/**

 * $Id$

 * 

 * SH4 => x86 translation. This version does no real optimization, it just

 * outputs straight-line x86 code - it mainly exists to provide a baseline

 * to test the optimizing versions against.

 *

 * Copyright (c) 2007 Nathan Keynes.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 */

#include <assert.h>

#include <math.h>

#ifndef NDEBUG

#define DEBUG_JUMPS 1

#endif

#include "sh4/xltcache.h"

#include "sh4/sh4core.h"

#include "sh4/sh4trans.h"

#include "sh4/sh4stat.h"

#include "sh4/sh4mmio.h"

#include "sh4/x86op.h"

#include "clock.h"

#define DEFAULT_BACKPATCH_SIZE 4096

struct backpatch_record {

    uint32_t fixup_offset;

    uint32_t fixup_icount;

    int32_t exc_code;

};

#define DELAY_NONE 0

#define DELAY_PC 1

#define DELAY_PC_PR 2

/** 

 * Struct to manage internal translation state. This state is not saved -

 * it is only valid between calls to sh4_translate_begin_block() and

 * sh4_translate_end_block()

 */

struct sh4_x86_state {

    int in_delay_slot;

    gboolean priv_checked; /* true if we've already checked the cpu mode. */

    gboolean fpuen_checked; /* true if we've already checked fpu enabled. */

    gboolean branch_taken; /* true if we branched unconditionally */

    uint32_t block_start_pc;

    uint32_t stack_posn;   /* Trace stack height for alignment purposes */

    int tstate;

    /* mode flags */

    gboolean tlb_on; /* True if tlb translation is active */

    /* Allocated memory for the (block-wide) back-patch list */

    struct backpatch_record *backpatch_list;

    uint32_t backpatch_posn;

    uint32_t backpatch_size;

};

#define TSTATE_NONE -1

#define TSTATE_O    0

#define TSTATE_C    2

#define TSTATE_E    4

#define TSTATE_NE   5

#define TSTATE_G    0xF

#define TSTATE_GE   0xD

#define TSTATE_A    7

#define TSTATE_AE   3

#ifdef ENABLE_SH4STATS

#define COUNT_INST(id) load_imm32(R_EAX,id); call_func1(sh4_stats_add, R_EAX); sh4_x86.tstate = TSTATE_NONE

#else

#define COUNT_INST(id)

#endif

/** Branch if T is set (either in the current cflags, or in sh4r.t) */

#define JT_rel8(label) if( sh4_x86.tstate == TSTATE_NONE ) { \

	CMP_imm8s_sh4r( 1, R_T ); sh4_x86.tstate = TSTATE_E; } \

    OP(0x70+sh4_x86.tstate); MARK_JMP8(label); OP(-1)

/** Branch if T is clear (either in the current cflags or in sh4r.t) */

#define JF_rel8(label) if( sh4_x86.tstate == TSTATE_NONE ) { \

	CMP_imm8s_sh4r( 1, R_T ); sh4_x86.tstate = TSTATE_E; } \

    OP(0x70+ (sh4_x86.tstate^1)); MARK_JMP8(label); OP(-1)

static struct sh4_x86_state sh4_x86;

static uint32_t max_int = 0x7FFFFFFF;

static uint32_t min_int = 0x80000000;

static uint32_t save_fcw; /* save value for fpu control word */

static uint32_t trunc_fcw = 0x0F7F; /* fcw value for truncation mode */

void sh4_translate_init(void)

{

    sh4_x86.backpatch_list = malloc(DEFAULT_BACKPATCH_SIZE);

    sh4_x86.backpatch_size = DEFAULT_BACKPATCH_SIZE / sizeof(struct backpatch_record);

}

static void sh4_x86_add_backpatch( uint8_t *fixup_addr, uint32_t fixup_pc, uint32_t exc_code )

{

    if( sh4_x86.backpatch_posn == sh4_x86.backpatch_size ) {

	sh4_x86.backpatch_size <<= 1;

	sh4_x86.backpatch_list = realloc( sh4_x86.backpatch_list, 

					  sh4_x86.backpatch_size * sizeof(struct backpatch_record));

	assert( sh4_x86.backpatch_list != NULL );

    }

    if( sh4_x86.in_delay_slot ) {

	fixup_pc -= 2;

