Archipelago » qemu

/* ppc-dis.c -- Disassemble PowerPC instructions

   Copyright 1994, 1995, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007

   Free Software Foundation, Inc.

   Written by Ian Lance Taylor, Cygnus Support

This file is part of GDB, GAS, and the GNU binutils.

GDB, GAS, and the GNU binutils are free software; you can redistribute

them and/or modify them under the terms of the GNU General Public

License as published by the Free Software Foundation; either version

2, or (at your option) any later version.

GDB, GAS, and the GNU binutils are distributed in the hope that they

will be useful, but WITHOUT ANY WARRANTY; without even the implied

warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See

the GNU General Public License for more details.

You should have received a copy of the GNU General Public License

along with this file; see the file COPYING.  If not,

see <http://www.gnu.org/licenses/>.  */

#include "disas/bfd.h"

#define BFD_DEFAULT_TARGET_SIZE 64

/* ppc.h -- Header file for PowerPC opcode table

   Copyright 1994, 1995, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,

   2007 Free Software Foundation, Inc.

   Written by Ian Lance Taylor, Cygnus Support

This file is part of GDB, GAS, and the GNU binutils.

GDB, GAS, and the GNU binutils are free software; you can redistribute

them and/or modify them under the terms of the GNU General Public

License as published by the Free Software Foundation; either version

1, or (at your option) any later version.

GDB, GAS, and the GNU binutils are distributed in the hope that they

will be useful, but WITHOUT ANY WARRANTY; without even the implied

warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See

the GNU General Public License for more details.

You should have received a copy of the GNU General Public License

along with this file; see the file COPYING.  If not,

see <http://www.gnu.org/licenses/>.  */

/* The opcode table is an array of struct powerpc_opcode.  */

struct powerpc_opcode

{

  /* The opcode name.  */

  const char *name;

  /* The opcode itself.  Those bits which will be filled in with

     operands are zeroes.  */

  unsigned long opcode;

  /* The opcode mask.  This is used by the disassembler.  This is a

     mask containing ones indicating those bits which must match the

     opcode field, and zeroes indicating those bits which need not

     match (and are presumably filled in by operands).  */

  unsigned long mask;

  /* One bit flags for the opcode.  These are used to indicate which

     specific processors support the instructions.  The defined values

     are listed below.  */

  unsigned long flags;

  /* An array of operand codes.  Each code is an index into the

     operand table.  They appear in the order which the operands must

     appear in assembly code, and are terminated by a zero.  */

  unsigned char operands[8];

};

/* The table itself is sorted by major opcode number, and is otherwise

   in the order in which the disassembler should consider

   instructions.  */

extern const struct powerpc_opcode powerpc_opcodes[];

extern const int powerpc_num_opcodes;

/* Values defined for the flags field of a struct powerpc_opcode.  */

/* Opcode is defined for the PowerPC architecture.  */

#define PPC_OPCODE_PPC                         1

/* Opcode is defined for the POWER (RS/6000) architecture.  */

#define PPC_OPCODE_POWER                 2

/* Opcode is defined for the POWER2 (Rios 2) architecture.  */

#define PPC_OPCODE_POWER2                 4

/* Opcode is only defined on 32 bit architectures.  */

#define PPC_OPCODE_32                         8

/* Opcode is only defined on 64 bit architectures.  */

#define PPC_OPCODE_64                      0x10

/* Opcode is supported by the Motorola PowerPC 601 processor.  The 601

   is assumed to support all PowerPC (PPC_OPCODE_PPC) instructions,

   but it also supports many additional POWER instructions.  */

#define PPC_OPCODE_601                      0x20

/* Opcode is supported in both the Power and PowerPC architectures

   (ie, compiler's -mcpu=common or assembler's -mcom).  */

#define PPC_OPCODE_COMMON              0x40

/* Opcode is supported for any Power or PowerPC platform (this is

   for the assembler's -many option, and it eliminates duplicates).  */

#define PPC_OPCODE_ANY                      0x80

/* Opcode is supported as part of the 64-bit bridge.  */

#define PPC_OPCODE_64_BRIDGE             0x100

/* Opcode is supported by Altivec Vector Unit */

#define PPC_OPCODE_ALTIVEC             0x200

/* Opcode is supported by PowerPC 403 processor.  */

#define PPC_OPCODE_403                     0x400

/* Opcode is supported by PowerPC BookE processor.  */

#define PPC_OPCODE_BOOKE             0x800

/* Opcode is only supported by 64-bit PowerPC BookE processor.  */

#define PPC_OPCODE_BOOKE64            0x1000

/* Opcode is supported by PowerPC 440 processor.  */

#define PPC_OPCODE_440                    0x2000

/* Opcode is only supported by Power4 architecture.  */

#define PPC_OPCODE_POWER4            0x4000

/* Opcode isn't supported by Power4 architecture.  */

#define PPC_OPCODE_NOPOWER4            0x8000

/* Opcode is only supported by POWERPC Classic architecture.  */

#define PPC_OPCODE_CLASSIC           0x10000

/* Opcode is only supported by e500x2 Core.  */

#define PPC_OPCODE_SPE                   0x20000

/* Opcode is supported by e500x2 Integer select APU.  */

#define PPC_OPCODE_ISEL                   0x40000

/* Opcode is an e500 SPE floating point instruction.  */

#define PPC_OPCODE_EFS                   0x80000

/* Opcode is supported by branch locking APU.  */

#define PPC_OPCODE_BRLOCK          0x100000

/* Opcode is supported by performance monitor APU.  */

#define PPC_OPCODE_PMR                  0x200000

/* Opcode is supported by cache locking APU.  */

#define PPC_OPCODE_CACHELCK          0x400000

/* Opcode is supported by machine check APU.  */

#define PPC_OPCODE_RFMCI          0x800000

/* Opcode is only supported by Power5 architecture.  */

#define PPC_OPCODE_POWER5         0x1000000

/* Opcode is supported by PowerPC e300 family.  */

#define PPC_OPCODE_E300          0x2000000

/* Opcode is only supported by Power6 architecture.  */

#define PPC_OPCODE_POWER6         0x4000000

/* Opcode is only supported by PowerPC Cell family.  */

#define PPC_OPCODE_CELL                 0x8000000

/* A macro to extract the major opcode from an instruction.  */

#define PPC_OP(i) (((i) >> 26) & 0x3f)

