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    439                  "vadd", "!0s, !1s, !2s", 2),
    440     ENCODING_MAP(kThumb2Vaddd,        0xee300b00,
    441                  kFmtDfp, 22, 12, kFmtDfp, 7, 16, kFmtDfp, 5, 0,
    442                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    443                  "vadd", "!0S, !1S, !2S", 2),
    444     ENCODING_MAP(kThumb2Vdivs,        0xee800a00,
    445                  kFmtSfp, 22, 12, kFmtSfp, 7, 16, kFmtSfp, 5, 0,
    446                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    447                  "vdivs", "!0s, !1s, !2s", 2),
    448     ENCODING_MAP(kThumb2Vdivd,        0xee800b00,
    449                  kFmtDfp, 22, 12, kFmtDfp, 7, 16, kFmtDfp, 5, 0,
    450                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    451                  "vdivd", "!0S, !1S, !2S", 2),
    452     ENCODING_MAP(kThumb2VcvtIF,       0xeeb80ac0,
    453                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    454                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    455                  "vcvt.f32", "!0s, !1s", 2),
    456     ENCODING_MAP(kThumb2VcvtID,       0xeeb80bc0,
    457                  kFmtDfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    458                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    459                  "vcvt.f64", "!0S, !1s", 2),
    460     ENCODING_MAP(kThumb2VcvtFI,       0xeebd0ac0,
    461                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    462                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    463                  "vcvt.s32.f32 ", "!0s, !1s", 2),
    464     ENCODING_MAP(kThumb2VcvtDI,       0xeebd0bc0,
    465                  kFmtSfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    466                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    467                  "vcvt.s32.f64 ", "!0s, !1S", 2),
    468     ENCODING_MAP(kThumb2VcvtFd,       0xeeb70ac0,
    469                  kFmtDfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    470                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    471                  "vcvt.f64.f32 ", "!0S, !1s", 2),
    472     ENCODING_MAP(kThumb2VcvtDF,       0xeeb70bc0,
    473                  kFmtSfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    474                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    475                  "vcvt.f32.f64 ", "!0s, !1S", 2),
    476     ENCODING_MAP(kThumb2Vsqrts,       0xeeb10ac0,
    477                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    478                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    479                  "vsqrt.f32 ", "!0s, !1s", 2),
    480     ENCODING_MAP(kThumb2Vsqrtd,       0xeeb10bc0,
    481                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    482                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    483                  "vsqrt.f64 ", "!0S, !1S", 2),
    484     ENCODING_MAP(kThumb2MovImmShift, 0xf04f0000, /* no setflags encoding */
    485                  kFmtBitBlt, 11, 8, kFmtModImm, -1, -1, kFmtUnused, -1, -1,
    486                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0,
    487                  "mov", "r!0d, #!1m", 2),
    488     ENCODING_MAP(kThumb2MovImm16,       0xf2400000,
    489                  kFmtBitBlt, 11, 8, kFmtImm16, -1, -1, kFmtUnused, -1, -1,
    490                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0,
    491                  "mov", "r!0d, #!1M", 2),
    492     ENCODING_MAP(kThumb2StrRRI12,       0xf8c00000,
    493                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    494                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    495                  "str", "r!0d, [r!1d, #!2d]", 2),
    496     ENCODING_MAP(kThumb2LdrRRI12,       0xf8d00000,
    497                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    498                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    499                  "ldr", "r!0d, [r!1d, #!2d]", 2),
    500     ENCODING_MAP(kThumb2StrRRI8Predec,       0xf8400c00,
    501                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 8, 0,
    502                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    503                  "str", "r!0d, [r!1d, #-!2d]", 2),
    504     ENCODING_MAP(kThumb2LdrRRI8Predec,       0xf8500c00,
    505                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 8, 0,
    506                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    507                  "ldr", "r!0d, [r!1d, #-!2d]", 2),
    508     ENCODING_MAP(kThumb2Cbnz,       0xb900, /* Note: does not affect flags */
    509                  kFmtBitBlt, 2, 0, kFmtImm6, -1, -1, kFmtUnused, -1, -1,
    510                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE0 | IS_BRANCH,
    511                  "cbnz", "r!0d,!1t", 1),
    512     ENCODING_MAP(kThumb2Cbz,       0xb100, /* Note: does not affect flags */
    513                  kFmtBitBlt, 2, 0, kFmtImm6, -1, -1, kFmtUnused, -1, -1,
    514                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE0 | IS_BRANCH,
    515                  "cbz", "r!0d,!1t", 1),
    516     ENCODING_MAP(kThumb2AddRRI12,       0xf2000000,
    517                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtImm12, -1, -1,
    518                  kFmtUnused, -1, -1,
    519                  IS_TERTIARY_OP | REG_DEF0_USE1,/* Note: doesn't affect flags */
    520                  "add", "r!0d,r!1d,#!2d", 2),
    521     ENCODING_MAP(kThumb2MovRR,       0xea4f0000, /* no setflags encoding */
    522                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtUnused, -1, -1,
    523                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    524                  "mov", "r!0d, r!1d", 2),
    525     ENCODING_MAP(kThumb2Vmovs,       0xeeb00a40,
    526                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    527                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    528                  "vmov.f32 ", " !0s, !1s", 2),
    529     ENCODING_MAP(kThumb2Vmovd,       0xeeb00b40,
    530                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    531                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    532                  "vmov.f64 ", " !0S, !1S", 2),
    533     ENCODING_MAP(kThumb2Ldmia,         0xe8900000,
    534                  kFmtBitBlt, 19, 16, kFmtBitBlt, 15, 0, kFmtUnused, -1, -1,
    535                  kFmtUnused, -1, -1,
    536                  IS_BINARY_OP | REG_DEF0_USE0 | REG_DEF_LIST1 | IS_LOAD,
    537                  "ldmia", "r!0d!!, <!1R>", 2),
    538     ENCODING_MAP(kThumb2Stmia,         0xe8800000,
    539                  kFmtBitBlt, 19, 16, kFmtBitBlt, 15, 0, kFmtUnused, -1, -1,
    540                  kFmtUnused, -1, -1,
    541                  IS_BINARY_OP | REG_DEF0_USE0 | REG_USE_LIST1 | IS_STORE,
    542                  "stmia", "r!0d!!, <!1R>", 2),
    543     ENCODING_MAP(kThumb2AddRRR,  0xeb100000, /* setflags encoding */
    544                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    545                  kFmtShift, -1, -1,
    546                  IS_QUAD_OP | REG_DEF0_USE12 | SETS_CCODES,
    547                  "adds", "r!0d, r!1d, r!2d!3H", 2),
    548     ENCODING_MAP(kThumb2SubRRR,       0xebb00000, /* setflags enconding */
    549                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    550                  kFmtShift, -1, -1,
    551                  IS_QUAD_OP | REG_DEF0_USE12 | SETS_CCODES,
    552                  "subs", "r!0d, r!1d, r!2d!3H", 2),
    553     ENCODING_MAP(kThumb2SbcRRR,       0xeb700000, /* setflags encoding */
    554                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    555                  kFmtShift, -1, -1,
    556                  IS_QUAD_OP | REG_DEF0_USE12 | USES_CCODES | SETS_CCODES,
    557                  "sbcs", "r!0d, r!1d, r!2d!3H", 2),
    558     ENCODING_MAP(kThumb2CmpRR,       0xebb00f00,
    559                  kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0, kFmtShift, -1, -1,
    560                  kFmtUnused, -1, -1,
    561                  IS_TERTIARY_OP | REG_USE01 | SETS_CCODES,
    562                  "cmp", "r!0d, r!1d", 2),
    563     ENCODING_MAP(kThumb2SubRRI12,       0xf2a00000,
    564                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtImm12, -1, -1,
    565                  kFmtUnused, -1, -1,
    566                  IS_TERTIARY_OP | REG_DEF0_USE1,/* Note: doesn't affect flags */
    567                  "sub", "r!0d,r!1d,#!2d", 2),
    568     ENCODING_MAP(kThumb2MvnImmShift,  0xf06f0000, /* no setflags encoding */
    569                  kFmtBitBlt, 11, 8, kFmtModImm, -1, -1, kFmtUnused, -1, -1,
    570                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0,
    571                  "mvn", "r!0d, #!1n", 2),
    572     ENCODING_MAP(kThumb2Sel,       0xfaa0f080,
    573                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    574                  kFmtUnused, -1, -1,
    575                  IS_TERTIARY_OP | REG_DEF0_USE12 | USES_CCODES,
    576                  "sel", "r!0d, r!1d, r!2d", 2),
    577     ENCODING_MAP(kThumb2Ubfx,       0xf3c00000,
    578                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtLsb, -1, -1,
    579                  kFmtBWidth, 4, 0, IS_QUAD_OP | REG_DEF0_USE1,
    580                  "ubfx", "r!0d, r!1d, #!2d, #!3d", 2),
    581     ENCODING_MAP(kThumb2Sbfx,       0xf3400000,
    582                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtLsb, -1, -1,
    583                  kFmtBWidth, 4, 0, IS_QUAD_OP | REG_DEF0_USE1,
    584                  "sbfx", "r!0d, r!1d, #!2d, #!3d", 2),
    585     ENCODING_MAP(kThumb2LdrRRR,    0xf8500000,
    586                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    587                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_DEF0_USE12 | IS_LOAD,
    588                  "ldr", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    589     ENCODING_MAP(kThumb2LdrhRRR,    0xf8300000,
    590                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    591                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_DEF0_USE12 | IS_LOAD,
    592                  "ldrh", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    593     ENCODING_MAP(kThumb2LdrshRRR,    0xf9300000,
    594                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    595                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_DEF0_USE12 | IS_LOAD,
    596                  "ldrsh", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    597     ENCODING_MAP(kThumb2LdrbRRR,    0xf8100000,
    598                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    599                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_DEF0_USE12 | IS_LOAD,
    600                  "ldrb", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    601     ENCODING_MAP(kThumb2LdrsbRRR,    0xf9100000,
    602                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    603                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_DEF0_USE12 | IS_LOAD,
    604                  "ldrsb", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    605     ENCODING_MAP(kThumb2StrRRR,    0xf8400000,
    606                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    607                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_USE012 | IS_STORE,
    608                  "str", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    609     ENCODING_MAP(kThumb2StrhRRR,    0xf8200000,
    610                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    611                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_USE012 | IS_STORE,
    612                  "strh", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    613     ENCODING_MAP(kThumb2StrbRRR,    0xf8000000,
    614                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    615                  kFmtBitBlt, 5, 4, IS_QUAD_OP | REG_USE012 | IS_STORE,
    616                  "strb", "r!0d, [r!1d, r!2d, LSL #!3d]", 2),
    617     ENCODING_MAP(kThumb2LdrhRRI12,       0xf8b00000,
    618                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    619                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    620                  "ldrh", "r!0d, [r!1d, #!2d]", 2),
    621     ENCODING_MAP(kThumb2LdrshRRI12,       0xf9b00000,
    622                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    623                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    624                  "ldrsh", "r!0d, [r!1d, #!2d]", 2),
    625     ENCODING_MAP(kThumb2LdrbRRI12,       0xf8900000,
    626                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    627                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    628                  "ldrb", "r!0d, [r!1d, #!2d]", 2),
    629     ENCODING_MAP(kThumb2LdrsbRRI12,       0xf9900000,
    630                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    631                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    632                  "ldrsb", "r!0d, [r!1d, #!2d]", 2),
    633     ENCODING_MAP(kThumb2StrhRRI12,       0xf8a00000,
    634                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    635                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    636                  "strh", "r!0d, [r!1d, #!2d]", 2),
    637     ENCODING_MAP(kThumb2StrbRRI12,       0xf8800000,
    638                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 11, 0,
    639                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_USE01 | IS_STORE,
    640                  "strb", "r!0d, [r!1d, #!2d]", 2),
    641     ENCODING_MAP(kThumb2Pop,           0xe8bd0000,
    642                  kFmtBitBlt, 15, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    643                  kFmtUnused, -1, -1,
    644                  IS_UNARY_OP | REG_DEF_SP | REG_USE_SP | REG_DEF_LIST0
    645                  | IS_LOAD, "pop", "<!0R>", 2),
    646     ENCODING_MAP(kThumb2Push,          0xe8ad0000,
    647                  kFmtBitBlt, 15, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    648                  kFmtUnused, -1, -1,
    649                  IS_UNARY_OP | REG_DEF_SP | REG_USE_SP | REG_USE_LIST0
    650                  | IS_STORE, "push", "<!0R>", 2),
    651     ENCODING_MAP(kThumb2CmpRI8, 0xf1b00f00,
    652                  kFmtBitBlt, 19, 16, kFmtModImm, -1, -1, kFmtUnused, -1, -1,
    653                  kFmtUnused, -1, -1,
    654                  IS_BINARY_OP | REG_USE0 | SETS_CCODES,
    655                  "cmp", "r!0d, #!1m", 2),
    656     ENCODING_MAP(kThumb2AdcRRR,  0xeb500000, /* setflags encoding */