    }

    sh4_x86.backpatch_list[sh4_x86.backpatch_posn].fixup_offset = 

	((uint8_t *)fixup_addr) - ((uint8_t *)xlat_current_block->code);

    sh4_x86.backpatch_list[sh4_x86.backpatch_posn].fixup_icount = (fixup_pc - sh4_x86.block_start_pc)>>1;

    sh4_x86.backpatch_list[sh4_x86.backpatch_posn].exc_code = exc_code;

    sh4_x86.backpatch_posn++;

}

/**

 * Emit an instruction to load an SH4 reg into a real register

 */

static inline void load_reg( int x86reg, int sh4reg ) 

{

    /* mov [bp+n], reg */

    OP(0x8B);

    OP(0x45 + (x86reg<<3));

    OP(REG_OFFSET(r[sh4reg]));

}

static inline void load_reg16s( int x86reg, int sh4reg )

{

    OP(0x0F);

    OP(0xBF);

    MODRM_r32_sh4r(x86reg, REG_OFFSET(r[sh4reg]));

}

static inline void load_reg16u( int x86reg, int sh4reg )

{

    OP(0x0F);

    OP(0xB7);

    MODRM_r32_sh4r(x86reg, REG_OFFSET(r[sh4reg]));

}

#define load_spreg( x86reg, regoff ) MOV_sh4r_r32( regoff, x86reg )

#define store_spreg( x86reg, regoff ) MOV_r32_sh4r( x86reg, regoff )

/**

 * Emit an instruction to load an immediate value into a register

 */

static inline void load_imm32( int x86reg, uint32_t value ) {

    /* mov #value, reg */

    OP(0xB8 + x86reg);

    OP32(value);

}

/**

 * Load an immediate 64-bit quantity (note: x86-64 only)

 */

static inline void load_imm64( int x86reg, uint64_t value ) {

    /* mov #value, reg */

    REXW();

    OP(0xB8 + x86reg);

    OP64(value);

}

/**

 * Emit an instruction to store an SH4 reg (RN)

 */

void static inline store_reg( int x86reg, int sh4reg ) {

    /* mov reg, [bp+n] */

    OP(0x89);

    OP(0x45 + (x86reg<<3));

    OP(REG_OFFSET(r[sh4reg]));

}

/**

 * Load an FR register (single-precision floating point) into an integer x86

 * register (eg for register-to-register moves)

 */

#define load_fr(reg,frm)  OP(0x8B); MODRM_r32_ebp32(reg, REG_OFFSET(fr[0][(frm)^1]) )

#define load_xf(reg,frm)  OP(0x8B); MODRM_r32_ebp32(reg, REG_OFFSET(fr[1][(frm)^1]) )

/**

 * Load the low half of a DR register (DR or XD) into an integer x86 register 

 */

#define load_dr0(reg,frm) OP(0x8B); MODRM_r32_ebp32(reg, REG_OFFSET(fr[frm&1][frm|0x01]) )

#define load_dr1(reg,frm) OP(0x8B); MODRM_r32_ebp32(reg, REG_OFFSET(fr[frm&1][frm&0x0E]) )

/**

 * Store an FR register (single-precision floating point) from an integer x86+

 * register (eg for register-to-register moves)

 */

#define store_fr(reg,frm) OP(0x89); MODRM_r32_ebp32( reg, REG_OFFSET(fr[0][(frm)^1]) )

#define store_xf(reg,frm) OP(0x89); MODRM_r32_ebp32( reg, REG_OFFSET(fr[1][(frm)^1]) )

#define store_dr0(reg,frm) OP(0x89); MODRM_r32_ebp32( reg, REG_OFFSET(fr[frm&1][frm|0x01]) )

#define store_dr1(reg,frm) OP(0x89); MODRM_r32_ebp32( reg, REG_OFFSET(fr[frm&1][frm&0x0E]) )

#define push_fpul()  FLDF_sh4r(R_FPUL)

#define pop_fpul()   FSTPF_sh4r(R_FPUL)

#define push_fr(frm) FLDF_sh4r( REG_OFFSET(fr[0][(frm)^1]) )

#define pop_fr(frm)  FSTPF_sh4r( REG_OFFSET(fr[0][(frm)^1]) )

#define push_xf(frm) FLDF_sh4r( REG_OFFSET(fr[1][(frm)^1]) )

#define pop_xf(frm)  FSTPF_sh4r( REG_OFFSET(fr[1][(frm)^1]) )