/* The operands table is an array of struct powerpc_operand.  */

struct powerpc_operand

{

  /* A bitmask of bits in the operand.  */

  unsigned int bitm;

  /* How far the operand is left shifted in the instruction.

     -1 to indicate that BITM and SHIFT cannot be used to determine

     where the operand goes in the insn.  */

  int shift;

  /* Insertion function.  This is used by the assembler.  To insert an

     operand value into an instruction, check this field.

     If it is NULL, execute

         i |= (op & o->bitm) << o->shift;

     (i is the instruction which we are filling in, o is a pointer to

     this structure, and op is the operand value).

     If this field is not NULL, then simply call it with the

     instruction and the operand value.  It will return the new value

     of the instruction.  If the ERRMSG argument is not NULL, then if

     the operand value is illegal, *ERRMSG will be set to a warning

     string (the operand will be inserted in any case).  If the

     operand value is legal, *ERRMSG will be unchanged (most operands

     can accept any value).  */

  unsigned long (*insert)

    (unsigned long instruction, long op, int dialect, const char **errmsg);

  /* Extraction function.  This is used by the disassembler.  To

     extract this operand type from an instruction, check this field.

     If it is NULL, compute

         op = (i >> o->shift) & o->bitm;

         if ((o->flags & PPC_OPERAND_SIGNED) != 0)

           sign_extend (op);

     (i is the instruction, o is a pointer to this structure, and op

     is the result).

     If this field is not NULL, then simply call it with the

     instruction value.  It will return the value of the operand.  If

     the INVALID argument is not NULL, *INVALID will be set to

     non-zero if this operand type can not actually be extracted from

     this operand (i.e., the instruction does not match).  If the

     operand is valid, *INVALID will not be changed.  */

  long (*extract) (unsigned long instruction, int dialect, int *invalid);

  /* One bit syntax flags.  */

  unsigned long flags;

};

/* Elements in the table are retrieved by indexing with values from

   the operands field of the powerpc_opcodes table.  */

extern const struct powerpc_operand powerpc_operands[];

extern const unsigned int num_powerpc_operands;

/* Values defined for the flags field of a struct powerpc_operand.  */

/* This operand takes signed values.  */

#define PPC_OPERAND_SIGNED (0x1)

/* This operand takes signed values, but also accepts a full positive

   range of values when running in 32 bit mode.  That is, if bits is

   16, it takes any value from -0x8000 to 0xffff.  In 64 bit mode,

   this flag is ignored.  */

#define PPC_OPERAND_SIGNOPT (0x2)

/* This operand does not actually exist in the assembler input.  This

   is used to support extended mnemonics such as mr, for which two

   operands fields are identical.  The assembler should call the

   insert function with any op value.  The disassembler should call

   the extract function, ignore the return value, and check the value

   placed in the valid argument.  */

#define PPC_OPERAND_FAKE (0x4)

/* The next operand should be wrapped in parentheses rather than

   separated from this one by a comma.  This is used for the load and

   store instructions which want their operands to look like

       reg,displacement(reg)

   */

#define PPC_OPERAND_PARENS (0x8)

/* This operand may use the symbolic names for the CR fields, which

   are

       lt  0        gt  1        eq  2        so  3        un  3

       cr0 0        cr1 1        cr2 2        cr3 3

       cr4 4        cr5 5        cr6 6        cr7 7

   These may be combined arithmetically, as in cr2*4+gt.  These are

   only supported on the PowerPC, not the POWER.  */

#define PPC_OPERAND_CR (0x10)

/* This operand names a register.  The disassembler uses this to print

   register names with a leading 'r'.  */

#define PPC_OPERAND_GPR (0x20)

/* Like PPC_OPERAND_GPR, but don't print a leading 'r' for r0.  */

#define PPC_OPERAND_GPR_0 (0x40)

/* This operand names a floating point register.  The disassembler

   prints these with a leading 'f'.  */

#define PPC_OPERAND_FPR (0x80)

/* This operand is a relative branch displacement.  The disassembler

   prints these symbolically if possible.  */

#define PPC_OPERAND_RELATIVE (0x100)

/* This operand is an absolute branch address.  The disassembler

   prints these symbolically if possible.  */

#define PPC_OPERAND_ABSOLUTE (0x200)

/* This operand is optional, and is zero if omitted.  This is used for

   example, in the optional BF field in the comparison instructions.  The

   assembler must count the number of operands remaining on the line,

   and the number of operands remaining for the opcode, and decide

   whether this operand is present or not.  The disassembler should

   print this operand out only if it is not zero.  */

#define PPC_OPERAND_OPTIONAL (0x400)