    657                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    658                  kFmtShift, -1, -1,
    659                  IS_QUAD_OP | REG_DEF0_USE12 | SETS_CCODES,
    660                  "adcs", "r!0d, r!1d, r!2d!3H", 2),
    661     ENCODING_MAP(kThumb2AndRRR,  0xea000000,
    662                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    663                  kFmtShift, -1, -1, IS_QUAD_OP | REG_DEF0_USE12,
    664                  "and", "r!0d, r!1d, r!2d!3H", 2),
    665     ENCODING_MAP(kThumb2BicRRR,  0xea200000,
    666                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    667                  kFmtShift, -1, -1, IS_QUAD_OP | REG_DEF0_USE12,
    668                  "bic", "r!0d, r!1d, r!2d!3H", 2),
    669     ENCODING_MAP(kThumb2CmnRR,  0xeb000000,
    670                  kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0, kFmtShift, -1, -1,
    671                  kFmtUnused, -1, -1,
    672                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    673                  "cmn", "r!0d, r!1d, shift !2d", 2),
    674     ENCODING_MAP(kThumb2EorRRR,  0xea800000,
    675                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    676                  kFmtShift, -1, -1, IS_QUAD_OP | REG_DEF0_USE12,
    677                  "eor", "r!0d, r!1d, r!2d!3H", 2),
    678     ENCODING_MAP(kThumb2MulRRR,  0xfb00f000,
    679                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    680                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    681                  "mul", "r!0d, r!1d, r!2d", 2),
    682     ENCODING_MAP(kThumb2MnvRR,  0xea6f0000,
    683                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtShift, -1, -1,
    684                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    685                  "mvn", "r!0d, r!1d, shift !2d", 2),
    686     ENCODING_MAP(kThumb2RsubRRI8,       0xf1d00000,
    687                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    688                  kFmtUnused, -1, -1,
    689                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    690                  "rsb", "r!0d,r!1d,#!2m", 2),
    691     ENCODING_MAP(kThumb2NegRR,       0xf1d00000, /* instance of rsub */
    692                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtUnused, -1, -1,
    693                  kFmtUnused, -1, -1,
    694                  IS_BINARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    695                  "neg", "r!0d,r!1d", 2),
    696     ENCODING_MAP(kThumb2OrrRRR,  0xea400000,
    697                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    698                  kFmtShift, -1, -1, IS_QUAD_OP | REG_DEF0_USE12,
    699                  "orr", "r!0d, r!1d, r!2d!3H", 2),
    700     ENCODING_MAP(kThumb2TstRR,       0xea100f00,
    701                  kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0, kFmtShift, -1, -1,
    702                  kFmtUnused, -1, -1,
    703                  IS_TERTIARY_OP | REG_USE01 | SETS_CCODES,
    704                  "tst", "r!0d, r!1d, shift !2d", 2),
    705     ENCODING_MAP(kThumb2LslRRR,  0xfa00f000,
    706                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    707                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    708                  "lsl", "r!0d, r!1d, r!2d", 2),
    709     ENCODING_MAP(kThumb2LsrRRR,  0xfa20f000,
    710                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    711                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    712                  "lsr", "r!0d, r!1d, r!2d", 2),
    713     ENCODING_MAP(kThumb2AsrRRR,  0xfa40f000,
    714                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    715                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    716                  "asr", "r!0d, r!1d, r!2d", 2),
    717     ENCODING_MAP(kThumb2RorRRR,  0xfa60f000,
    718                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    719                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    720                  "ror", "r!0d, r!1d, r!2d", 2),
    721     ENCODING_MAP(kThumb2LslRRI5,  0xea4f0000,
    722                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtShift5, -1, -1,
    723                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    724                  "lsl", "r!0d, r!1d, #!2d", 2),
    725     ENCODING_MAP(kThumb2LsrRRI5,  0xea4f0010,
    726                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtShift5, -1, -1,
    727                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    728                  "lsr", "r!0d, r!1d, #!2d", 2),
    729     ENCODING_MAP(kThumb2AsrRRI5,  0xea4f0020,
    730                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtShift5, -1, -1,
    731                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    732                  "asr", "r!0d, r!1d, #!2d", 2),
    733     ENCODING_MAP(kThumb2RorRRI5,  0xea4f0030,
    734                  kFmtBitBlt, 11, 8, kFmtBitBlt, 3, 0, kFmtShift5, -1, -1,
    735                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    736                  "ror", "r!0d, r!1d, #!2d", 2),
    737     ENCODING_MAP(kThumb2BicRRI8,  0xf0200000,
    738                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    739                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    740                  "bic", "r!0d, r!1d, #!2m", 2),
    741     ENCODING_MAP(kThumb2AndRRI8,  0xf0000000,
    742                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    743                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    744                  "and", "r!0d, r!1d, #!2m", 2),
    745     ENCODING_MAP(kThumb2OrrRRI8,  0xf0400000,
    746                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    747                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    748                  "orr", "r!0d, r!1d, #!2m", 2),
    749     ENCODING_MAP(kThumb2EorRRI8,  0xf0800000,
    750                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    751                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1,
    752                  "eor", "r!0d, r!1d, #!2m", 2),
    753     ENCODING_MAP(kThumb2AddRRI8,  0xf1100000,
    754                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    755                  kFmtUnused, -1, -1,
    756                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    757                  "adds", "r!0d, r!1d, #!2m", 2),
    758     ENCODING_MAP(kThumb2AdcRRI8,  0xf1500000,
    759                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    760                  kFmtUnused, -1, -1,
    761                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES | USES_CCODES,
    762                  "adcs", "r!0d, r!1d, #!2m", 2),
    763     ENCODING_MAP(kThumb2SubRRI8,  0xf1b00000,
    764                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    765                  kFmtUnused, -1, -1,
    766                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES,
    767                  "subs", "r!0d, r!1d, #!2m", 2),
    768     ENCODING_MAP(kThumb2SbcRRI8,  0xf1700000,
    769                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtModImm, -1, -1,
    770                  kFmtUnused, -1, -1,
    771                  IS_TERTIARY_OP | REG_DEF0_USE1 | SETS_CCODES | USES_CCODES,
    772                  "sbcs", "r!0d, r!1d, #!2m", 2),
    773     ENCODING_MAP(kThumb2It,  0xbf00,
    774                  kFmtBitBlt, 7, 4, kFmtBitBlt, 3, 0, kFmtModImm, -1, -1,
    775                  kFmtUnused, -1, -1, IS_BINARY_OP | IS_IT | USES_CCODES,
    776                  "it:!1b", "!0c", 1),
    777     ENCODING_MAP(kThumb2Fmstat,  0xeef1fa10,
    778                  kFmtUnused, -1, -1, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    779                  kFmtUnused, -1, -1, NO_OPERAND | SETS_CCODES,
    780                  "fmstat", "", 2),
    781     ENCODING_MAP(kThumb2Vcmpd,        0xeeb40b40,
    782                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    783                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01,
    784                  "vcmp.f64", "!0S, !1S", 2),
    785     ENCODING_MAP(kThumb2Vcmps,        0xeeb40a40,
    786                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    787                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_USE01,
    788                  "vcmp.f32", "!0s, !1s", 2),
    789     ENCODING_MAP(kThumb2LdrPcRel12,       0xf8df0000,
    790                  kFmtBitBlt, 15, 12, kFmtBitBlt, 11, 0, kFmtUnused, -1, -1,
    791                  kFmtUnused, -1, -1,
    792                  IS_TERTIARY_OP | REG_DEF0 | REG_USE_PC | IS_LOAD,
    793                  "ldr", "r!0d, [rpc, #!1d]", 2),
    794     ENCODING_MAP(kThumb2BCond,        0xf0008000,
    795                  kFmtBrOffset, -1, -1, kFmtBitBlt, 25, 22, kFmtUnused, -1, -1,
    796                  kFmtUnused, -1, -1,
    797                  IS_BINARY_OP | IS_BRANCH | USES_CCODES,
    798                  "b!1c", "!0t", 2),
    799     ENCODING_MAP(kThumb2Vmovd_RR,       0xeeb00b40,
    800                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    801                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    802                  "vmov.f64", "!0S, !1S", 2),
    803     ENCODING_MAP(kThumb2Vmovs_RR,       0xeeb00a40,
    804                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    805                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    806                  "vmov.f32", "!0s, !1s", 2),
    807     ENCODING_MAP(kThumb2Fmrs,       0xee100a10,
    808                  kFmtBitBlt, 15, 12, kFmtSfp, 7, 16, kFmtUnused, -1, -1,
    809                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    810                  "fmrs", "r!0d, !1s", 2),
    811     ENCODING_MAP(kThumb2Fmsr,       0xee000a10,
    812                  kFmtSfp, 7, 16, kFmtBitBlt, 15, 12, kFmtUnused, -1, -1,
    813                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    814                  "fmsr", "!0s, r!1d", 2),
    815     ENCODING_MAP(kThumb2Fmrrd,       0xec500b10,
    816                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtDfp, 5, 0,
    817                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF01_USE2,
    818                  "fmrrd", "r!0d, r!1d, !2S", 2),
    819     ENCODING_MAP(kThumb2Fmdrr,       0xec400b10,
    820                  kFmtDfp, 5, 0, kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16,
    821                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE12,
    822                  "fmdrr", "!0S, r!1d, r!2d", 2),
    823     ENCODING_MAP(kThumb2Vabsd,       0xeeb00bc0,
    824                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    825                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    826                  "vabs.f64", "!0S, !1S", 2),
    827     ENCODING_MAP(kThumb2Vabss,       0xeeb00ac0,
    828                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    829                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    830                  "vabs.f32", "!0s, !1s", 2),
    831     ENCODING_MAP(kThumb2Vnegd,       0xeeb10b40,
    832                  kFmtDfp, 22, 12, kFmtDfp, 5, 0, kFmtUnused, -1, -1,
    833                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    834                  "vneg.f64", "!0S, !1S", 2),
    835     ENCODING_MAP(kThumb2Vnegs,       0xeeb10a40,
    836                  kFmtSfp, 22, 12, kFmtSfp, 5, 0, kFmtUnused, -1, -1,
    837                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0_USE1,
    838                  "vneg.f32", "!0s, !1s", 2),
    839     ENCODING_MAP(kThumb2Vmovs_IMM8,       0xeeb00a00,
    840                  kFmtSfp, 22, 12, kFmtFPImm, 16, 0, kFmtUnused, -1, -1,
    841                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0,
    842                  "vmov.f32", "!0s, #0x!1h", 2),
    843     ENCODING_MAP(kThumb2Vmovd_IMM8,       0xeeb00b00,
    844                  kFmtDfp, 22, 12, kFmtFPImm, 16, 0, kFmtUnused, -1, -1,
    845                  kFmtUnused, -1, -1, IS_BINARY_OP | REG_DEF0,
    846                  "vmov.f64", "!0S, #0x!1h", 2),
    847     ENCODING_MAP(kThumb2Mla,  0xfb000000,
    848                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtBitBlt, 3, 0,
    849                  kFmtBitBlt, 15, 12,
    850                  IS_QUAD_OP | REG_DEF0 | REG_USE1 | REG_USE2 | REG_USE3,
    851                  "mla", "r!0d, r!1d, r!2d, r!3d", 2),
    852     ENCODING_MAP(kThumb2Umull,  0xfba00000,
    853                  kFmtBitBlt, 15, 12, kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16,
    854                  kFmtBitBlt, 3, 0,
    855                  IS_QUAD_OP | REG_DEF0 | REG_DEF1 | REG_USE2 | REG_USE3,
    856                  "umull", "r!0d, r!1d, r!2d, r!3d", 2),
    857     ENCODING_MAP(kThumb2Ldrex,       0xe8500f00,
    858                  kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16, kFmtBitBlt, 7, 0,
    859                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0_USE1 | IS_LOAD,
    860                  "ldrex", "r!0d, [r!1d, #!2E]", 2),
    861     ENCODING_MAP(kThumb2Strex,       0xe8400000,
    862                  kFmtBitBlt, 11, 8, kFmtBitBlt, 15, 12, kFmtBitBlt, 19, 16,
    863                  kFmtBitBlt, 7, 0, IS_QUAD_OP | REG_DEF0_USE12 | IS_STORE,
    864                  "strex", "r!0d,r!1d, [r!2d, #!2E]", 2),
    865     ENCODING_MAP(kThumb2Clrex,       0xf3bf8f2f,
    866                  kFmtUnused, -1, -1, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    867                  kFmtUnused, -1, -1, NO_OPERAND,
    868                  "clrex", "", 2),
    869     ENCODING_MAP(kThumb2Bfi,         0xf3600000,
    870                  kFmtBitBlt, 11, 8, kFmtBitBlt, 19, 16, kFmtShift5, -1, -1,
    871                  kFmtBitBlt, 4, 0, IS_QUAD_OP | REG_DEF0_USE1,
    872                  "bfi", "r!0d,r!1d,#!2d,#!3d", 2),
    873     ENCODING_MAP(kThumb2Bfc,         0xf36f0000,
    874                  kFmtBitBlt, 11, 8, kFmtShift5, -1, -1, kFmtBitBlt, 4, 0,
    875                  kFmtUnused, -1, -1, IS_TERTIARY_OP | REG_DEF0,
    876                  "bfc", "r!0d,#!1d,#!2d", 2),
    877     ENCODING_MAP(kThumb2Dmb,         0xf3bf8f50,
    878                  kFmtBitBlt, 3, 0, kFmtUnused, -1, -1, kFmtUnused, -1, -1,
    879                  kFmtUnused, -1, -1, IS_UNARY_OP,
    880                  "dmb","#!0B",2),
    881 };
    882 
    883 /*
    884  * The fake NOP of moving r0 to r0 actually will incur data stalls if r0 is
    885  * not ready. Since r5 (rFP) is not updated often, it is less likely to
    886  * generate unnecessary stall cycles.