#define push_dr(frm) FLDD_sh4r( REG_OFFSET(fr[0][(frm)&0x0E]) )

#define pop_dr(frm)  FSTPD_sh4r( REG_OFFSET(fr[0][(frm)&0x0E]) )

#define push_xdr(frm) FLDD_sh4r( REG_OFFSET(fr[1][(frm)&0x0E]) )

#define pop_xdr(frm)  FSTPD_sh4r( REG_OFFSET(fr[1][(frm)&0x0E]) )

/* Exception checks - Note that all exception checks will clobber EAX */

#define check_priv( ) \

    if( !sh4_x86.priv_checked ) { \

	sh4_x86.priv_checked = TRUE;\

	load_spreg( R_EAX, R_SR );\

	AND_imm32_r32( SR_MD, R_EAX );\

	if( sh4_x86.in_delay_slot ) {\

	    JE_exc( EXC_SLOT_ILLEGAL );\

	} else {\

	    JE_exc( EXC_ILLEGAL );\

	}\

    }\

#define check_fpuen( ) \

    if( !sh4_x86.fpuen_checked ) {\

	sh4_x86.fpuen_checked = TRUE;\

	load_spreg( R_EAX, R_SR );\

	AND_imm32_r32( SR_FD, R_EAX );\

	if( sh4_x86.in_delay_slot ) {\

	    JNE_exc(EXC_SLOT_FPU_DISABLED);\

	} else {\

	    JNE_exc(EXC_FPU_DISABLED);\

	}\

    }

#define check_ralign16( x86reg ) \

    TEST_imm32_r32( 0x00000001, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_READ)

#define check_walign16( x86reg ) \

    TEST_imm32_r32( 0x00000001, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_WRITE);

#define check_ralign32( x86reg ) \

    TEST_imm32_r32( 0x00000003, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_READ)

#define check_walign32( x86reg ) \

    TEST_imm32_r32( 0x00000003, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_WRITE);

#define check_ralign64( x86reg ) \

    TEST_imm32_r32( 0x00000007, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_READ)

#define check_walign64( x86reg ) \

    TEST_imm32_r32( 0x00000007, x86reg ); \

    JNE_exc(EXC_DATA_ADDR_WRITE);

#define UNDEF()

#define MEM_RESULT(value_reg) if(value_reg != R_EAX) { MOV_r32_r32(R_EAX,value_reg); }

#define MEM_READ_BYTE( addr_reg, value_reg ) call_func1(sh4_read_byte, addr_reg ); MEM_RESULT(value_reg)

#define MEM_READ_WORD( addr_reg, value_reg ) call_func1(sh4_read_word, addr_reg ); MEM_RESULT(value_reg)

#define MEM_READ_LONG( addr_reg, value_reg ) call_func1(sh4_read_long, addr_reg ); MEM_RESULT(value_reg)

#define MEM_WRITE_BYTE( addr_reg, value_reg ) call_func2(sh4_write_byte, addr_reg, value_reg)

#define MEM_WRITE_WORD( addr_reg, value_reg ) call_func2(sh4_write_word, addr_reg, value_reg)

#define MEM_WRITE_LONG( addr_reg, value_reg ) call_func2(sh4_write_long, addr_reg, value_reg)

/**

 * Perform MMU translation on the address in addr_reg for a read operation, iff the TLB is turned 

 * on, otherwise do nothing. Clobbers EAX, ECX and EDX. May raise a TLB exception or address error.

 */

#define MMU_TRANSLATE_READ( addr_reg ) if( sh4_x86.tlb_on ) { call_func1(mmu_vma_to_phys_read, addr_reg); CMP_imm32_r32(MMU_VMA_ERROR, R_EAX); JE_exc(-1); MEM_RESULT(addr_reg); }

#define MMU_TRANSLATE_READ_EXC( addr_reg, exc_code ) if( sh4_x86.tlb_on ) { call_func1(mmu_vma_to_phys_read, addr_reg); CMP_imm32_r32(MMU_VMA_ERROR, R_EAX); JE_exc(exc_code); MEM_RESULT(addr_reg) }

/**

 * Perform MMU translation on the address in addr_reg for a write operation, iff the TLB is turned 

 * on, otherwise do nothing. Clobbers EAX, ECX and EDX. May raise a TLB exception or address error.