/* This flag is only used with PPC_OPERAND_OPTIONAL.  If this operand

   is omitted, then for the next operand use this operand value plus

   1, ignoring the next operand field for the opcode.  This wretched

   hack is needed because the Power rotate instructions can take

   either 4 or 5 operands.  The disassembler should print this operand

   out regardless of the PPC_OPERAND_OPTIONAL field.  */

#define PPC_OPERAND_NEXT (0x800)

/* This operand should be regarded as a negative number for the

   purposes of overflow checking (i.e., the normal most negative

   number is disallowed and one more than the normal most positive

   number is allowed).  This flag will only be set for a signed

   operand.  */

#define PPC_OPERAND_NEGATIVE (0x1000)

/* This operand names a vector unit register.  The disassembler

   prints these with a leading 'v'.  */

#define PPC_OPERAND_VR (0x2000)

/* This operand is for the DS field in a DS form instruction.  */

#define PPC_OPERAND_DS (0x4000)

/* This operand is for the DQ field in a DQ form instruction.  */

#define PPC_OPERAND_DQ (0x8000)

/* Valid range of operand is 0..n rather than 0..n-1.  */

#define PPC_OPERAND_PLUS1 (0x10000)

/* The POWER and PowerPC assemblers use a few macros.  We keep them

   with the operands table for simplicity.  The macro table is an

   array of struct powerpc_macro.  */

struct powerpc_macro

{

  /* The macro name.  */

  const char *name;

  /* The number of operands the macro takes.  */

  unsigned int operands;

  /* One bit flags for the opcode.  These are used to indicate which

     specific processors support the instructions.  The values are the

     same as those for the struct powerpc_opcode flags field.  */

  unsigned long flags;

  /* A format string to turn the macro into a normal instruction.

     Each %N in the string is replaced with operand number N (zero

     based).  */

  const char *format;

};

extern const struct powerpc_macro powerpc_macros[];

extern const int powerpc_num_macros;

/* ppc-opc.c -- PowerPC opcode list

   Copyright 1994, 1995, 1996, 1997, 1998, 2000, 2001, 2002, 2003, 2004,

   2005, 2006, 2007 Free Software Foundation, Inc.

   Written by Ian Lance Taylor, Cygnus Support

   This file is part of GDB, GAS, and the GNU binutils.

   GDB, GAS, and the GNU binutils are free software; you can redistribute

   them and/or modify them under the terms of the GNU General Public

   License as published by the Free Software Foundation; either version

   2, or (at your option) any later version.

   GDB, GAS, and the GNU binutils are distributed in the hope that they

   will be useful, but WITHOUT ANY WARRANTY; without even the implied

   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See

   the GNU General Public License for more details.

   You should have received a copy of the GNU General Public License

   along with this file; see the file COPYING.

   If not, see <http://www.gnu.org/licenses/>.  */

/* This file holds the PowerPC opcode table.  The opcode table

   includes almost all of the extended instruction mnemonics.  This

   permits the disassembler to use them, and simplifies the assembler

   logic, at the cost of increasing the table size.  The table is

   strictly constant data, so the compiler should be able to put it in

   the .text section.

   This file also holds the operand table.  All knowledge about

   inserting operands into instructions and vice-versa is kept in this

   file.  */

/* Local insertion and extraction functions.  */

static unsigned long insert_bat (unsigned long, long, int, const char **);

static long extract_bat (unsigned long, int, int *);

static unsigned long insert_bba (unsigned long, long, int, const char **);

static long extract_bba (unsigned long, int, int *);

static unsigned long insert_bdm (unsigned long, long, int, const char **);

static long extract_bdm (unsigned long, int, int *);

static unsigned long insert_bdp (unsigned long, long, int, const char **);

static long extract_bdp (unsigned long, int, int *);

static unsigned long insert_bo (unsigned long, long, int, const char **);

static long extract_bo (unsigned long, int, int *);

static unsigned long insert_boe (unsigned long, long, int, const char **);

static long extract_boe (unsigned long, int, int *);

static unsigned long insert_fxm (unsigned long, long, int, const char **);

static long extract_fxm (unsigned long, int, int *);

static unsigned long insert_mbe (unsigned long, long, int, const char **);

static long extract_mbe (unsigned long, int, int *);

static unsigned long insert_mb6 (unsigned long, long, int, const char **);

static long extract_mb6 (unsigned long, int, int *);

static long extract_nb (unsigned long, int, int *);

static unsigned long insert_nsi (unsigned long, long, int, const char **);

static long extract_nsi (unsigned long, int, int *);

static unsigned long insert_ral (unsigned long, long, int, const char **);

static unsigned long insert_ram (unsigned long, long, int, const char **);

static unsigned long insert_raq (unsigned long, long, int, const char **);

static unsigned long insert_ras (unsigned long, long, int, const char **);

static unsigned long insert_rbs (unsigned long, long, int, const char **);

static long extract_rbs (unsigned long, int, int *);

static unsigned long insert_sh6 (unsigned long, long, int, const char **);

static long extract_sh6 (unsigned long, int, int *);

static unsigned long insert_spr (unsigned long, long, int, const char **);

static long extract_spr (unsigned long, int, int *);

static unsigned long insert_sprg (unsigned long, long, int, const char **);

static long extract_sprg (unsigned long, int, int *);

static unsigned long insert_tbr (unsigned long, long, int, const char **);

static long extract_tbr (unsigned long, int, int *);

/* The operands table.

   The fields are bitm, shift, insert, extract, flags.