    887  */
    888 #define PADDING_MOV_R5_R5               0x1C2D
    889 
    890 /* Track the number of times that the code cache is patched */
    891 #if defined(WITH_JIT_TUNING)
    892 #define UPDATE_CODE_CACHE_PATCHES()    (gDvmJit.codeCachePatches++)
    893 #else
    894 #define UPDATE_CODE_CACHE_PATCHES()
    895 #endif
    896 
    897 /* Write the numbers in the literal pool to the codegen stream */
    898 static void installDataContent(CompilationUnit *cUnit)
    899 {
    900     int *dataPtr = (int *) ((char *) cUnit->baseAddr + cUnit->dataOffset);
    901     ArmLIR *dataLIR = (ArmLIR *) cUnit->wordList;
    902     while (dataLIR) {
    903         *dataPtr++ = dataLIR->operands[0];
    904         dataLIR = NEXT_LIR(dataLIR);
    905     }
    906 }
    907 
    908 /* Returns the size of a Jit trace description */
    909 static int jitTraceDescriptionSize(const JitTraceDescription *desc)
    910 {
    911     int runCount;
    912     /* Trace end is always of non-meta type (ie isCode == true) */
    913     for (runCount = 0; ; runCount++) {
    914         if (desc->trace[runCount].frag.isCode &&
    915             desc->trace[runCount].frag.runEnd)
    916            break;
    917     }
    918     return sizeof(JitTraceDescription) + ((runCount+1) * sizeof(JitTraceRun));
    919 }
    920 
    921 /*
    922  * Assemble the LIR into binary instruction format.  Note that we may
    923  * discover that pc-relative displacements may not fit the selected
    924  * instruction.  In those cases we will try to substitute a new code
    925  * sequence or request that the trace be shortened and retried.
    926  */
    927 static AssemblerStatus assembleInstructions(CompilationUnit *cUnit,
    928                                             intptr_t startAddr)
    929 {
    930     short *bufferAddr = (short *) cUnit->codeBuffer;
    931     ArmLIR *lir;
    932 
    933     for (lir = (ArmLIR *) cUnit->firstLIRInsn; lir; lir = NEXT_LIR(lir)) {
    934         if (lir->opCode < 0) {
    935             if ((lir->opCode == kArmPseudoPseudoAlign4) &&
    936                 /* 1 means padding is needed */
    937                 (lir->operands[0] == 1)) {
    938                 *bufferAddr++ = PADDING_MOV_R5_R5;
    939             }
    940             continue;
    941         }
    942 
    943         if (lir->isNop) {
    944             continue;
    945         }
    946 
    947         if (lir->opCode == kThumbLdrPcRel ||
    948             lir->opCode == kThumb2LdrPcRel12 ||
    949             lir->opCode == kThumbAddPcRel ||
    950             ((lir->opCode == kThumb2Vldrs) && (lir->operands[1] == rpc))) {
    951             ArmLIR *lirTarget = (ArmLIR *) lir->generic.target;
    952             intptr_t pc = (lir->generic.offset + 4) & ~3;
    953             intptr_t target = lirTarget->generic.offset;
    954             int delta = target - pc;
    955             if (delta & 0x3) {
    956                 LOGE("PC-rel distance is not multiples of 4: %d\n", delta);
    957                 dvmCompilerAbort(cUnit);
    958             }
    959             if ((lir->opCode == kThumb2LdrPcRel12) && (delta > 4091)) {
    960                 return kRetryHalve;
    961             } else if (delta > 1020) {
    962                 return kRetryHalve;
    963             }
    964             if (lir->opCode == kThumb2Vldrs) {
    965                 lir->operands[2] = delta >> 2;
    966             } else {
    967                 lir->operands[1] = (lir->opCode == kThumb2LdrPcRel12) ?
    968                                     delta : delta >> 2;
    969             }
    970         } else if (lir->opCode == kThumb2Cbnz || lir->opCode == kThumb2Cbz) {
    971             ArmLIR *targetLIR = (ArmLIR *) lir->generic.target;
    972             intptr_t pc = lir->generic.offset + 4;
    973             intptr_t target = targetLIR->generic.offset;
    974             int delta = target - pc;
    975             if (delta > 126 || delta < 0) {
    976                 /* Convert to cmp rx,#0 / b[eq/ne] tgt pair */
    977                 ArmLIR *newInst = dvmCompilerNew(sizeof(ArmLIR), true);
    978                 /* Make new branch instruction and insert after */
    979                 newInst->opCode = kThumbBCond;
    980                 newInst->operands[0] = 0;
    981                 newInst->operands[1] = (lir->opCode == kThumb2Cbz) ?
    982                                         kArmCondEq : kArmCondNe;
    983                 newInst->generic.target = lir->generic.target;
    984                 dvmCompilerSetupResourceMasks(newInst);
    985                 dvmCompilerInsertLIRAfter((LIR *)lir, (LIR *)newInst);
    986                 /* Convert the cb[n]z to a cmp rx, #0 ] */
    987                 lir->opCode = kThumbCmpRI8;
    988                 /* operand[0] is src1 in both cb[n]z & CmpRI8 */
    989                 lir->operands[1] = 0;
    990                 lir->generic.target = 0;
    991                 dvmCompilerSetupResourceMasks(lir);
    992                 return kRetryAll;
    993             } else {
    994                 lir->operands[1] = delta >> 1;
    995             }
    996         } else if (lir->opCode == kThumbBCond ||
    997                    lir->opCode == kThumb2BCond) {
    998             ArmLIR *targetLIR = (ArmLIR *) lir->generic.target;
    999             intptr_t pc = lir->generic.offset + 4;
   1000             intptr_t target = targetLIR->generic.offset;
   1001             int delta = target - pc;
   1002             if ((lir->opCode == kThumbBCond) && (delta > 254 || delta < -256)) {
   1003                 return kRetryHalve;
   1004             }
   1005             lir->operands[0] = delta >> 1;
   1006         } else if (lir->opCode == kThumbBUncond) {
   1007             ArmLIR *targetLIR = (ArmLIR *) lir->generic.target;
   1008             intptr_t pc = lir->generic.offset + 4;
   1009             intptr_t target = targetLIR->generic.offset;
   1010             int delta = target - pc;
   1011             if (delta > 2046 || delta < -2048) {
   1012                 LOGE("Unconditional branch distance out of range: %d\n", delta);
   1013                 dvmCompilerAbort(cUnit);
   1014             }
   1015             lir->operands[0] = delta >> 1;
   1016         } else if (lir->opCode == kThumbBlx1) {
   1017             assert(NEXT_LIR(lir)->opCode == kThumbBlx2);
   1018             /* curPC is Thumb */
   1019             intptr_t curPC = (startAddr + lir->generic.offset + 4) & ~3;
   1020             intptr_t target = lir->operands[1];
   1021 
   1022             /* Match bit[1] in target with base */
   1023             if (curPC & 0x2) {
   1024                 target |= 0x2;
   1025             }
   1026             int delta = target - curPC;
   1027             assert((delta >= -(1<<22)) && (delta <= ((1<<22)-2)));
   1028 
   1029             lir->operands[0] = (delta >> 12) & 0x7ff;
   1030             NEXT_LIR(lir)->operands[0] = (delta>> 1) & 0x7ff;
   1031         }
   1032 
   1033         ArmEncodingMap *encoder = &EncodingMap[lir->opCode];
   1034         u4 bits = encoder->skeleton;
   1035         int i;
   1036         for (i = 0; i < 4; i++) {
   1037             u4 operand;
   1038             u4 value;
   1039             operand = lir->operands[i];
   1040             switch(encoder->fieldLoc[i].kind) {
   1041                 case kFmtUnused:
   1042                     break;
   1043                 case kFmtFPImm:
   1044                     value = ((operand & 0xF0) >> 4) << encoder->fieldLoc[i].end;
   1045                     value |= (operand & 0x0F) << encoder->fieldLoc[i].start;
   1046                     bits |= value;
   1047                     break;
   1048                 case kFmtBrOffset:
   1049                     value = ((operand  & 0x80000) >> 19) << 26;
   1050                     value |= ((operand & 0x40000) >> 18) << 11;
   1051                     value |= ((operand & 0x20000) >> 17) << 13;
   1052                     value |= ((operand & 0x1f800) >> 11) << 16;
   1053                     value |= (operand  & 0x007ff);
   1054                     bits |= value;
   1055                     break;
   1056                 case kFmtShift5:
   1057                     value = ((operand & 0x1c) >> 2) << 12;
   1058                     value |= (operand & 0x03) << 6;
   1059                     bits |= value;
   1060                     break;
   1061                 case kFmtShift:
   1062                     value = ((operand & 0x70) >> 4) << 12;
   1063                     value |= (operand & 0x0f) << 4;
   1064                     bits |= value;
   1065                     break;
   1066                 case kFmtBWidth:
   1067                     value = operand - 1;
   1068                     bits |= value;
   1069                     break;
   1070                 case kFmtLsb:
   1071                     value = ((operand & 0x1c) >> 2) << 12;
   1072                     value |= (operand & 0x03) << 6;
   1073                     bits |= value;
   1074                     break;
   1075                 case kFmtImm6:
   1076                     value = ((operand & 0x20) >> 5) << 9;
   1077                     value |= (operand & 0x1f) << 3;
   1078                     bits |= value;
   1079                     break;
   1080                 case kFmtBitBlt:
   1081                     value = (operand << encoder->fieldLoc[i].start) &
   1082                             ((1 << (encoder->fieldLoc[i].end + 1)) - 1);
   1083                     bits |= value;
   1084                     break;
   1085                 case kFmtDfp: {
   1086                     assert(DOUBLEREG(operand));
   1087                     assert((operand & 0x1) == 0);
   1088                     int regName = (operand & FP_REG_MASK) >> 1;
   1089                     /* Snag the 1-bit slice and position it */
   1090                     value = ((regName & 0x10) >> 4) <<
   1091                             encoder->fieldLoc[i].end;
   1092                     /* Extract and position the 4-bit slice */
   1093                     value |= (regName & 0x0f) <<
   1094                             encoder->fieldLoc[i].start;
   1095                     bits |= value;
   1096                     break;
   1097                 }
   1098                 case kFmtSfp:
   1099                     assert(SINGLEREG(operand));
   1100                     /* Snag the 1-bit slice and position it */
   1101                     value = (operand & 0x1) <<
   1102                             encoder->fieldLoc[i].end;
   1103                     /* Extract and position the 4-bit slice */
   1104                     value |= ((operand & 0x1e) >> 1) <<
   1105                             encoder->fieldLoc[i].start;
   1106                     bits |= value;
   1107                     break;
   1108                 case kFmtImm12:
   1109                 case kFmtModImm:
   1110                     value = ((operand & 0x800) >> 11) << 26;
   1111                     value |= ((operand & 0x700) >> 8) << 12;
   1112                     value |= operand & 0x0ff;
   1113                     bits |= value;
   1114                     break;
   1115                 case kFmtImm16:
   1116                     value = ((operand & 0x0800) >> 11) << 26;
   1117                     value |= ((operand & 0xf000) >> 12) << 16;
   1118                     value |= ((operand & 0x0700) >> 8) << 12;
   1119                     value |= operand & 0x0ff;
   1120                     bits |= value;
   1121                     break;
   1122                 default:
   1123                     assert(0);
   1124             }
   1125         }
   1126         if (encoder->size == 2) {
   1127             *bufferAddr++ = (bits >> 16) & 0xffff;
   1128         }
   1129         *bufferAddr++ = bits & 0xffff;
   1130     }
   1131     return kSuccess;
   1132 }
   1133 
   1134 #if defined(SIGNATURE_BREAKPOINT)
   1135 /* Inspect the assembled instruction stream to find potential matches */
   1136 static void matchSignatureBreakpoint(const CompilationUnit *cUnit,
   1137                                      unsigned int size)
   1138 {
   1139     unsigned int i, j;
   1140     u4 *ptr = (u4 *) cUnit->codeBuffer;
   1141 
   1142     for (i = 0; i < size - gDvmJit.signatureBreakpointSize + 1; i++) {
   1143         if (ptr[i] == gDvmJit.signatureBreakpoint[0]) {
   1144             for (j = 1; j < gDvmJit.signatureBreakpointSize; j++) {
   1145                 if (ptr[i+j] != gDvmJit.signatureBreakpoint[j]) {
   1146                     break;
   1147                 }
   1148             }
   1149             if (j == gDvmJit.signatureBreakpointSize) {
   1150                 LOGD("Signature match starting from offset %#x (%d words)",
   1151                      i*4, gDvmJit.signatureBreakpointSize);
   1152                 int descSize = jitTraceDescriptionSize(cUnit->traceDesc);
   1153                 JitTraceDescription *newCopy =
   1154                     (JitTraceDescription *) malloc(descSize);
   1155                 memcpy(newCopy, cUnit->traceDesc, descSize);
   1156                 dvmCompilerWorkEnqueue(NULL, kWorkOrderTraceDebug, newCopy);
   1157                 break;
   1158             }
   1159         }
   1160     }
   1161 }
   1162 #endif
   1163 
   1164 /*
   1165  * Translation layout in the code cache.  Note that the codeAddress pointer
   1166  * in JitTable will point directly to the code body (field codeAddress).  The
   1167  * chain cell offset codeAddress - 2, and (if present) executionCount is at
   1168  * codeAddress - 6.
   1169  *
   1170  *      +----------------------------+
   1171  *      | Execution count            |  -> [Optional] 4 bytes
   1172  *      +----------------------------+
   1173  *   +--| Offset to chain cell counts|  -> 2 bytes
   1174  *   |  +----------------------------+
   1175  *   |  | Code body                  |  -> Start address for translation
   1176  *   |  |                            |     variable in 2-byte chunks
   1177  *   |  .                            .     (JitTable's codeAddress points here)
   1178  *   |  .                            .
   1179  *   |  |                            |
   1180  *   |  +----------------------------+
   1181  *   |  | Chaining Cells             |  -> 12/16 bytes each, must be 4 byte aligned
   1182  *   |  .                            .
   1183  *   |  .                            .