 */

#define MMU_TRANSLATE_WRITE( addr_reg ) if( sh4_x86.tlb_on ) { call_func1(mmu_vma_to_phys_write, addr_reg); CMP_imm32_r32(MMU_VMA_ERROR, R_EAX); JE_exc(-1); MEM_RESULT(addr_reg); }

#define MEM_READ_SIZE (CALL_FUNC1_SIZE)

#define MEM_WRITE_SIZE (CALL_FUNC2_SIZE)

#define MMU_TRANSLATE_SIZE (sh4_x86.tlb_on ? (CALL_FUNC1_SIZE + 12) : 0 )

#define SLOTILLEGAL() JMP_exc(EXC_SLOT_ILLEGAL); sh4_x86.in_delay_slot = DELAY_NONE; return 1;

/****** Import appropriate calling conventions ******/

#if SIZEOF_VOID_P == 8

#include "sh4/ia64abi.h"

#else /* 32-bit system */

#ifdef APPLE_BUILD

#include "sh4/ia32mac.h"

#else

#include "sh4/ia32abi.h"

#endif

#endif

uint32_t sh4_translate_end_block_size()

{

    if( sh4_x86.backpatch_posn <= 3 ) {

	return EPILOGUE_SIZE + (sh4_x86.backpatch_posn*12);

    } else {

	return EPILOGUE_SIZE + 48 + (sh4_x86.backpatch_posn-3)*15;

    }

}

/**

 * Embed a breakpoint into the generated code

 */

void sh4_translate_emit_breakpoint( sh4vma_t pc )

{

    load_imm32( R_EAX, pc );

    call_func1( sh4_translate_breakpoint_hit, R_EAX );

}

#define UNTRANSLATABLE(pc) !IS_IN_ICACHE(pc)

/**

 * Embed a call to sh4_execute_instruction for situations that we

 * can't translate (just page-crossing delay slots at the moment).

 * Caller is responsible for setting new_pc before calling this function.

 *

 * Performs:

 *   Set PC = endpc

 *   Set sh4r.in_delay_slot = sh4_x86.in_delay_slot

 *   Update slice_cycle for endpc+2 (single step doesn't update slice_cycle)

 *   Call sh4_execute_instruction

 *   Call xlat_get_code_by_vma / xlat_get_code as for normal exit

 */

void exit_block_emu( sh4vma_t endpc )

{

    load_imm32( R_ECX, endpc - sh4_x86.block_start_pc );   // 5

    ADD_r32_sh4r( R_ECX, R_PC );

    load_imm32( R_ECX, (((endpc - sh4_x86.block_start_pc)>>1)+1)*sh4_cpu_period ); // 5

    ADD_r32_sh4r( R_ECX, REG_OFFSET(slice_cycle) );     // 6

    load_imm32( R_ECX, sh4_x86.in_delay_slot ? 1 : 0 );

    store_spreg( R_ECX, REG_OFFSET(in_delay_slot) );

    call_func0( sh4_execute_instruction );    

    load_spreg( R_EAX, R_PC );

    if( sh4_x86.tlb_on ) {

	call_func1(xlat_get_code_by_vma,R_EAX);

    } else {

	call_func1(xlat_get_code,R_EAX);

    }

    AND_imm8s_rptr( 0xFC, R_EAX );

    POP_r32(R_EBP);

    RET();

} 

/**

 * Translate a single instruction. Delayed branches are handled specially

 * by translating both branch and delayed instruction as a single unit (as

 * 

 * The instruction MUST be in the icache (assert check)

 *

 * @return true if the instruction marks the end of a basic block

 * (eg a branch or 

 */

uint32_t sh4_translate_instruction( sh4vma_t pc )

{

    uint32_t ir;

    /* Read instruction from icache */

    assert( IS_IN_ICACHE(pc) );

    ir = *(uint16_t *)GET_ICACHE_PTR(pc);

	/* PC is not in the current icache - this usually means we're running

	 * with MMU on, and we've gone past the end of the page. And since 

	 * sh4_translate_block is pretty careful about this, it means we're

	 * almost certainly in a delay slot.

	 *

	 * Since we can't assume the page is present (and we can't fault it in

	 * at this point, inline a call to sh4_execute_instruction (with a few

	 * small repairs to cope with the different environment).