   We used to put parens around the various additions, like the one

   for BA just below.  However, that caused trouble with feeble

   compilers with a limit on depth of a parenthesized expression, like

   (reportedly) the compiler in Microsoft Developer Studio 5.  So we

   omit the parens, since the macros are never used in a context where

   the addition will be ambiguous.  */

const struct powerpc_operand powerpc_operands[] =

{

  /* The zero index is used to indicate the end of the list of

     operands.  */

#define UNUSED 0

  { 0, 0, NULL, NULL, 0 },

  /* The BA field in an XL form instruction.  */

#define BA UNUSED + 1

  /* The BI field in a B form or XL form instruction.  */

#define BI BA

#define BI_MASK (0x1f << 16)

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_CR },

  /* The BA field in an XL form instruction when it must be the same

     as the BT field in the same instruction.  */

#define BAT BA + 1

  { 0x1f, 16, insert_bat, extract_bat, PPC_OPERAND_FAKE },

  /* The BB field in an XL form instruction.  */

#define BB BAT + 1

#define BB_MASK (0x1f << 11)

  { 0x1f, 11, NULL, NULL, PPC_OPERAND_CR },

  /* The BB field in an XL form instruction when it must be the same

     as the BA field in the same instruction.  */

#define BBA BB + 1

  { 0x1f, 11, insert_bba, extract_bba, PPC_OPERAND_FAKE },

  /* The BD field in a B form instruction.  The lower two bits are

     forced to zero.  */

#define BD BBA + 1

  { 0xfffc, 0, NULL, NULL, PPC_OPERAND_RELATIVE | PPC_OPERAND_SIGNED },

  /* The BD field in a B form instruction when absolute addressing is

     used.  */

#define BDA BD + 1

  { 0xfffc, 0, NULL, NULL, PPC_OPERAND_ABSOLUTE | PPC_OPERAND_SIGNED },

  /* The BD field in a B form instruction when the - modifier is used.

     This sets the y bit of the BO field appropriately.  */

#define BDM BDA + 1

  { 0xfffc, 0, insert_bdm, extract_bdm,

      PPC_OPERAND_RELATIVE | PPC_OPERAND_SIGNED },

  /* The BD field in a B form instruction when the - modifier is used

     and absolute address is used.  */

#define BDMA BDM + 1

  { 0xfffc, 0, insert_bdm, extract_bdm,

      PPC_OPERAND_ABSOLUTE | PPC_OPERAND_SIGNED },

  /* The BD field in a B form instruction when the + modifier is used.

     This sets the y bit of the BO field appropriately.  */

#define BDP BDMA + 1

  { 0xfffc, 0, insert_bdp, extract_bdp,

      PPC_OPERAND_RELATIVE | PPC_OPERAND_SIGNED },

  /* The BD field in a B form instruction when the + modifier is used

     and absolute addressing is used.  */

#define BDPA BDP + 1

  { 0xfffc, 0, insert_bdp, extract_bdp,

      PPC_OPERAND_ABSOLUTE | PPC_OPERAND_SIGNED },

  /* The BF field in an X or XL form instruction.  */

#define BF BDPA + 1

  /* The CRFD field in an X form instruction.  */

#define CRFD BF

  { 0x7, 23, NULL, NULL, PPC_OPERAND_CR },

  /* The BF field in an X or XL form instruction.  */

#define BFF BF + 1

  { 0x7, 23, NULL, NULL, 0 },

  /* An optional BF field.  This is used for comparison instructions,

     in which an omitted BF field is taken as zero.  */

#define OBF BFF + 1

  { 0x7, 23, NULL, NULL, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },

  /* The BFA field in an X or XL form instruction.  */

#define BFA OBF + 1

  { 0x7, 18, NULL, NULL, PPC_OPERAND_CR },

  /* The BO field in a B form instruction.  Certain values are

     illegal.  */

#define BO BFA + 1

#define BO_MASK (0x1f << 21)

  { 0x1f, 21, insert_bo, extract_bo, 0 },

  /* The BO field in a B form instruction when the + or - modifier is

     used.  This is like the BO field, but it must be even.  */

#define BOE BO + 1

  { 0x1e, 21, insert_boe, extract_boe, 0 },

#define BH BOE + 1

  { 0x3, 11, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The BT field in an X or XL form instruction.  */

#define BT BH + 1

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_CR },

  /* The condition register number portion of the BI field in a B form

     or XL form instruction.  This is used for the extended

     conditional branch mnemonics, which set the lower two bits of the

     BI field.  This field is optional.  */

#define CR BT + 1

  { 0x7, 18, NULL, NULL, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },

  /* The CRB field in an X form instruction.  */

#define CRB CR + 1

  /* The MB field in an M form instruction.  */

#define MB CRB

#define MB_MASK (0x1f << 6)

  { 0x1f, 6, NULL, NULL, 0 },

  /* The CRFS field in an X form instruction.  */

#define CRFS CRB + 1

  { 0x7, 0, NULL, NULL, PPC_OPERAND_CR },

  /* The CT field in an X form instruction.  */

#define CT CRFS + 1

  /* The MO field in an mbar instruction.  */

#define MO CT

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The D field in a D form instruction.  This is a displacement off

     a register, and implies that the next operand is a register in

     parentheses.  */

#define D CT + 1

  { 0xffff, 0, NULL, NULL, PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED },

  /* The DE field in a DE form instruction.  This is like D, but is 12

     bits only.  */

#define DE D + 1

  { 0xfff, 4, NULL, NULL, PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED },

  /* The DES field in a DES form instruction.  This is like DS, but is 14

     bits only (12 stored.)  */

#define DES DE + 1

  { 0x3ffc, 2, NULL, NULL, PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED },

  /* The DQ field in a DQ form instruction.  This is like D, but the

     lower four bits are forced to zero. */

#define DQ DES + 1

  { 0xfff0, 0, NULL, NULL,

    PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED | PPC_OPERAND_DQ },

  /* The DS field in a DS form instruction.  This is like D, but the

     lower two bits are forced to zero.  */

#undef DS

#define DS DQ + 1

  { 0xfffc, 0, NULL, NULL,

    PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED | PPC_OPERAND_DS },

  /* The E field in a wrteei instruction.  */

#define E DS + 1

  { 0x1, 15, NULL, NULL, 0 },

  /* The FL1 field in a POWER SC form instruction.  */

#define FL1 E + 1

  /* The U field in an X form instruction.  */

#define U FL1

  { 0xf, 12, NULL, NULL, 0 },

  /* The FL2 field in a POWER SC form instruction.  */

#define FL2 FL1 + 1

  { 0x7, 2, NULL, NULL, 0 },

  /* The FLM field in an XFL form instruction.  */

#define FLM FL2 + 1

  { 0xff, 17, NULL, NULL, 0 },

  /* The FRA field in an X or A form instruction.  */

#define FRA FLM + 1

#define FRA_MASK (0x1f << 16)

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_FPR },

  /* The FRB field in an X or A form instruction.  */

#define FRB FRA + 1

#define FRB_MASK (0x1f << 11)

  { 0x1f, 11, NULL, NULL, PPC_OPERAND_FPR },

  /* The FRC field in an A form instruction.  */

#define FRC FRB + 1

#define FRC_MASK (0x1f << 6)

  { 0x1f, 6, NULL, NULL, PPC_OPERAND_FPR },

  /* The FRS field in an X form instruction or the FRT field in a D, X

     or A form instruction.  */

#define FRS FRC + 1

#define FRT FRS

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_FPR },

  /* The FXM field in an XFX instruction.  */

#define FXM FRS + 1

  { 0xff, 12, insert_fxm, extract_fxm, 0 },

  /* Power4 version for mfcr.  */

#define FXM4 FXM + 1

  { 0xff, 12, insert_fxm, extract_fxm, PPC_OPERAND_OPTIONAL },

  /* The L field in a D or X form instruction.  */

#define L FXM4 + 1

  { 0x1, 21, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The LEV field in a POWER SVC form instruction.  */

#define SVC_LEV L + 1

  { 0x7f, 5, NULL, NULL, 0 },

  /* The LEV field in an SC form instruction.  */

#define LEV SVC_LEV + 1

  { 0x7f, 5, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The LI field in an I form instruction.  The lower two bits are

     forced to zero.  */

#define LI LEV + 1

  { 0x3fffffc, 0, NULL, NULL, PPC_OPERAND_RELATIVE | PPC_OPERAND_SIGNED },

  /* The LI field in an I form instruction when used as an absolute

     address.  */

#define LIA LI + 1

  { 0x3fffffc, 0, NULL, NULL, PPC_OPERAND_ABSOLUTE | PPC_OPERAND_SIGNED },

  /* The LS field in an X (sync) form instruction.  */

#define LS LIA + 1

  { 0x3, 21, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The ME field in an M form instruction.  */

#define ME LS + 1

#define ME_MASK (0x1f << 1)

  { 0x1f, 1, NULL, NULL, 0 },

  /* The MB and ME fields in an M form instruction expressed a single

     operand which is a bitmask indicating which bits to select.  This

     is a two operand form using PPC_OPERAND_NEXT.  See the

     description in opcode/ppc.h for what this means.  */

#define MBE ME + 1

  { 0x1f, 6, NULL, NULL, PPC_OPERAND_OPTIONAL | PPC_OPERAND_NEXT },

  { -1, 0, insert_mbe, extract_mbe, 0 },

  /* The MB or ME field in an MD or MDS form instruction.  The high

     bit is wrapped to the low end.  */

#define MB6 MBE + 2

#define ME6 MB6

#define MB6_MASK (0x3f << 5)

  { 0x3f, 5, insert_mb6, extract_mb6, 0 },

  /* The NB field in an X form instruction.  The value 32 is stored as

     0.  */

#define NB MB6 + 1

  { 0x1f, 11, NULL, extract_nb, PPC_OPERAND_PLUS1 },

  /* The NSI field in a D form instruction.  This is the same as the

     SI field, only negated.  */

#define NSI NB + 1

  { 0xffff, 0, insert_nsi, extract_nsi,

      PPC_OPERAND_NEGATIVE | PPC_OPERAND_SIGNED },

  /* The RA field in an D, DS, DQ, X, XO, M, or MDS form instruction.  */

#define RA NSI + 1

#define RA_MASK (0x1f << 16)

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_GPR },

  /* As above, but 0 in the RA field means zero, not r0.  */

#define RA0 RA + 1

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_GPR_0 },

  /* The RA field in the DQ form lq instruction, which has special

     value restrictions.  */

#define RAQ RA0 + 1

  { 0x1f, 16, insert_raq, NULL, PPC_OPERAND_GPR_0 },

  /* The RA field in a D or X form instruction which is an updating

     load, which means that the RA field may not be zero and may not

     equal the RT field.  */

#define RAL RAQ + 1

  { 0x1f, 16, insert_ral, NULL, PPC_OPERAND_GPR_0 },

  /* The RA field in an lmw instruction, which has special value

     restrictions.  */

#define RAM RAL + 1

  { 0x1f, 16, insert_ram, NULL, PPC_OPERAND_GPR_0 },

  /* The RA field in a D or X form instruction which is an updating

     store or an updating floating point load, which means that the RA

     field may not be zero.  */

#define RAS RAM + 1

  { 0x1f, 16, insert_ras, NULL, PPC_OPERAND_GPR_0 },

  /* The RA field of the tlbwe instruction, which is optional.  */

#define RAOPT RAS + 1

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_GPR | PPC_OPERAND_OPTIONAL },