   1184  *   |  |                            |
   1185  *   |  +----------------------------+
   1186  *   |  | Gap for large switch stmt  |  -> # cases >= MAX_CHAINED_SWITCH_CASES
   1187  *   |  +----------------------------+
   1188  *   +->| Chaining cell counts       |  -> 8 bytes, chain cell counts by type
   1189  *      +----------------------------+
   1190  *      | Trace description          |  -> variable sized
   1191  *      .                            .
   1192  *      |                            |
   1193  *      +----------------------------+
   1194  *      | Literal pool               |  -> 4-byte aligned, variable size
   1195  *      .                            .
   1196  *      .                            .
   1197  *      |                            |
   1198  *      +----------------------------+
   1199  *
   1200  * Go over each instruction in the list and calculate the offset from the top
   1201  * before sending them off to the assembler. If out-of-range branch distance is
   1202  * seen rearrange the instructions a bit to correct it.
   1203  */
   1204 void dvmCompilerAssembleLIR(CompilationUnit *cUnit, JitTranslationInfo *info)
   1205 {
   1206     LIR *lir;
   1207     ArmLIR *armLIR;
   1208     int offset = 0;
   1209     int i;
   1210     ChainCellCounts chainCellCounts;
   1211     int descSize =
   1212         cUnit->wholeMethod ? 0 : jitTraceDescriptionSize(cUnit->traceDesc);
   1213     int chainingCellGap;
   1214 
   1215     info->instructionSet = cUnit->instructionSet;
   1216 
   1217     /* Beginning offset needs to allow space for chain cell offset */
   1218     for (armLIR = (ArmLIR *) cUnit->firstLIRInsn;
   1219          armLIR;
   1220          armLIR = NEXT_LIR(armLIR)) {
   1221         armLIR->generic.offset = offset;
   1222         if (armLIR->opCode >= 0 && !armLIR->isNop) {
   1223             armLIR->size = EncodingMap[armLIR->opCode].size * 2;
   1224             offset += armLIR->size;
   1225         } else if (armLIR->opCode == kArmPseudoPseudoAlign4) {
   1226             if (offset & 0x2) {
   1227                 offset += 2;
   1228                 armLIR->operands[0] = 1;
   1229             } else {
   1230                 armLIR->operands[0] = 0;
   1231             }
   1232         }
   1233         /* Pseudo opcodes don't consume space */
   1234     }
   1235 
   1236     /* Const values have to be word aligned */
   1237     offset = (offset + 3) & ~3;
   1238 
   1239     /*
   1240      * Get the gap (# of u4) between the offset of chaining cell count and
   1241      * the bottom of real chaining cells. If the translation has chaining
   1242      * cells, the gap is guaranteed to be multiples of 4.
   1243      */
   1244     chainingCellGap = (offset - cUnit->chainingCellBottom->offset) >> 2;
   1245 
   1246     /* Add space for chain cell counts & trace description */
   1247     u4 chainCellOffset = offset;
   1248     ArmLIR *chainCellOffsetLIR = (ArmLIR *) cUnit->chainCellOffsetLIR;
   1249     assert(chainCellOffsetLIR);
   1250     assert(chainCellOffset < 0x10000);
   1251     assert(chainCellOffsetLIR->opCode == kArm16BitData &&
   1252            chainCellOffsetLIR->operands[0] == CHAIN_CELL_OFFSET_TAG);
   1253 
   1254     /*
   1255      * Replace the CHAIN_CELL_OFFSET_TAG with the real value. If trace
   1256      * profiling is enabled, subtract 4 (occupied by the counter word) from
   1257      * the absolute offset as the value stored in chainCellOffsetLIR is the
   1258      * delta from &chainCellOffsetLIR to &ChainCellCounts.
   1259      */
   1260     chainCellOffsetLIR->operands[0] =
   1261         gDvmJit.profile ? (chainCellOffset - 4) : chainCellOffset;
   1262 
   1263     offset += sizeof(chainCellCounts) + descSize;
   1264 
   1265     assert((offset & 0x3) == 0);  /* Should still be word aligned */
   1266 
   1267     /* Set up offsets for literals */
   1268     cUnit->dataOffset = offset;
   1269 
   1270     for (lir = cUnit->wordList; lir; lir = lir->next) {
   1271         lir->offset = offset;
   1272         offset += 4;
   1273     }
   1274 
   1275     cUnit->totalSize = offset;
   1276 
   1277     if (gDvmJit.codeCacheByteUsed + cUnit->totalSize > gDvmJit.codeCacheSize) {
   1278         gDvmJit.codeCacheFull = true;
   1279         cUnit->baseAddr = NULL;
   1280         return;
   1281     }
   1282 
   1283     /* Allocate enough space for the code block */
   1284     cUnit->codeBuffer = dvmCompilerNew(chainCellOffset, true);
   1285     if (cUnit->codeBuffer == NULL) {
   1286         LOGE("Code buffer allocation failure\n");
   1287         cUnit->baseAddr = NULL;
   1288         return;
   1289     }
   1290 
   1291     /*
   1292      * Attempt to assemble the trace.  Note that assembleInstructions
   1293      * may rewrite the code sequence and request a retry.
   1294      */
   1295     cUnit->assemblerStatus = assembleInstructions(cUnit,
   1296           (intptr_t) gDvmJit.codeCache + gDvmJit.codeCacheByteUsed);
   1297 
   1298     switch(cUnit->assemblerStatus) {
   1299         case kSuccess:
   1300             break;
   1301         case kRetryAll:
   1302             if (cUnit->assemblerRetries < MAX_ASSEMBLER_RETRIES) {
   1303                 /* Restore pristine chain cell marker on retry */
   1304                 chainCellOffsetLIR->operands[0] = CHAIN_CELL_OFFSET_TAG;
   1305                 return;
   1306             }
   1307             /* Too many retries - reset and try cutting the trace in half */
   1308             cUnit->assemblerRetries = 0;
   1309             cUnit->assemblerStatus = kRetryHalve;
   1310             return;
   1311         case kRetryHalve:
   1312             return;
   1313         default:
   1314              LOGE("Unexpected assembler status: %d", cUnit->assemblerStatus);
   1315              dvmAbort();
   1316     }
   1317 
   1318 #if defined(SIGNATURE_BREAKPOINT)
   1319     if (info->discardResult == false && gDvmJit.signatureBreakpoint != NULL &&
   1320         chainCellOffset/4 >= gDvmJit.signatureBreakpointSize) {
   1321         matchSignatureBreakpoint(cUnit, chainCellOffset/4);
   1322     }
   1323 #endif
   1324 
   1325     /* Don't go all the way if the goal is just to get the verbose output */
   1326     if (info->discardResult) return;
   1327 
   1328     cUnit->baseAddr = (char *) gDvmJit.codeCache + gDvmJit.codeCacheByteUsed;
   1329     gDvmJit.codeCacheByteUsed += offset;
   1330 
   1331     UNPROTECT_CODE_CACHE(cUnit->baseAddr, offset);
   1332 
   1333     /* Install the code block */
   1334     memcpy((char*)cUnit->baseAddr, cUnit->codeBuffer, chainCellOffset);
   1335     gDvmJit.numCompilations++;
   1336 
   1337     /* Install the chaining cell counts */
   1338     for (i=0; i< kChainingCellGap; i++) {
   1339         chainCellCounts.u.count[i] = cUnit->numChainingCells[i];
   1340     }
   1341 
   1342     /* Set the gap number in the chaining cell count structure */
   1343     chainCellCounts.u.count[kChainingCellGap] = chainingCellGap;
   1344 
   1345     memcpy((char*)cUnit->baseAddr + chainCellOffset, &chainCellCounts,
   1346            sizeof(chainCellCounts));
   1347 
   1348     /* Install the trace description */
   1349     memcpy((char*)cUnit->baseAddr + chainCellOffset + sizeof(chainCellCounts),
   1350            cUnit->traceDesc, descSize);
   1351 
   1352     /* Write the literals directly into the code cache */
   1353     installDataContent(cUnit);
   1354 
   1355     /* Flush dcache and invalidate the icache to maintain coherence */
   1356     cacheflush((long)cUnit->baseAddr,
   1357                (long)((char *) cUnit->baseAddr + offset), 0);
   1358     UPDATE_CODE_CACHE_PATCHES();
   1359 
   1360     PROTECT_CODE_CACHE(cUnit->baseAddr, offset);
   1361 
   1362     /* Record code entry point and instruction set */
   1363     info->codeAddress = (char*)cUnit->baseAddr + cUnit->headerSize;
   1364     /* If applicable, mark low bit to denote thumb */
   1365     if (info->instructionSet != DALVIK_JIT_ARM)
   1366         info->codeAddress = (char*)info->codeAddress + 1;
   1367 }
   1368 
   1369 /*
   1370  * Returns the skeleton bit pattern associated with an opcode.  All
   1371  * variable fields are zeroed.
   1372  */
   1373 static u4 getSkeleton(ArmOpCode op)
   1374 {
   1375     return EncodingMap[op].skeleton;
   1376 }
   1377 
   1378 static u4 assembleChainingBranch(int branchOffset, bool thumbTarget)
   1379 {
   1380     u4 thumb1, thumb2;
   1381 
   1382     if (!thumbTarget) {
   1383         thumb1 =  (getSkeleton(kThumbBlx1) | ((branchOffset>>12) & 0x7ff));
   1384         thumb2 =  (getSkeleton(kThumbBlx2) | ((branchOffset>> 1) & 0x7ff));
   1385     } else if ((branchOffset < -2048) | (branchOffset > 2046)) {
   1386         thumb1 =  (getSkeleton(kThumbBl1) | ((branchOffset>>12) & 0x7ff));
   1387         thumb2 =  (getSkeleton(kThumbBl2) | ((branchOffset>> 1) & 0x7ff));
   1388     } else {
   1389         thumb1 =  (getSkeleton(kThumbBUncond) | ((branchOffset>> 1) & 0x7ff));
   1390         thumb2 =  getSkeleton(kThumbOrr);  /* nop -> or r0, r0 */
   1391     }
   1392 
   1393     return thumb2<<16 | thumb1;
   1394 }
   1395 
   1396 /*
   1397  * Perform translation chain operation.
   1398  * For ARM, we'll use a pair of thumb instructions to generate
   1399  * an unconditional chaining branch of up to 4MB in distance.
   1400  * Use a BL, because the generic "interpret" translation needs
   1401  * the link register to find the dalvik pc of teh target.
   1402  *     111HHooooooooooo
   1403  * Where HH is 10 for the 1st inst, and 11 for the second and
   1404  * the "o" field is each instruction's 11-bit contribution to the
   1405  * 22-bit branch offset.
   1406  * If the target is nearby, use a single-instruction bl.
   1407  * If one or more threads is suspended, don't chain.
   1408  */
   1409 void* dvmJitChain(void* tgtAddr, u4* branchAddr)
   1410 {
   1411     int baseAddr = (u4) branchAddr + 4;
   1412     int branchOffset = (int) tgtAddr - baseAddr;
   1413     u4 newInst;
   1414     bool thumbTarget;
   1415 
   1416     /*
   1417      * Only chain translations when there is no urge to ask all threads to
   1418      * suspend themselves via the interpreter.
   1419      */
   1420     if ((gDvmJit.pProfTable != NULL) && (gDvm.sumThreadSuspendCount == 0) &&
   1421         (gDvmJit.codeCacheFull == false)) {
   1422         assert((branchOffset >= -(1<<22)) && (branchOffset <= ((1<<22)-2)));
   1423 
   1424         gDvmJit.translationChains++;
   1425 
   1426         COMPILER_TRACE_CHAINING(
   1427             LOGD("Jit Runtime: chaining 0x%x to 0x%x\n",
   1428                  (int) branchAddr, (int) tgtAddr & -2));
   1429 
   1430         /*
   1431          * NOTE: normally, all translations are Thumb[2] mode, with
   1432          * a single exception: the default TEMPLATE_INTERPRET
   1433          * pseudo-translation.  If the need ever arises to
   1434          * mix Arm & Thumb[2] translations, the following code should be
   1435          * generalized.
   1436          */
   1437         thumbTarget = (tgtAddr != dvmCompilerGetInterpretTemplate());
   1438 
   1439         newInst = assembleChainingBranch(branchOffset, thumbTarget);
   1440 
   1441         /*
   1442          * The second half-word instruction of the chaining cell must
   1443          * either be a nop (which represents initial state), or is the
   1444          * same exact branch halfword that we are trying to install.
   1445          */
   1446         assert( ((*branchAddr >> 16) == getSkeleton(kThumbOrr)) ||
   1447                 ((*branchAddr >> 16) == (newInst >> 16)));
   1448 
   1449         UNPROTECT_CODE_CACHE(branchAddr, sizeof(*branchAddr));
   1450 
   1451         *branchAddr = newInst;
   1452         cacheflush((long)branchAddr, (long)branchAddr + 4, 0);
   1453         UPDATE_CODE_CACHE_PATCHES();
   1454 
   1455         PROTECT_CODE_CACHE(branchAddr, sizeof(*branchAddr));
   1456 
   1457         gDvmJit.hasNewChain = true;
   1458     }
   1459 
   1460     return tgtAddr;
   1461 }
   1462 
   1463 #if !defined(WITH_SELF_VERIFICATION)
   1464 /*
   1465  * Attempt to enqueue a work order to patch an inline cache for a predicted
   1466  * chaining cell for virtual/interface calls.
   1467  */
   1468 static void inlineCachePatchEnqueue(PredictedChainingCell *cellAddr,
   1469                                     PredictedChainingCell *newContent)
   1470 {
   1471     /*
   1472      * Make sure only one thread gets here since updating the cell (ie fast
   1473      * path and queueing the request (ie the queued path) have to be done
   1474      * in an atomic fashion.