	 */

    if( !sh4_x86.in_delay_slot ) {

	sh4_translate_add_recovery( (pc - sh4_x86.block_start_pc)>>1 );

    }

%%

/* ALU operations */

ADD Rm, Rn {:

    COUNT_INST(I_ADD);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    ADD_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

ADD #imm, Rn {:  

    COUNT_INST(I_ADDI);

    load_reg( R_EAX, Rn );

    ADD_imm8s_r32( imm, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

ADDC Rm, Rn {:

    COUNT_INST(I_ADDC);

    if( sh4_x86.tstate != TSTATE_C ) {

	LDC_t();

    }

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    ADC_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

ADDV Rm, Rn {:

    COUNT_INST(I_ADDV);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    ADD_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    SETO_t();

    sh4_x86.tstate = TSTATE_O;

:}

AND Rm, Rn {:

    COUNT_INST(I_AND);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    AND_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

AND #imm, R0 {:  

    COUNT_INST(I_ANDI);

    load_reg( R_EAX, 0 );

    AND_imm32_r32(imm, R_EAX); 

    store_reg( R_EAX, 0 );

    sh4_x86.tstate = TSTATE_NONE;

:}

AND.B #imm, @(R0, GBR) {: 

    COUNT_INST(I_ANDB);

    load_reg( R_EAX, 0 );

    load_spreg( R_ECX, R_GBR );

    ADD_r32_r32( R_ECX, R_EAX );

    MMU_TRANSLATE_WRITE( R_EAX );

    PUSH_realigned_r32(R_EAX);

    MEM_READ_BYTE( R_EAX, R_EAX );

    POP_realigned_r32(R_ECX);

    AND_imm32_r32(imm, R_EAX );

    MEM_WRITE_BYTE( R_ECX, R_EAX );

    sh4_x86.tstate = TSTATE_NONE;

:}

CMP/EQ Rm, Rn {:  

    COUNT_INST(I_CMPEQ);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    CMP_r32_r32( R_EAX, R_ECX );

    SETE_t();

    sh4_x86.tstate = TSTATE_E;

:}

CMP/EQ #imm, R0 {:  

    COUNT_INST(I_CMPEQI);

    load_reg( R_EAX, 0 );

    CMP_imm8s_r32(imm, R_EAX);

    SETE_t();

    sh4_x86.tstate = TSTATE_E;

:}

CMP/GE Rm, Rn {:  

    COUNT_INST(I_CMPGE);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    CMP_r32_r32( R_EAX, R_ECX );

    SETGE_t();

    sh4_x86.tstate = TSTATE_GE;

:}

CMP/GT Rm, Rn {: 

    COUNT_INST(I_CMPGT);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    CMP_r32_r32( R_EAX, R_ECX );

    SETG_t();

    sh4_x86.tstate = TSTATE_G;

:}

CMP/HI Rm, Rn {:  

    COUNT_INST(I_CMPHI);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    CMP_r32_r32( R_EAX, R_ECX );

    SETA_t();

    sh4_x86.tstate = TSTATE_A;

:}

CMP/HS Rm, Rn {: 

    COUNT_INST(I_CMPHS);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    CMP_r32_r32( R_EAX, R_ECX );

    SETAE_t();

    sh4_x86.tstate = TSTATE_AE;

 :}

CMP/PL Rn {: 

    COUNT_INST(I_CMPPL);

    load_reg( R_EAX, Rn );

    CMP_imm8s_r32( 0, R_EAX );

    SETG_t();

    sh4_x86.tstate = TSTATE_G;

:}

CMP/PZ Rn {:  

    COUNT_INST(I_CMPPZ);

    load_reg( R_EAX, Rn );

    CMP_imm8s_r32( 0, R_EAX );

    SETGE_t();

    sh4_x86.tstate = TSTATE_GE;

:}

CMP/STR Rm, Rn {:  

    COUNT_INST(I_CMPSTR);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    XOR_r32_r32( R_ECX, R_EAX );

    TEST_r8_r8( R_AL, R_AL );

    JE_rel8(target1);

    TEST_r8_r8( R_AH, R_AH );

    JE_rel8(target2);

    SHR_imm8_r32( 16, R_EAX );

    TEST_r8_r8( R_AL, R_AL );

    JE_rel8(target3);

    TEST_r8_r8( R_AH, R_AH );

    JMP_TARGET(target1);

    JMP_TARGET(target2);