  /* The RB field in an X, XO, M, or MDS form instruction.  */

#define RB RAOPT + 1

#define RB_MASK (0x1f << 11)

  { 0x1f, 11, NULL, NULL, PPC_OPERAND_GPR },

  /* The RB field in an X form instruction when it must be the same as

     the RS field in the instruction.  This is used for extended

     mnemonics like mr.  */

#define RBS RB + 1

  { 0x1f, 11, insert_rbs, extract_rbs, PPC_OPERAND_FAKE },

  /* The RS field in a D, DS, X, XFX, XS, M, MD or MDS form

     instruction or the RT field in a D, DS, X, XFX or XO form

     instruction.  */

#define RS RBS + 1

#define RT RS

#define RT_MASK (0x1f << 21)

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_GPR },

  /* The RS and RT fields of the DS form stq instruction, which have

     special value restrictions.  */

#define RSQ RS + 1

#define RTQ RSQ

  { 0x1e, 21, NULL, NULL, PPC_OPERAND_GPR_0 },

  /* The RS field of the tlbwe instruction, which is optional.  */

#define RSO RSQ + 1

#define RTO RSO

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_GPR | PPC_OPERAND_OPTIONAL },

  /* The SH field in an X or M form instruction.  */

#define SH RSO + 1

#define SH_MASK (0x1f << 11)

  /* The other UIMM field in a EVX form instruction.  */

#define EVUIMM SH

  { 0x1f, 11, NULL, NULL, 0 },

  /* The SH field in an MD form instruction.  This is split.  */

#define SH6 SH + 1

#define SH6_MASK ((0x1f << 11) | (1 << 1))

  { 0x3f, -1, insert_sh6, extract_sh6, 0 },

  /* The SH field of the tlbwe instruction, which is optional.  */

#define SHO SH6 + 1

  { 0x1f, 11, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The SI field in a D form instruction.  */

#define SI SHO + 1

  { 0xffff, 0, NULL, NULL, PPC_OPERAND_SIGNED },

  /* The SI field in a D form instruction when we accept a wide range

     of positive values.  */

#define SISIGNOPT SI + 1

  { 0xffff, 0, NULL, NULL, PPC_OPERAND_SIGNED | PPC_OPERAND_SIGNOPT },

  /* The SPR field in an XFX form instruction.  This is flipped--the

     lower 5 bits are stored in the upper 5 and vice- versa.  */

#define SPR SISIGNOPT + 1

#define PMR SPR

#define SPR_MASK (0x3ff << 11)

  { 0x3ff, 11, insert_spr, extract_spr, 0 },

  /* The BAT index number in an XFX form m[ft]ibat[lu] instruction.  */

#define SPRBAT SPR + 1

#define SPRBAT_MASK (0x3 << 17)

  { 0x3, 17, NULL, NULL, 0 },

  /* The SPRG register number in an XFX form m[ft]sprg instruction.  */

#define SPRG SPRBAT + 1

  { 0x1f, 16, insert_sprg, extract_sprg, 0 },

  /* The SR field in an X form instruction.  */

#define SR SPRG + 1

  { 0xf, 16, NULL, NULL, 0 },

  /* The STRM field in an X AltiVec form instruction.  */

#define STRM SR + 1

  { 0x3, 21, NULL, NULL, 0 },

  /* The SV field in a POWER SC form instruction.  */

#define SV STRM + 1

  { 0x3fff, 2, NULL, NULL, 0 },

  /* The TBR field in an XFX form instruction.  This is like the SPR

     field, but it is optional.  */

#define TBR SV + 1

  { 0x3ff, 11, insert_tbr, extract_tbr, PPC_OPERAND_OPTIONAL },

  /* The TO field in a D or X form instruction.  */

#define TO TBR + 1

#define TO_MASK (0x1f << 21)