   1475      */
   1476     dvmLockMutex(&gDvmJit.compilerICPatchLock);
   1477 
   1478     /* Fast path for uninitialized chaining cell */
   1479     if (cellAddr->clazz == NULL &&
   1480         cellAddr->branch == PREDICTED_CHAIN_BX_PAIR_INIT) {
   1481 
   1482         UNPROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1483 
   1484         cellAddr->method = newContent->method;
   1485         cellAddr->branch = newContent->branch;
   1486         /*
   1487          * The update order matters - make sure clazz is updated last since it
   1488          * will bring the uninitialized chaining cell to life.
   1489          */
   1490         android_atomic_release_store((int32_t)newContent->clazz,
   1491             (void*) &cellAddr->clazz);
   1492         cacheflush((intptr_t) cellAddr, (intptr_t) (cellAddr+1), 0);
   1493         UPDATE_CODE_CACHE_PATCHES();
   1494 
   1495         PROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1496 
   1497 #if defined(WITH_JIT_TUNING)
   1498         gDvmJit.icPatchInit++;
   1499 #endif
   1500     /* Check if this is a frequently missed clazz */
   1501     } else if (cellAddr->stagedClazz != newContent->clazz) {
   1502         /* Not proven to be frequent yet - build up the filter cache */
   1503         UNPROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1504 
   1505         cellAddr->stagedClazz = newContent->clazz;
   1506 
   1507         UPDATE_CODE_CACHE_PATCHES();
   1508         PROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1509 
   1510 #if defined(WITH_JIT_TUNING)
   1511         gDvmJit.icPatchRejected++;
   1512 #endif
   1513     /*
   1514      * Different classes but same method implementation - it is safe to just
   1515      * patch the class value without the need to stop the world.
   1516      */
   1517     } else if (cellAddr->method == newContent->method) {
   1518         UNPROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1519 
   1520         cellAddr->clazz = newContent->clazz;
   1521         /* No need to flush the cache here since the branch is not patched */
   1522         UPDATE_CODE_CACHE_PATCHES();
   1523 
   1524         PROTECT_CODE_CACHE(cellAddr, sizeof(*cellAddr));
   1525 
   1526 #if defined(WITH_JIT_TUNING)
   1527         gDvmJit.icPatchLockFree++;
   1528 #endif
   1529     /*
   1530      * Cannot patch the chaining cell inline - queue it until the next safe
   1531      * point.
   1532      */
   1533     } else if (gDvmJit.compilerICPatchIndex < COMPILER_IC_PATCH_QUEUE_SIZE) {
   1534         int index = gDvmJit.compilerICPatchIndex++;
   1535         gDvmJit.compilerICPatchQueue[index].cellAddr = cellAddr;
   1536         gDvmJit.compilerICPatchQueue[index].cellContent = *newContent;
   1537 #if defined(WITH_JIT_TUNING)
   1538         gDvmJit.icPatchQueued++;
   1539 #endif
   1540     } else {
   1541     /* Queue is full - just drop this patch request */
   1542 #if defined(WITH_JIT_TUNING)
   1543         gDvmJit.icPatchDropped++;
   1544 #endif
   1545     }
   1546 
   1547     dvmUnlockMutex(&gDvmJit.compilerICPatchLock);
   1548 }
   1549 #endif
   1550 
   1551 /*
   1552  * This method is called from the invoke templates for virtual and interface
   1553  * methods to speculatively setup a chain to the callee. The templates are
   1554  * written in assembly and have setup method, cell, and clazz at r0, r2, and
   1555  * r3 respectively, so there is a unused argument in the list. Upon return one
   1556  * of the following three results may happen:
   1557  *   1) Chain is not setup because the callee is native. Reset the rechain
   1558  *      count to a big number so that it will take a long time before the next
   1559  *      rechain attempt to happen.
   1560  *   2) Chain is not setup because the callee has not been created yet. Reset
   1561  *      the rechain count to a small number and retry in the near future.
   1562  *   3) Ask all other threads to stop before patching this chaining cell.
   1563  *      This is required because another thread may have passed the class check
   1564  *      but hasn't reached the chaining cell yet to follow the chain. If we
   1565  *      patch the content before halting the other thread, there could be a
   1566  *      small window for race conditions to happen that it may follow the new
   1567  *      but wrong chain to invoke a different method.
   1568  */
   1569 const Method *dvmJitToPatchPredictedChain(const Method *method,
   1570                                           InterpState *interpState,
   1571                                           PredictedChainingCell *cell,
   1572                                           const ClassObject *clazz)
   1573 {
   1574     int newRechainCount = PREDICTED_CHAIN_COUNTER_RECHAIN;
   1575 #if defined(WITH_SELF_VERIFICATION)
   1576     newRechainCount = PREDICTED_CHAIN_COUNTER_AVOID;
   1577     goto done;
   1578 #else
   1579     if (dvmIsNativeMethod(method)) {
   1580         UNPROTECT_CODE_CACHE(cell, sizeof(*cell));
   1581 
   1582         /*
   1583          * Put a non-zero/bogus value in the clazz field so that it won't
   1584          * trigger immediate patching and will continue to fail to match with
   1585          * a real clazz pointer.
   1586          */
   1587         cell->clazz = (void *) PREDICTED_CHAIN_FAKE_CLAZZ;
   1588 
   1589         UPDATE_CODE_CACHE_PATCHES();
   1590         PROTECT_CODE_CACHE(cell, sizeof(*cell));
   1591         goto done;
   1592     }
   1593     int tgtAddr = (int) dvmJitGetCodeAddr(method->insns);
   1594 
   1595     /*
   1596      * Compilation not made yet for the callee. Reset the counter to a small
   1597      * value and come back to check soon.
   1598      */
   1599     if ((tgtAddr == 0) ||
   1600         ((void*)tgtAddr == dvmCompilerGetInterpretTemplate())) {
   1601         COMPILER_TRACE_CHAINING(
   1602             LOGD("Jit Runtime: predicted chain %p to method %s%s delayed",
   1603                  cell, method->clazz->descriptor, method->name));
   1604         goto done;
   1605     }
   1606 
   1607     PredictedChainingCell newCell;
   1608 
   1609     if (cell->clazz == NULL) {
   1610         newRechainCount = interpState->icRechainCount;
   1611     }
   1612 
   1613     int baseAddr = (int) cell + 4;   // PC is cur_addr + 4
   1614     int branchOffset = tgtAddr - baseAddr;
   1615 
   1616     newCell.branch = assembleChainingBranch(branchOffset, true);
   1617     newCell.clazz = clazz;
   1618     newCell.method = method;
   1619 
   1620     /*
   1621      * Enter the work order to the queue and the chaining cell will be patched
   1622      * the next time a safe point is entered.
   1623      *
   1624      * If the enqueuing fails reset the rechain count to a normal value so that
   1625      * it won't get indefinitely delayed.
   1626      */
   1627     inlineCachePatchEnqueue(cell, &newCell);
   1628 #endif
   1629 done:
   1630     interpState->icRechainCount = newRechainCount;
   1631     return method;
   1632 }
   1633 
   1634 /*
   1635  * Patch the inline cache content based on the content passed from the work
   1636  * order.
   1637  */
   1638 void dvmCompilerPatchInlineCache(void)
   1639 {
   1640     int i;
   1641     PredictedChainingCell *minAddr, *maxAddr;
   1642 
   1643     /* Nothing to be done */
   1644     if (gDvmJit.compilerICPatchIndex == 0) return;
   1645 
   1646     /*
   1647      * Since all threads are already stopped we don't really need to acquire
   1648      * the lock. But race condition can be easily introduced in the future w/o
   1649      * paying attention so we still acquire the lock here.
   1650      */
   1651     dvmLockMutex(&gDvmJit.compilerICPatchLock);
   1652 
   1653     UNPROTECT_CODE_CACHE(gDvmJit.codeCache, gDvmJit.codeCacheByteUsed);
   1654 
   1655     //LOGD("Number of IC patch work orders: %d", gDvmJit.compilerICPatchIndex);
   1656 
   1657     /* Initialize the min/max address range */
   1658     minAddr = (PredictedChainingCell *)
   1659         ((char *) gDvmJit.codeCache + gDvmJit.codeCacheSize);
   1660     maxAddr = (PredictedChainingCell *) gDvmJit.codeCache;
   1661 
   1662     for (i = 0; i < gDvmJit.compilerICPatchIndex; i++) {
   1663         PredictedChainingCell *cellAddr =
   1664             gDvmJit.compilerICPatchQueue[i].cellAddr;
   1665         PredictedChainingCell *cellContent =
   1666             &gDvmJit.compilerICPatchQueue[i].cellContent;
   1667 
   1668         COMPILER_TRACE_CHAINING(
   1669             LOGD("Jit Runtime: predicted chain %p from %s to %s (%s) "
   1670                  "patched",
   1671                  cellAddr,
   1672                  cellAddr->clazz->descriptor,
   1673                  cellContent->clazz->descriptor,
   1674                  cellContent->method->name));
   1675 
   1676         /* Patch the chaining cell */
   1677         *cellAddr = *cellContent;
   1678         minAddr = (cellAddr < minAddr) ? cellAddr : minAddr;
   1679         maxAddr = (cellAddr > maxAddr) ? cellAddr : maxAddr;
   1680     }
   1681 
   1682     /* Then synchronize the I/D cache */
   1683     cacheflush((long) minAddr, (long) (maxAddr+1), 0);
   1684     UPDATE_CODE_CACHE_PATCHES();
   1685 
   1686     PROTECT_CODE_CACHE(gDvmJit.codeCache, gDvmJit.codeCacheByteUsed);
   1687 
   1688     gDvmJit.compilerICPatchIndex = 0;
   1689     dvmUnlockMutex(&gDvmJit.compilerICPatchLock);
   1690 }
   1691 
   1692 /*
   1693  * Unchain a trace given the starting address of the translation
   1694  * in the code cache.  Refer to the diagram in dvmCompilerAssembleLIR.
   1695  * Returns the address following the last cell unchained.  Note that
   1696  * the incoming codeAddr is a thumb code address, and therefore has
   1697  * the low bit set.
   1698  */
   1699 u4* dvmJitUnchain(void* codeAddr)
   1700 {
   1701     u2* pChainCellOffset = (u2*)((char*)codeAddr - 3);
   1702     u2 chainCellOffset = *pChainCellOffset;
   1703     ChainCellCounts *pChainCellCounts =
   1704           (ChainCellCounts*)((char*)codeAddr + chainCellOffset - 3);
   1705     int cellSize;
   1706     u4* pChainCells;
   1707     u4* pStart;
   1708     u4 newInst;
   1709     int i,j;
   1710     PredictedChainingCell *predChainCell;
   1711 
   1712     /* Get total count of chain cells */
   1713     for (i = 0, cellSize = 0; i < kChainingCellGap; i++) {
   1714         if (i != kChainingCellInvokePredicted) {
   1715             cellSize += pChainCellCounts->u.count[i] * (CHAIN_CELL_NORMAL_SIZE >> 2);
   1716         } else {
   1717             cellSize += pChainCellCounts->u.count[i] *
   1718                 (CHAIN_CELL_PREDICTED_SIZE >> 2);
   1719         }
   1720     }
   1721 
   1722     if (cellSize == 0)
   1723         return (u4 *) pChainCellCounts;
   1724 
   1725     /* Locate the beginning of the chain cell region */
   1726     pStart = pChainCells = ((u4 *) pChainCellCounts) - cellSize -
   1727              pChainCellCounts->u.count[kChainingCellGap];
   1728 
   1729     /* The cells are sorted in order - walk through them and reset */
   1730     for (i = 0; i < kChainingCellGap; i++) {
   1731         int elemSize = CHAIN_CELL_NORMAL_SIZE >> 2;  /* In 32-bit words */
   1732         if (i == kChainingCellInvokePredicted) {
   1733             elemSize = CHAIN_CELL_PREDICTED_SIZE >> 2;
   1734         }
   1735 
   1736         for (j = 0; j < pChainCellCounts->u.count[i]; j++) {
   1737             switch(i) {
   1738                 case kChainingCellNormal:
   1739                 case kChainingCellHot:
   1740                 case kChainingCellInvokeSingleton:
   1741                 case kChainingCellBackwardBranch:
   1742                     /*
   1743                      * Replace the 1st half-word of the cell with an
   1744                      * unconditional branch, leaving the 2nd half-word
   1745                      * untouched.  This avoids problems with a thread
   1746                      * that is suspended between the two halves when
   1747                      * this unchaining takes place.
   1748                      */
   1749                     newInst = *pChainCells;
   1750                     newInst &= 0xFFFF0000;
   1751                     newInst |= getSkeleton(kThumbBUncond); /* b offset is 0 */
   1752                     *pChainCells = newInst;
   1753                     break;
   1754                 case kChainingCellInvokePredicted:
   1755                     predChainCell = (PredictedChainingCell *) pChainCells;
   1756                     /*
   1757                      * There could be a race on another mutator thread to use
   1758                      * this particular predicted cell and the check has passed
   1759                      * the clazz comparison. So we cannot safely wipe the
   1760                      * method and branch but it is safe to clear the clazz,
   1761                      * which serves as the key.