  { 0x1f, 21, NULL, NULL, 0 },

  /* The UI field in a D form instruction.  */

#define UI TO + 1

  { 0xffff, 0, NULL, NULL, 0 },

  /* The VA field in a VA, VX or VXR form instruction.  */

#define VA UI + 1

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_VR },

  /* The VB field in a VA, VX or VXR form instruction.  */

#define VB VA + 1

  { 0x1f, 11, NULL, NULL, PPC_OPERAND_VR },

  /* The VC field in a VA form instruction.  */

#define VC VB + 1

  { 0x1f, 6, NULL, NULL, PPC_OPERAND_VR },

  /* The VD or VS field in a VA, VX, VXR or X form instruction.  */

#define VD VC + 1

#define VS VD

  { 0x1f, 21, NULL, NULL, PPC_OPERAND_VR },

  /* The SIMM field in a VX form instruction.  */

#define SIMM VD + 1

  { 0x1f, 16, NULL, NULL, PPC_OPERAND_SIGNED},

  /* The UIMM field in a VX form instruction, and TE in Z form.  */

#define UIMM SIMM + 1

#define TE UIMM

  { 0x1f, 16, NULL, NULL, 0 },

  /* The SHB field in a VA form instruction.  */

#define SHB UIMM + 1

  { 0xf, 6, NULL, NULL, 0 },

  /* The other UIMM field in a half word EVX form instruction.  */

#define EVUIMM_2 SHB + 1

  { 0x3e, 10, NULL, NULL, PPC_OPERAND_PARENS },

  /* The other UIMM field in a word EVX form instruction.  */

#define EVUIMM_4 EVUIMM_2 + 1

  { 0x7c, 9, NULL, NULL, PPC_OPERAND_PARENS },

  /* The other UIMM field in a double EVX form instruction.  */

#define EVUIMM_8 EVUIMM_4 + 1

  { 0xf8, 8, NULL, NULL, PPC_OPERAND_PARENS },

  /* The WS field.  */

#define WS EVUIMM_8 + 1

  { 0x7, 11, NULL, NULL, 0 },

  /* The L field in an mtmsrd or A form instruction or W in an X form.  */

#define A_L WS + 1

#define W A_L

  { 0x1, 16, NULL, NULL, PPC_OPERAND_OPTIONAL },

#define RMC A_L + 1

  { 0x3, 9, NULL, NULL, 0 },

#define R RMC + 1

  { 0x1, 16, NULL, NULL, 0 },

#define SP R + 1

  { 0x3, 19, NULL, NULL, 0 },

#define S SP + 1

  { 0x1, 20, NULL, NULL, 0 },

  /* SH field starting at bit position 16.  */

#define SH16 S + 1

  /* The DCM and DGM fields in a Z form instruction.  */

#define DCM SH16

#define DGM DCM

  { 0x3f, 10, NULL, NULL, 0 },

  /* The EH field in larx instruction.  */

#define EH SH16 + 1

  { 0x1, 0, NULL, NULL, PPC_OPERAND_OPTIONAL },

  /* The L field in an mtfsf or XFL form instruction.  */

#define XFL_L EH + 1

  { 0x1, 25, NULL, NULL, PPC_OPERAND_OPTIONAL},

};

const unsigned int num_powerpc_operands = (sizeof (powerpc_operands)

                                           / sizeof (powerpc_operands[0]));

/* The functions used to insert and extract complicated operands.  */

/* The BA field in an XL form instruction when it must be the same as

   the BT field in the same instruction.  This operand is marked FAKE.

   The insertion function just copies the BT field into the BA field,

   and the extraction function just checks that the fields are the

   same.  */

static unsigned long

insert_bat (unsigned long insn,

            long value ATTRIBUTE_UNUSED,

            int dialect ATTRIBUTE_UNUSED,

            const char **errmsg ATTRIBUTE_UNUSED)

{

  return insn | (((insn >> 21) & 0x1f) << 16);

}

static long

extract_bat (unsigned long insn,

             int dialect ATTRIBUTE_UNUSED,

             int *invalid)

{

  if (((insn >> 21) & 0x1f) != ((insn >> 16) & 0x1f))

    *invalid = 1;

  return 0;

}

/* The BB field in an XL form instruction when it must be the same as

   the BA field in the same instruction.  This operand is marked FAKE.

   The insertion function just copies the BA field into the BB field,

   and the extraction function just checks that the fields are the

   same.  */

static unsigned long

insert_bba (unsigned long insn,

            long value ATTRIBUTE_UNUSED,

            int dialect ATTRIBUTE_UNUSED,

            const char **errmsg ATTRIBUTE_UNUSED)

{

  return insn | (((insn >> 16) & 0x1f) << 11);

}

static long

extract_bba (unsigned long insn,

             int dialect ATTRIBUTE_UNUSED,

             int *invalid)

{

  if (((insn >> 16) & 0x1f) != ((insn >> 11) & 0x1f))

    *invalid = 1;

  return 0;

}

/* The BD field in a B form instruction when the - modifier is used.

   This modifier means that the branch is not expected to be taken.

   For chips built to versions of the architecture prior to version 2

   (ie. not Power4 compatible), we set the y bit of the BO field to 1

   if the offset is negative.  When extracting, we require that the y

   bit be 1 and that the offset be positive, since if the y bit is 0

   we just want to print the normal form of the instruction.

   Power4 compatible targets use two bits, "a", and "t", instead of

   the "y" bit.  "at" == 00 => no hint, "at" == 01 => unpredictable,

   "at" == 10 => not taken, "at" == 11 => taken.  The "t" bit is 00001

   in BO field, the "a" bit is 00010 for branch on CR(BI) and 01000

   for branch on CTR.  We only handle the taken/not-taken hint here.

   Note that we don't relax the conditions tested here when

   disassembling with -Many because insns using extract_bdm and

   extract_bdp always occur in pairs.  One or the other will always

   be valid.  */

static unsigned long

insert_bdm (unsigned long insn,

            long value,

            int dialect,

            const char **errmsg ATTRIBUTE_UNUSED)

{

  if ((dialect & PPC_OPCODE_POWER4) == 0)

    {

      if ((value & 0x8000) != 0)

        insn |= 1 << 21;

    }

  else

    {

      if ((insn & (0x14 << 21)) == (0x04 << 21))

        insn |= 0x02 << 21;

      else if ((insn & (0x14 << 21)) == (0x10 << 21))

        insn |= 0x08 << 21;

    }

  return insn | (value & 0xfffc);

}

static long

extract_bdm (unsigned long insn,

             int dialect,

             int *invalid)

{

  if ((dialect & PPC_OPCODE_POWER4) == 0)

    {

      if (((insn & (1 << 21)) == 0) != ((insn & (1 << 15)) == 0))

        *invalid = 1;

    }

  else

    {

      if ((insn & (0x17 << 21)) != (0x06 << 21)

          && (insn & (0x1d << 21)) != (0x18 << 21))

        *invalid = 1;

    }

  return ((insn & 0xfffc) ^ 0x8000) - 0x8000;

}

/* The BD field in a B form instruction when the + modifier is used.