   1762                      */
   1763                     predChainCell->clazz = PREDICTED_CHAIN_CLAZZ_INIT;
   1764                     break;
   1765                 default:
   1766                     LOGE("Unexpected chaining type: %d", i);
   1767                     dvmAbort();  // dvmAbort OK here - can't safely recover
   1768             }
   1769             COMPILER_TRACE_CHAINING(
   1770                 LOGD("Jit Runtime: unchaining 0x%x", (int)pChainCells));
   1771             pChainCells += elemSize;  /* Advance by a fixed number of words */
   1772         }
   1773     }
   1774     return pChainCells;
   1775 }
   1776 
   1777 /* Unchain all translation in the cache. */
   1778 void dvmJitUnchainAll()
   1779 {
   1780     u4* lowAddress = NULL;
   1781     u4* highAddress = NULL;
   1782     unsigned int i;
   1783     if (gDvmJit.pJitEntryTable != NULL) {
   1784         COMPILER_TRACE_CHAINING(LOGD("Jit Runtime: unchaining all"));
   1785         dvmLockMutex(&gDvmJit.tableLock);
   1786 
   1787         UNPROTECT_CODE_CACHE(gDvmJit.codeCache, gDvmJit.codeCacheByteUsed);
   1788 
   1789         for (i = 0; i < gDvmJit.jitTableSize; i++) {
   1790             if (gDvmJit.pJitEntryTable[i].dPC &&
   1791                    gDvmJit.pJitEntryTable[i].codeAddress &&
   1792                    (gDvmJit.pJitEntryTable[i].codeAddress !=
   1793                     dvmCompilerGetInterpretTemplate())) {
   1794                 u4* lastAddress;
   1795                 lastAddress =
   1796                       dvmJitUnchain(gDvmJit.pJitEntryTable[i].codeAddress);
   1797                 if (lowAddress == NULL ||
   1798                       (u4*)gDvmJit.pJitEntryTable[i].codeAddress < lowAddress)
   1799                     lowAddress = lastAddress;
   1800                 if (lastAddress > highAddress)
   1801                     highAddress = lastAddress;
   1802             }
   1803         }
   1804         cacheflush((long)lowAddress, (long)highAddress, 0);
   1805         UPDATE_CODE_CACHE_PATCHES();
   1806 
   1807         PROTECT_CODE_CACHE(gDvmJit.codeCache, gDvmJit.codeCacheByteUsed);
   1808 
   1809         dvmUnlockMutex(&gDvmJit.tableLock);
   1810         gDvmJit.translationChains = 0;
   1811     }
   1812     gDvmJit.hasNewChain = false;
   1813 }
   1814 
   1815 typedef struct jitProfileAddrToLine {
   1816     u4 lineNum;
   1817     u4 bytecodeOffset;
   1818 } jitProfileAddrToLine;
   1819 
   1820 
   1821 /* Callback function to track the bytecode offset/line number relationiship */
   1822 static int addrToLineCb (void *cnxt, u4 bytecodeOffset, u4 lineNum)
   1823 {
   1824     jitProfileAddrToLine *addrToLine = (jitProfileAddrToLine *) cnxt;
   1825 
   1826     /* Best match so far for this offset */
   1827     if (addrToLine->bytecodeOffset >= bytecodeOffset) {
   1828         addrToLine->lineNum = lineNum;
   1829     }
   1830     return 0;
   1831 }
   1832 
   1833 static char *getTraceBase(const JitEntry *p)
   1834 {
   1835     return (char*)p->codeAddress -
   1836         (6 + (p->u.info.instructionSet == DALVIK_JIT_ARM ? 0 : 1));
   1837 }
   1838 
   1839 /* Dumps profile info for a single trace */
   1840 static int dumpTraceProfile(JitEntry *p, bool silent, bool reset,
   1841                             unsigned long sum)
   1842 {
   1843     ChainCellCounts* pCellCounts;
   1844     char* traceBase;
   1845     u4* pExecutionCount;
   1846     u4 executionCount;
   1847     u2* pCellOffset;
   1848     JitTraceDescription *desc;
   1849     const Method* method;
   1850     int idx;
   1851 
   1852     traceBase = getTraceBase(p);
   1853 
   1854     if (p->codeAddress == NULL) {
   1855         if (!silent)
   1856             LOGD("TRACEPROFILE 0x%08x 0 NULL 0 0", (int)traceBase);
   1857         return 0;
   1858     }
   1859     if (p->codeAddress == dvmCompilerGetInterpretTemplate()) {
   1860         if (!silent)
   1861             LOGD("TRACEPROFILE 0x%08x 0 INTERPRET_ONLY  0 0", (int)traceBase);
   1862         return 0;
   1863     }
   1864 
   1865     pExecutionCount = (u4*) (traceBase);
   1866     executionCount = *pExecutionCount;
   1867     if (reset) {
   1868         *pExecutionCount =0;
   1869     }
   1870     if (silent) {
   1871         return executionCount;
   1872     }
   1873     pCellOffset = (u2*) (traceBase + 4);
   1874     pCellCounts = (ChainCellCounts*) ((char *)pCellOffset + *pCellOffset);
   1875     desc = (JitTraceDescription*) ((char*)pCellCounts + sizeof(*pCellCounts));
   1876     method = desc->method;
   1877     char *methodDesc = dexProtoCopyMethodDescriptor(&method->prototype);
   1878     jitProfileAddrToLine addrToLine = {0, desc->trace[0].frag.startOffset};
   1879 
   1880     /*
   1881      * We may end up decoding the debug information for the same method
   1882      * multiple times, but the tradeoff is we don't need to allocate extra
   1883      * space to store the addr/line mapping. Since this is a debugging feature
   1884      * and done infrequently so the slower but simpler mechanism should work
   1885      * just fine.
   1886      */
   1887     dexDecodeDebugInfo(method->clazz->pDvmDex->pDexFile,
   1888                        dvmGetMethodCode(method),
   1889                        method->clazz->descriptor,
   1890                        method->prototype.protoIdx,
   1891                        method->accessFlags,
   1892                        addrToLineCb, NULL, &addrToLine);
   1893 
   1894     LOGD("TRACEPROFILE 0x%08x % 10d %5.2f%% [%#x(+%d), %d] %s%s;%s",
   1895          (int)traceBase,
   1896          executionCount,
   1897          ((float ) executionCount) / sum * 100.0,
   1898          desc->trace[0].frag.startOffset,
   1899          desc->trace[0].frag.numInsts,
   1900          addrToLine.lineNum,
   1901          method->clazz->descriptor, method->name, methodDesc);
   1902     free(methodDesc);
   1903 
   1904     /* Find the last fragment (ie runEnd is set) */
   1905     for (idx = 0;
   1906          desc->trace[idx].frag.isCode && !desc->trace[idx].frag.runEnd;
   1907          idx++) {
   1908     }
   1909 
   1910     /*
   1911      * runEnd must comes with a JitCodeDesc frag. If isCode is false it must
   1912      * be a meta info field (only used by callsite info for now).
   1913      */
   1914     if (!desc->trace[idx].frag.isCode) {
   1915         const Method *method = desc->trace[idx+1].meta;
   1916         char *methodDesc = dexProtoCopyMethodDescriptor(&method->prototype);
   1917         /* Print the callee info in the trace */
   1918         LOGD("    -> %s%s;%s", method->clazz->descriptor, method->name,
   1919              methodDesc);
   1920     }
   1921 
   1922     return executionCount;
   1923 }
   1924 
   1925 /* Create a copy of the trace descriptor of an existing compilation */
   1926 JitTraceDescription *dvmCopyTraceDescriptor(const u2 *pc,
   1927                                             const JitEntry *knownEntry)
   1928 {
   1929     const JitEntry *jitEntry = knownEntry ? knownEntry : dvmFindJitEntry(pc);
   1930     if (jitEntry == NULL) return NULL;
   1931 
   1932     /* Find out the startint point */
   1933     char *traceBase = getTraceBase(jitEntry);
   1934 
   1935     /* Then find out the starting point of the chaining cell */
   1936     u2 *pCellOffset = (u2*) (traceBase + 4);
   1937     ChainCellCounts *pCellCounts =
   1938         (ChainCellCounts*) ((char *)pCellOffset + *pCellOffset);
   1939 
   1940     /* From there we can find out the starting point of the trace descriptor */
   1941     JitTraceDescription *desc =
   1942         (JitTraceDescription*) ((char*)pCellCounts + sizeof(*pCellCounts));
   1943 
   1944     /* Now make a copy and return */
   1945     int descSize = jitTraceDescriptionSize(desc);
   1946     JitTraceDescription *newCopy = (JitTraceDescription *) malloc(descSize);
   1947     memcpy(newCopy, desc, descSize);
   1948     return newCopy;
   1949 }
   1950 
   1951 /* Handy function to retrieve the profile count */
   1952 static inline int getProfileCount(const JitEntry *entry)
   1953 {
   1954     if (entry->dPC == 0 || entry->codeAddress == 0 ||
   1955         entry->codeAddress == dvmCompilerGetInterpretTemplate())
   1956         return 0;
   1957 
   1958     u4 *pExecutionCount = (u4 *) getTraceBase(entry);
   1959 
   1960     return *pExecutionCount;
   1961 }
   1962 
   1963 
   1964 /* qsort callback function */
   1965 static int sortTraceProfileCount(const void *entry1, const void *entry2)
   1966 {
   1967     const JitEntry *jitEntry1 = entry1;
   1968     const JitEntry *jitEntry2 = entry2;
   1969 
   1970     int count1 = getProfileCount(jitEntry1);
   1971     int count2 = getProfileCount(jitEntry2);
   1972     return (count1 == count2) ? 0 : ((count1 > count2) ? -1 : 1);
   1973 }
   1974 
   1975 /* Sort the trace profile counts and dump them */
   1976 void dvmCompilerSortAndPrintTraceProfiles()
   1977 {
   1978     JitEntry *sortedEntries;
   1979     int numTraces = 0;
   1980     unsigned long sum = 0;
   1981     unsigned int i;
   1982 
   1983     /* Make sure that the table is not changing */
   1984     dvmLockMutex(&gDvmJit.tableLock);
   1985 
   1986     /* Sort the entries by descending order */
   1987     sortedEntries = malloc(sizeof(JitEntry) * gDvmJit.jitTableSize);
   1988     if (sortedEntries == NULL)
   1989         goto done;
   1990     memcpy(sortedEntries, gDvmJit.pJitEntryTable,
   1991            sizeof(JitEntry) * gDvmJit.jitTableSize);
   1992     qsort(sortedEntries, gDvmJit.jitTableSize, sizeof(JitEntry),
   1993           sortTraceProfileCount);
   1994 
   1995     /* Analyze the sorted entries */
   1996     for (i=0; i < gDvmJit.jitTableSize; i++) {
   1997         if (sortedEntries[i].dPC != 0) {
   1998             sum += dumpTraceProfile(&sortedEntries[i],
   1999                                        true /* silent */,
   2000                                        false /* reset */,
   2001                                        0);
   2002             numTraces++;
   2003         }
   2004     }
   2005     if (numTraces == 0)
   2006         numTraces = 1;
   2007     if (sum == 0) {
   2008         sum = 1;
   2009     }
   2010 
   2011     LOGD("JIT: Average execution count -> %d",(int)(sum / numTraces));
   2012 
   2013     /* Dump the sorted entries. The count of each trace will be reset to 0. */
   2014     for (i=0; i < gDvmJit.jitTableSize; i++) {
   2015         if (sortedEntries[i].dPC != 0) {
   2016             dumpTraceProfile(&sortedEntries[i],
   2017                              false /* silent */,
   2018                              true /* reset */,
   2019                              sum);
   2020         }
   2021     }
   2022 
   2023     for (i=0; i < gDvmJit.jitTableSize && i < 10; i++) {
   2024         /* Stip interpreter stubs */
   2025         if (sortedEntries[i].codeAddress == dvmCompilerGetInterpretTemplate()) {
   2026             continue;
   2027         }
   2028         JitTraceDescription* desc =
   2029             dvmCopyTraceDescriptor(NULL, &sortedEntries[i]);
   2030         dvmCompilerWorkEnqueue(sortedEntries[i].dPC,
   2031                                kWorkOrderTraceDebug, desc);
   2032     }
   2033 
   2034     free(sortedEntries);
   2035 done:
   2036     dvmUnlockMutex(&gDvmJit.tableLock);
   2037     return;
   2038 }
   2039 
   2040 #if defined(WITH_SELF_VERIFICATION)
   2041 /*
   2042  * The following are used to keep compiled loads and stores from modifying
   2043  * memory during self verification mode.
   2044  *
   2045  * Stores do not modify memory. Instead, the address and value pair are stored
   2046  * into heapSpace. Addresses within heapSpace are unique. For accesses smaller
   2047  * than a word, the word containing the address is loaded first before being
   2048  * updated.
   2049  *
   2050  * Loads check heapSpace first and return data from there if an entry exists.
   2051  * Otherwise, data is loaded from memory as usual.
   2052  */
   2053 
   2054 /* Used to specify sizes of memory operations */
   2055 enum {
   2056     kSVByte,
   2057     kSVSignedByte,
   2058     kSVHalfword,
   2059     kSVSignedHalfword,
   2060     kSVWord,
   2061     kSVDoubleword,
   2062     kSVVariable,
   2063 };
   2064 
   2065 /* Load the value of a decoded register from the stack */
   2066 static int selfVerificationMemRegLoad(int* sp, int reg)
   2067 {
   2068     return *(sp + reg);
   2069 }
   2070 
   2071 /* Load the value of a decoded doubleword register from the stack */
   2072 static s8 selfVerificationMemRegLoadDouble(int* sp, int reg)
   2073 {
   2074     return *((s8*)(sp + reg));
   2075 }
   2076 
   2077 /* Store the value of a decoded register out to the stack */
   2078 static void selfVerificationMemRegStore(int* sp, int data, int reg)
   2079 {
   2080     *(sp + reg) = data;
   2081 }
   2082 
   2083 /* Store the value of a decoded doubleword register out to the stack */
   2084 static void selfVerificationMemRegStoreDouble(int* sp, s8 data, int reg)
   2085 {
   2086     *((s8*)(sp + reg)) = data;
   2087 }
   2088 
   2089 /*
   2090  * Load the specified size of data from the specified address, checking
   2091  * heapSpace first if Self Verification mode wrote to it previously, and
   2092  * falling back to actual memory otherwise.
   2093  */
   2094 static int selfVerificationLoad(int addr, int size)
   2095 {
   2096     Thread *self = dvmThreadSelf();
   2097     ShadowSpace *shadowSpace = self->shadowSpace;
   2098     ShadowHeap *heapSpacePtr;
   2099 
   2100     int data;
   2101     int maskedAddr = addr & 0xFFFFFFFC;
   2102     int alignment = addr & 0x3;
   2103 
   2104     for (heapSpacePtr = shadowSpace->heapSpace;
   2105          heapSpacePtr != shadowSpace->heapSpaceTail; heapSpacePtr++) {
   2106         if (heapSpacePtr->addr == maskedAddr) {
   2107             addr = ((unsigned int) &(heapSpacePtr->data)) | alignment;
   2108             break;
   2109         }
   2110     }
   2111 
   2112     switch (size) {
   2113         case kSVByte:
   2114             data = *((u1*) addr);
   2115             break;
   2116         case kSVSignedByte:
   2117             data = *((s1*) addr);
   2118             break;
   2119         case kSVHalfword:
   2120             data = *((u2*) addr);
   2121             break;
   2122         case kSVSignedHalfword:
   2123             data = *((s2*) addr);
   2124             break;
   2125         case kSVWord:
   2126             data = *((u4*) addr);
   2127             break;
   2128         default:
   2129             LOGE("*** ERROR: BAD SIZE IN selfVerificationLoad: %d", size);
   2130             data = 0;
   2131             dvmAbort();
   2132     }
   2133 
   2134     //LOGD("*** HEAP LOAD: Addr: 0x%x Data: 0x%x Size: %d", addr, data, size);
   2135     return data;
   2136 }
   2137 
   2138 /* Like selfVerificationLoad, but specifically for doublewords */
   2139 static s8 selfVerificationLoadDoubleword(int addr)
   2140 {
   2141     Thread *self = dvmThreadSelf();
   2142     ShadowSpace* shadowSpace = self->shadowSpace;
   2143     ShadowHeap* heapSpacePtr;
   2144 
   2145     int addr2 = addr+4;
   2146     unsigned int data = *((unsigned int*) addr);
   2147     unsigned int data2 = *((unsigned int*) addr2);
   2148 
   2149     for (heapSpacePtr = shadowSpace->heapSpace;
   2150          heapSpacePtr != shadowSpace->heapSpaceTail; heapSpacePtr++) {
   2151         if (heapSpacePtr->addr == addr) {
   2152             data = heapSpacePtr->data;
   2153         } else if (heapSpacePtr->addr == addr2) {
   2154             data2 = heapSpacePtr->data;
   2155         }
   2156     }
   2157 
   2158     //LOGD("*** HEAP LOAD DOUBLEWORD: Addr: 0x%x Data: 0x%x Data2: 0x%x",
   2159     //    addr, data, data2);
   2160     return (((s8) data2) << 32) | data;
   2161 }
   2162 
   2163 /*
   2164  * Handles a store of a specified size of data to a specified address.
   2165  * This gets logged as an addr/data pair in heapSpace instead of modifying
   2166  * memory.  Addresses in heapSpace are unique, and accesses smaller than a
   2167  * word pull the entire word from memory first before updating.
   2168  */
   2169 static void selfVerificationStore(int addr, int data, int size)
   2170 {
   2171     Thread *self = dvmThreadSelf();
   2172     ShadowSpace *shadowSpace = self->shadowSpace;
   2173     ShadowHeap *heapSpacePtr;
   2174 
   2175     int maskedAddr = addr & 0xFFFFFFFC;
   2176     int alignment = addr & 0x3;
   2177 
   2178     //LOGD("*** HEAP STORE: Addr: 0x%x Data: 0x%x Size: %d", addr, data, size);
   2179 
   2180     for (heapSpacePtr = shadowSpace->heapSpace;
   2181          heapSpacePtr != shadowSpace->heapSpaceTail; heapSpacePtr++) {
   2182         if (heapSpacePtr->addr == maskedAddr) break;
   2183     }
   2184 
   2185     if (heapSpacePtr == shadowSpace->heapSpaceTail) {
   2186         heapSpacePtr->addr = maskedAddr;
   2187         heapSpacePtr->data = *((unsigned int*) maskedAddr);
   2188         shadowSpace->heapSpaceTail++;
   2189     }
   2190 
   2191     addr = ((unsigned int) &(heapSpacePtr->data)) | alignment;
   2192     switch (size) {
   2193         case kSVByte:
   2194             *((u1*) addr) = data;
   2195             break;
   2196         case kSVSignedByte:
   2197             *((s1*) addr) = data;
   2198             break;
   2199         case kSVHalfword:
   2200             *((u2*) addr) = data;
   2201             break;
   2202         case kSVSignedHalfword:
   2203             *((s2*) addr) = data;
   2204             break;
   2205         case kSVWord:
   2206             *((u4*) addr) = data;
   2207             break;
   2208         default:
   2209             LOGE("*** ERROR: BAD SIZE IN selfVerificationSave: %d", size);
   2210             dvmAbort();
   2211     }
   2212 }
   2213 
   2214 /* Like selfVerificationStore, but specifically for doublewords */
   2215 static void selfVerificationStoreDoubleword(int addr, s8 double_data)
   2216 {
   2217     Thread *self = dvmThreadSelf();
   2218     ShadowSpace *shadowSpace = self->shadowSpace;
   2219     ShadowHeap *heapSpacePtr;
   2220 
   2221     int addr2 = addr+4;
   2222     int data = double_data;
   2223     int data2 = double_data >> 32;
   2224     bool store1 = false, store2 = false;
   2225 
   2226     //LOGD("*** HEAP STORE DOUBLEWORD: Addr: 0x%x Data: 0x%x, Data2: 0x%x",
   2227     //    addr, data, data2);
   2228 
   2229     for (heapSpacePtr = shadowSpace->heapSpace;
   2230          heapSpacePtr != shadowSpace->heapSpaceTail; heapSpacePtr++) {
   2231         if (heapSpacePtr->addr == addr) {
   2232             heapSpacePtr->data = data;
   2233             store1 = true;
   2234         } else if (heapSpacePtr->addr == addr2) {
   2235             heapSpacePtr->data = data2;
   2236             store2 = true;
   2237         }
   2238     }
   2239 
   2240     if (!store1) {
   2241         shadowSpace->heapSpaceTail->addr = addr;
   2242         shadowSpace->heapSpaceTail->data = data;
   2243         shadowSpace->heapSpaceTail++;
   2244     }
   2245     if (!store2) {
   2246         shadowSpace->heapSpaceTail->addr = addr2;
   2247         shadowSpace->heapSpaceTail->data = data2;
   2248         shadowSpace->heapSpaceTail++;
   2249     }
   2250 }
   2251 
   2252 /*
   2253  * Decodes the memory instruction at the address specified in the link
   2254  * register. All registers (r0-r12,lr) and fp registers (d0-d15) are stored
   2255  * consecutively on the stack beginning at the specified stack pointer.
   2256  * Calls the proper Self Verification handler for the memory instruction and
   2257  * updates the link register to point past the decoded memory instruction.
   2258  */
   2259 void dvmSelfVerificationMemOpDecode(int lr, int* sp)
   2260 {
   2261     enum {
   2262         kMemOpLdrPcRel = 0x09, // ldr(3)  [01001] rd[10..8] imm_8[7..0]
   2263         kMemOpRRR      = 0x0A, // Full opcode is 7 bits
   2264         kMemOp2Single  = 0x0A, // Used for Vstrs and Vldrs
   2265         kMemOpRRR2     = 0x0B, // Full opcode is 7 bits
   2266         kMemOp2Double  = 0x0B, // Used for Vstrd and Vldrd
   2267         kMemOpStrRRI5  = 0x0C, // str(1)  [01100] imm_5[10..6] rn[5..3] rd[2..0]
   2268         kMemOpLdrRRI5  = 0x0D, // ldr(1)  [01101] imm_5[10..6] rn[5..3] rd[2..0]
   2269         kMemOpStrbRRI5 = 0x0E, // strb(1) [01110] imm_5[10..6] rn[5..3] rd[2..0]
   2270         kMemOpLdrbRRI5 = 0x0F, // ldrb(1) [01111] imm_5[10..6] rn[5..3] rd[2..0]
   2271         kMemOpStrhRRI5 = 0x10, // strh(1) [10000] imm_5[10..6] rn[5..3] rd[2..0]
   2272         kMemOpLdrhRRI5 = 0x11, // ldrh(1) [10001] imm_5[10..6] rn[5..3] rd[2..0]
   2273         kMemOpLdrSpRel = 0x13, // ldr(4)  [10011] rd[10..8] imm_8[7..0]
   2274         kMemOpStmia    = 0x18, // stmia   [11000] rn[10..8] reglist [7..0]
   2275         kMemOpLdmia    = 0x19, // ldmia   [11001] rn[10..8] reglist [7..0]
   2276         kMemOpStrRRR   = 0x28, // str(2)  [0101000] rm[8..6] rn[5..3] rd[2..0]
   2277         kMemOpStrhRRR  = 0x29, // strh(2) [0101001] rm[8..6] rn[5..3] rd[2..0]
   2278         kMemOpStrbRRR  = 0x2A, // strb(2) [0101010] rm[8..6] rn[5..3] rd[2..0]
   2279         kMemOpLdrsbRRR = 0x2B, // ldrsb   [0101011] rm[8..6] rn[5..3] rd[2..0]
   2280         kMemOpLdrRRR   = 0x2C, // ldr(2)  [0101100] rm[8..6] rn[5..3] rd[2..0]
   2281         kMemOpLdrhRRR  = 0x2D, // ldrh(2) [0101101] rm[8..6] rn[5..3] rd[2..0]
   2282         kMemOpLdrbRRR  = 0x2E, // ldrb(2) [0101110] rm[8..6] rn[5..3] rd[2..0]
   2283         kMemOpLdrshRRR = 0x2F, // ldrsh   [0101111] rm[8..6] rn[5..3] rd[2..0]
   2284         kMemOp2Stmia   = 0xE88, // stmia  [111010001000[ rn[19..16] mask[15..0]
   2285         kMemOp2Ldmia   = 0xE89, // ldmia  [111010001001[ rn[19..16] mask[15..0]
   2286         kMemOp2Stmia2  = 0xE8A, // stmia  [111010001010[ rn[19..16] mask[15..0]
   2287         kMemOp2Ldmia2  = 0xE8B, // ldmia  [111010001011[ rn[19..16] mask[15..0]
   2288         kMemOp2Vstr    = 0xED8, // Used for Vstrs and Vstrd
   2289         kMemOp2Vldr    = 0xED9, // Used for Vldrs and Vldrd
   2290         kMemOp2Vstr2   = 0xEDC, // Used for Vstrs and Vstrd
   2291         kMemOp2Vldr2   = 0xEDD, // Used for Vstrs and Vstrd
   2292         kMemOp2StrbRRR = 0xF80, /* str rt,[rn,rm,LSL #imm] [111110000000]
   2293                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2294         kMemOp2LdrbRRR = 0xF81, /* ldrb rt,[rn,rm,LSL #imm] [111110000001]
   2295                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2296         kMemOp2StrhRRR = 0xF82, /* str rt,[rn,rm,LSL #imm] [111110000010]
   2297                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2298         kMemOp2LdrhRRR = 0xF83, /* ldrh rt,[rn,rm,LSL #imm] [111110000011]
   2299                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2300         kMemOp2StrRRR  = 0xF84, /* str rt,[rn,rm,LSL #imm] [111110000100]
   2301                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2302         kMemOp2LdrRRR  = 0xF85, /* ldr rt,[rn,rm,LSL #imm] [111110000101]
   2303                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2304         kMemOp2StrbRRI12 = 0xF88, /* strb rt,[rn,#imm12] [111110001000]
   2305                                        rt[15..12] rn[19..16] imm12[11..0] */
   2306         kMemOp2LdrbRRI12 = 0xF89, /* ldrb rt,[rn,#imm12] [111110001001]
   2307                                        rt[15..12] rn[19..16] imm12[11..0] */
   2308         kMemOp2StrhRRI12 = 0xF8A, /* strh rt,[rn,#imm12] [111110001010]
   2309                                        rt[15..12] rn[19..16] imm12[11..0] */
   2310         kMemOp2LdrhRRI12 = 0xF8B, /* ldrh rt,[rn,#imm12] [111110001011]
   2311                                        rt[15..12] rn[19..16] imm12[11..0] */
   2312         kMemOp2StrRRI12 = 0xF8C, /* str(Imm,T3) rd,[rn,#imm12] [111110001100]
   2313                                        rn[19..16] rt[15..12] imm12[11..0] */
   2314         kMemOp2LdrRRI12 = 0xF8D, /* ldr(Imm,T3) rd,[rn,#imm12] [111110001101]
   2315                                        rn[19..16] rt[15..12] imm12[11..0] */
   2316         kMemOp2LdrsbRRR = 0xF91, /* ldrsb rt,[rn,rm,LSL #imm] [111110010001]
   2317                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2318         kMemOp2LdrshRRR = 0xF93, /* ldrsh rt,[rn,rm,LSL #imm] [111110010011]
   2319                                 rn[19-16] rt[15-12] [000000] imm[5-4] rm[3-0] */
   2320         kMemOp2LdrsbRRI12 = 0xF99, /* ldrsb rt,[rn,#imm12] [111110011001]
   2321                                        rt[15..12] rn[19..16] imm12[11..0] */
   2322         kMemOp2LdrshRRI12 = 0xF9B, /* ldrsh rt,[rn,#imm12] [111110011011]
   2323                                        rt[15..12] rn[19..16] imm12[11..0] */
   2324         kMemOp2        = 0xE000, // top 3 bits set indicates Thumb2
   2325     };
   2326 
   2327     int addr, offset, data;
   2328     long long double_data;
   2329     int size = kSVWord;
   2330     bool store = false;
   2331     unsigned int *lr_masked = (unsigned int *) (lr & 0xFFFFFFFE);
   2332     unsigned int insn = *lr_masked;
   2333 
   2334     int old_lr;
   2335     old_lr = selfVerificationMemRegLoad(sp, 13);
   2336 
   2337     if ((insn & kMemOp2) == kMemOp2) {
   2338         insn = (insn << 16) | (insn >> 16);
   2339         //LOGD("*** THUMB2 - Addr: 0x%x Insn: 0x%x", lr, insn);
   2340 
   2341         int opcode12 = (insn >> 20) & 0xFFF;
   2342         int opcode4 = (insn >> 8) & 0xF;
   2343         int imm2 = (insn >> 4) & 0x3;
   2344         int imm8 = insn & 0xFF;
   2345         int imm12 = insn & 0xFFF;
   2346         int rd = (insn >> 12) & 0xF;
   2347         int rm = insn & 0xF;
   2348         int rn = (insn >> 16) & 0xF;
   2349         int rt = (insn >> 12) & 0xF;
   2350         bool wBack = true;
   2351 
   2352         // Update the link register