   This is like BDM, above, except that the branch is expected to be

   taken.  */

static unsigned long

insert_bdp (unsigned long insn,

            long value,

            int dialect,

            const char **errmsg ATTRIBUTE_UNUSED)

{

  if ((dialect & PPC_OPCODE_POWER4) == 0)

    {

      if ((value & 0x8000) == 0)

        insn |= 1 << 21;

    }

  else

    {

      if ((insn & (0x14 << 21)) == (0x04 << 21))

        insn |= 0x03 << 21;

      else if ((insn & (0x14 << 21)) == (0x10 << 21))

        insn |= 0x09 << 21;

    }

  return insn | (value & 0xfffc);

}

static long

extract_bdp (unsigned long insn,

             int dialect,

             int *invalid)

{

  if ((dialect & PPC_OPCODE_POWER4) == 0)

    {

      if (((insn & (1 << 21)) == 0) == ((insn & (1 << 15)) == 0))

        *invalid = 1;

    }

  else

    {

      if ((insn & (0x17 << 21)) != (0x07 << 21)

          && (insn & (0x1d << 21)) != (0x19 << 21))

        *invalid = 1;

    }

  return ((insn & 0xfffc) ^ 0x8000) - 0x8000;

}

/* Check for legal values of a BO field.  */

static int

valid_bo (long value, int dialect, int extract)

{

  if ((dialect & PPC_OPCODE_POWER4) == 0)

    {

      int valid;

      /* Certain encodings have bits that are required to be zero.

         These are (z must be zero, y may be anything):

             001zy

             011zy

             1z00y

             1z01y

             1z1zz

      */

      switch (value & 0x14)

        {

        default:

        case 0:

          valid = 1;

          break;

        case 0x4:

          valid = (value & 0x2) == 0;

          break;

        case 0x10:

          valid = (value & 0x8) == 0;

          break;

        case 0x14:

          valid = value == 0x14;

          break;

        }

      /* When disassembling with -Many, accept power4 encodings too.  */

      if (valid

          || (dialect & PPC_OPCODE_ANY) == 0

          || !extract)

        return valid;

    }

  /* Certain encodings have bits that are required to be zero.

     These are (z must be zero, a & t may be anything):

         0000z

         0001z

         0100z

         0101z

         001at

         011at

         1a00t

         1a01t

         1z1zz

  */

  if ((value & 0x14) == 0)

    return (value & 0x1) == 0;

  else if ((value & 0x14) == 0x14)

    return value == 0x14;

  else

    return 1;

}

/* The BO field in a B form instruction.  Warn about attempts to set

   the field to an illegal value.  */

static unsigned long

insert_bo (unsigned long insn,

           long value,

           int dialect,

           const char **errmsg)

{

  if (!valid_bo (value, dialect, 0))

    *errmsg = _("invalid conditional option");

  return insn | ((value & 0x1f) << 21);

}

static long

extract_bo (unsigned long insn,

            int dialect,

            int *invalid)

{

  long value;

  value = (insn >> 21) & 0x1f;

  if (!valid_bo (value, dialect, 1))

    *invalid = 1;

  return value;

}

/* The BO field in a B form instruction when the + or - modifier is

   used.  This is like the BO field, but it must be even.  When

   extracting it, we force it to be even.  */

static unsigned long

insert_boe (unsigned long insn,

            long value,

            int dialect,

            const char **errmsg)

{

  if (!valid_bo (value, dialect, 0))

    *errmsg = _("invalid conditional option");

  else if ((value & 1) != 0)

    *errmsg = _("attempt to set y bit when using + or - modifier");

  return insn | ((value & 0x1f) << 21);

}

static long

extract_boe (unsigned long insn,

             int dialect,

             int *invalid)

{

  long value;

  value = (insn >> 21) & 0x1f;

  if (!valid_bo (value, dialect, 1))

    *invalid = 1;

  return value & 0x1e;

}

/* FXM mask in mfcr and mtcrf instructions.  */

static unsigned long

insert_fxm (unsigned long insn,

            long value,

            int dialect,

            const char **errmsg)

{

  /* If we're handling the mfocrf and mtocrf insns ensure that exactly

     one bit of the mask field is set.  */

  if ((insn & (1 << 20)) != 0)

    {

      if (value == 0 || (value & -value) != value)

        {

          *errmsg = _("invalid mask field");

          value = 0;

        }

    }

  /* If the optional field on mfcr is missing that means we want to use

     the old form of the instruction that moves the whole cr.  In that

     case we'll have VALUE zero.  There doesn't seem to be a way to

     distinguish this from the case where someone writes mfcr %r3,0.  */

  else if (value == 0)

    ;

  /* If only one bit of the FXM field is set, we can use the new form

     of the instruction, which is faster.  Unlike the Power4 branch hint

     encoding, this is not backward compatible.  Do not generate the

     new form unless -mpower4 has been given, or -many and the two

     operand form of mfcr was used.  */

  else if ((value & -value) == value

           && ((dialect & PPC_OPCODE_POWER4) != 0

               || ((dialect & PPC_OPCODE_ANY) != 0

                   && (insn & (0x3ff << 1)) == 19 << 1)))

    insn |= 1 << 20;

  /* Any other value on mfcr is an error.  */

  else if ((insn & (0x3ff << 1)) == 19 << 1)

    {

      *errmsg = _("ignoring invalid mfcr mask");

      value = 0;

    }

  return insn | ((value & 0xff) << 12);