   2353         selfVerificationMemRegStore(sp, old_lr+4, 13);
   2354 
   2355         // Determine whether the mem op is a store or load
   2356         switch (opcode12) {
   2357             case kMemOp2Stmia:
   2358             case kMemOp2Stmia2:
   2359             case kMemOp2Vstr:
   2360             case kMemOp2Vstr2:
   2361             case kMemOp2StrbRRR:
   2362             case kMemOp2StrhRRR:
   2363             case kMemOp2StrRRR:
   2364             case kMemOp2StrbRRI12:
   2365             case kMemOp2StrhRRI12:
   2366             case kMemOp2StrRRI12:
   2367                 store = true;
   2368         }
   2369 
   2370         // Determine the size of the mem access
   2371         switch (opcode12) {
   2372             case kMemOp2StrbRRR:
   2373             case kMemOp2LdrbRRR:
   2374             case kMemOp2StrbRRI12:
   2375             case kMemOp2LdrbRRI12:
   2376                 size = kSVByte;
   2377                 break;
   2378             case kMemOp2LdrsbRRR:
   2379             case kMemOp2LdrsbRRI12:
   2380                 size = kSVSignedByte;
   2381                 break;
   2382             case kMemOp2StrhRRR:
   2383             case kMemOp2LdrhRRR:
   2384             case kMemOp2StrhRRI12:
   2385             case kMemOp2LdrhRRI12:
   2386                 size = kSVHalfword;
   2387                 break;
   2388             case kMemOp2LdrshRRR:
   2389             case kMemOp2LdrshRRI12:
   2390                 size = kSVSignedHalfword;
   2391                 break;
   2392             case kMemOp2Vstr:
   2393             case kMemOp2Vstr2:
   2394             case kMemOp2Vldr:
   2395             case kMemOp2Vldr2:
   2396                 if (opcode4 == kMemOp2Double) size = kSVDoubleword;
   2397                 break;
   2398             case kMemOp2Stmia:
   2399             case kMemOp2Ldmia:
   2400             case kMemOp2Stmia2:
   2401             case kMemOp2Ldmia2:
   2402                 size = kSVVariable;
   2403                 break;
   2404         }
   2405 
   2406         // Load the value of the address
   2407         addr = selfVerificationMemRegLoad(sp, rn);
   2408 
   2409         // Figure out the offset
   2410         switch (opcode12) {
   2411             case kMemOp2Vstr:
   2412             case kMemOp2Vstr2:
   2413             case kMemOp2Vldr:
   2414             case kMemOp2Vldr2:
   2415                 offset = imm8 << 2;
   2416                 if (opcode4 == kMemOp2Single) {
   2417                     rt = rd << 1;
   2418                     if (insn & 0x400000) rt |= 0x1;
   2419                 } else if (opcode4 == kMemOp2Double) {
   2420                     if (insn & 0x400000) rt |= 0x10;
   2421                     rt = rt << 1;
   2422                 } else {
   2423                     LOGE("*** ERROR: UNRECOGNIZED VECTOR MEM OP: %x", opcode4);
   2424                     dvmAbort();
   2425                 }
   2426                 rt += 14;
   2427                 break;
   2428             case kMemOp2StrbRRR:
   2429             case kMemOp2LdrbRRR:
   2430             case kMemOp2StrhRRR:
   2431             case kMemOp2LdrhRRR:
   2432             case kMemOp2StrRRR:
   2433             case kMemOp2LdrRRR:
   2434             case kMemOp2LdrsbRRR:
   2435             case kMemOp2LdrshRRR:
   2436                 offset = selfVerificationMemRegLoad(sp, rm) << imm2;
   2437                 break;
   2438             case kMemOp2StrbRRI12:
   2439             case kMemOp2LdrbRRI12:
   2440             case kMemOp2StrhRRI12:
   2441             case kMemOp2LdrhRRI12:
   2442             case kMemOp2StrRRI12:
   2443             case kMemOp2LdrRRI12:
   2444             case kMemOp2LdrsbRRI12:
   2445             case kMemOp2LdrshRRI12:
   2446                 offset = imm12;
   2447                 break;
   2448             case kMemOp2Stmia:
   2449             case kMemOp2Ldmia:
   2450                 wBack = false;
   2451             case kMemOp2Stmia2:
   2452             case kMemOp2Ldmia2:
   2453                 offset = 0;
   2454                 break;
   2455             default:
   2456                 LOGE("*** ERROR: UNRECOGNIZED THUMB2 MEM OP: %x", opcode12);
   2457                 offset = 0;
   2458                 dvmAbort();
   2459         }
   2460 
   2461         // Handle the decoded mem op accordingly
   2462         if (store) {
   2463             if (size == kSVVariable) {
   2464                 LOGD("*** THUMB2 STMIA CURRENTLY UNUSED (AND UNTESTED)");
   2465                 int i;
   2466                 int regList = insn & 0xFFFF;
   2467                 for (i = 0; i < 16; i++) {
   2468                     if (regList & 0x1) {
   2469                         data = selfVerificationMemRegLoad(sp, i);
   2470                         selfVerificationStore(addr, data, kSVWord);
   2471                         addr += 4;
   2472                     }
   2473                     regList = regList >> 1;
   2474                 }
   2475                 if (wBack) selfVerificationMemRegStore(sp, addr, rn);
   2476             } else if (size == kSVDoubleword) {
   2477                 double_data = selfVerificationMemRegLoadDouble(sp, rt);
   2478                 selfVerificationStoreDoubleword(addr+offset, double_data);
   2479             } else {
   2480                 data = selfVerificationMemRegLoad(sp, rt);
   2481                 selfVerificationStore(addr+offset, data, size);
   2482             }
   2483         } else {
   2484             if (size == kSVVariable) {
   2485                 LOGD("*** THUMB2 LDMIA CURRENTLY UNUSED (AND UNTESTED)");
   2486                 int i;
   2487                 int regList = insn & 0xFFFF;
   2488                 for (i = 0; i < 16; i++) {
   2489                     if (regList & 0x1) {
   2490                         data = selfVerificationLoad(addr, kSVWord);
   2491                         selfVerificationMemRegStore(sp, data, i);
   2492                         addr += 4;
   2493                     }
   2494                     regList = regList >> 1;
   2495                 }
   2496                 if (wBack) selfVerificationMemRegStore(sp, addr, rn);
   2497             } else if (size == kSVDoubleword) {
   2498                 double_data = selfVerificationLoadDoubleword(addr+offset);
   2499                 selfVerificationMemRegStoreDouble(sp, double_data, rt);
   2500             } else {
   2501                 data = selfVerificationLoad(addr+offset, size);
   2502                 selfVerificationMemRegStore(sp, data, rt);
   2503             }
   2504         }
   2505     } else {
   2506         //LOGD("*** THUMB - Addr: 0x%x Insn: 0x%x", lr, insn);
   2507 
   2508         // Update the link register
   2509         selfVerificationMemRegStore(sp, old_lr+2, 13);
   2510 
   2511         int opcode5 = (insn >> 11) & 0x1F;
   2512         int opcode7 = (insn >> 9) & 0x7F;
   2513         int imm = (insn >> 6) & 0x1F;
   2514         int rd = (insn >> 8) & 0x7;
   2515         int rm = (insn >> 6) & 0x7;
   2516         int rn = (insn >> 3) & 0x7;
   2517         int rt = insn & 0x7;
   2518 
   2519         // Determine whether the mem op is a store or load
   2520         switch (opcode5) {
   2521             case kMemOpRRR:
   2522                 switch (opcode7) {
   2523                     case kMemOpStrRRR:
   2524                     case kMemOpStrhRRR:
   2525                     case kMemOpStrbRRR:
   2526                         store = true;
   2527                 }
   2528                 break;
   2529             case kMemOpStrRRI5:
   2530             case kMemOpStrbRRI5:
   2531             case kMemOpStrhRRI5:
   2532             case kMemOpStmia:
   2533                 store = true;
   2534         }
   2535 
   2536         // Determine the size of the mem access
   2537         switch (opcode5) {
   2538             case kMemOpRRR:
   2539             case kMemOpRRR2:
   2540                 switch (opcode7) {
   2541                     case kMemOpStrbRRR:
   2542                     case kMemOpLdrbRRR:
   2543                         size = kSVByte;
   2544                         break;
   2545                     case kMemOpLdrsbRRR:
   2546                         size = kSVSignedByte;
   2547                         break;
   2548                     case kMemOpStrhRRR:
   2549                     case kMemOpLdrhRRR:
   2550                         size = kSVHalfword;
   2551                         break;
   2552                     case kMemOpLdrshRRR:
   2553                         size = kSVSignedHalfword;
   2554                         break;
   2555                 }
   2556                 break;
   2557             case kMemOpStrbRRI5:
   2558             case kMemOpLdrbRRI5:
   2559                 size = kSVByte;
   2560                 break;
   2561             case kMemOpStrhRRI5:
   2562             case kMemOpLdrhRRI5:
   2563                 size = kSVHalfword;
   2564                 break;
   2565             case kMemOpStmia:
   2566             case kMemOpLdmia:
   2567                 size = kSVVariable;
   2568                 break;
   2569         }
   2570 
   2571         // Load the value of the address
   2572         if (opcode5 == kMemOpLdrPcRel)
   2573             addr = selfVerificationMemRegLoad(sp, 4);
   2574         else if (opcode5 == kMemOpStmia || opcode5 == kMemOpLdmia)
   2575             addr = selfVerificationMemRegLoad(sp, rd);
   2576         else
   2577             addr = selfVerificationMemRegLoad(sp, rn);
   2578 
   2579         // Figure out the offset
   2580         switch (opcode5) {
   2581             case kMemOpLdrPcRel:
   2582                 offset = (insn & 0xFF) << 2;
   2583                 rt = rd;
   2584                 break;
   2585             case kMemOpRRR:
   2586             case kMemOpRRR2:
   2587                 offset = selfVerificationMemRegLoad(sp, rm);
   2588                 break;
   2589             case kMemOpStrRRI5:
   2590             case kMemOpLdrRRI5:
   2591                 offset = imm << 2;
   2592                 break;
   2593             case kMemOpStrhRRI5:
   2594             case kMemOpLdrhRRI5:
   2595                 offset = imm << 1;
   2596                 break;
   2597             case kMemOpStrbRRI5:
   2598             case kMemOpLdrbRRI5:
   2599                 offset = imm;
   2600                 break;
   2601             case kMemOpStmia:
   2602             case kMemOpLdmia:
   2603                 offset = 0;
   2604                 break;
   2605             default:
   2606                 LOGE("*** ERROR: UNRECOGNIZED THUMB MEM OP: %x", opcode5);
   2607                 offset = 0;
   2608                 dvmAbort();
   2609         }
   2610 
   2611         // Handle the decoded mem op accordingly
   2612         if (store) {
   2613             if (size == kSVVariable) {
   2614                 int i;
   2615                 int regList = insn & 0xFF;
   2616                 for (i = 0; i < 8; i++) {
   2617                     if (regList & 0x1) {
   2618                         data = selfVerificationMemRegLoad(sp, i);
   2619                         selfVerificationStore(addr, data, kSVWord);
   2620                         addr += 4;
   2621                     }
   2622                     regList = regList >> 1;
   2623                 }
   2624                 selfVerificationMemRegStore(sp, addr, rd);
   2625             } else {
   2626                 data = selfVerificationMemRegLoad(sp, rt);
   2627                 selfVerificationStore(addr+offset, data, size);
   2628             }
   2629         } else {
   2630             if (size == kSVVariable) {
   2631                 bool wBack = true;
   2632                 int i;
   2633                 int regList = insn & 0xFF;
   2634                 for (i = 0; i < 8; i++) {
   2635                     if (regList & 0x1) {
   2636                         if (i == rd) wBack = false;
   2637                         data = selfVerificationLoad(addr, kSVWord);
   2638                         selfVerificationMemRegStore(sp, data, i);
   2639                         addr += 4;
   2640                     }
   2641                     regList = regList >> 1;
   2642                 }
   2643                 if (wBack) selfVerificationMemRegStore(sp, addr, rd);
   2644             } else {
   2645                 data = selfVerificationLoad(addr+offset, size);
   2646                 selfVerificationMemRegStore(sp, data, rt);
   2647             }
   2648         }
   2649     }
   2650 }
   2651 #endif
   2652