    JMP_TARGET(target3);

    SETE_t();

    sh4_x86.tstate = TSTATE_E;

:}

DIV0S Rm, Rn {:

    COUNT_INST(I_DIV0S);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    SHR_imm8_r32( 31, R_EAX );

    SHR_imm8_r32( 31, R_ECX );

    store_spreg( R_EAX, R_M );

    store_spreg( R_ECX, R_Q );

    CMP_r32_r32( R_EAX, R_ECX );

    SETNE_t();

    sh4_x86.tstate = TSTATE_NE;

:}

DIV0U {:  

    COUNT_INST(I_DIV0U);

    XOR_r32_r32( R_EAX, R_EAX );

    store_spreg( R_EAX, R_Q );

    store_spreg( R_EAX, R_M );

    store_spreg( R_EAX, R_T );

    sh4_x86.tstate = TSTATE_C; // works for DIV1

:}

DIV1 Rm, Rn {:

    COUNT_INST(I_DIV1);

    load_spreg( R_ECX, R_M );

    load_reg( R_EAX, Rn );

    if( sh4_x86.tstate != TSTATE_C ) {

	LDC_t();

    }

    RCL1_r32( R_EAX );

    SETC_r8( R_DL ); // Q'

    CMP_sh4r_r32( R_Q, R_ECX );

    JE_rel8(mqequal);

    ADD_sh4r_r32( REG_OFFSET(r[Rm]), R_EAX );

    JMP_rel8(end);

    JMP_TARGET(mqequal);

    SUB_sh4r_r32( REG_OFFSET(r[Rm]), R_EAX );

    JMP_TARGET(end);

    store_reg( R_EAX, Rn ); // Done with Rn now

    SETC_r8(R_AL); // tmp1

    XOR_r8_r8( R_DL, R_AL ); // Q' = Q ^ tmp1

    XOR_r8_r8( R_AL, R_CL ); // Q'' = Q' ^ M

    store_spreg( R_ECX, R_Q );

    XOR_imm8s_r32( 1, R_AL );   // T = !Q'

    MOVZX_r8_r32( R_AL, R_EAX );

    store_spreg( R_EAX, R_T );

    sh4_x86.tstate = TSTATE_NONE;

:}

DMULS.L Rm, Rn {:  

    COUNT_INST(I_DMULS);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    IMUL_r32(R_ECX);

    store_spreg( R_EDX, R_MACH );

    store_spreg( R_EAX, R_MACL );

    sh4_x86.tstate = TSTATE_NONE;

:}

DMULU.L Rm, Rn {:  

    COUNT_INST(I_DMULU);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    MUL_r32(R_ECX);

    store_spreg( R_EDX, R_MACH );

    store_spreg( R_EAX, R_MACL );    

    sh4_x86.tstate = TSTATE_NONE;

:}

DT Rn {:  

    COUNT_INST(I_DT);

    load_reg( R_EAX, Rn );

    ADD_imm8s_r32( -1, R_EAX );

    store_reg( R_EAX, Rn );

    SETE_t();

    sh4_x86.tstate = TSTATE_E;

:}

EXTS.B Rm, Rn {:  

    COUNT_INST(I_EXTSB);

    load_reg( R_EAX, Rm );

    MOVSX_r8_r32( R_EAX, R_EAX );

    store_reg( R_EAX, Rn );

:}

EXTS.W Rm, Rn {:  

    COUNT_INST(I_EXTSW);

    load_reg( R_EAX, Rm );

    MOVSX_r16_r32( R_EAX, R_EAX );

    store_reg( R_EAX, Rn );

:}

EXTU.B Rm, Rn {:  

    COUNT_INST(I_EXTUB);

    load_reg( R_EAX, Rm );

    MOVZX_r8_r32( R_EAX, R_EAX );

    store_reg( R_EAX, Rn );

:}

EXTU.W Rm, Rn {:  

    COUNT_INST(I_EXTUW);

    load_reg( R_EAX, Rm );

    MOVZX_r16_r32( R_EAX, R_EAX );

    store_reg( R_EAX, Rn );

:}

MAC.L @Rm+, @Rn+ {:

    COUNT_INST(I_MACL);

    if( Rm == Rn ) {

	load_reg( R_EAX, Rm );

	check_ralign32( R_EAX );

	MMU_TRANSLATE_READ( R_EAX );

	PUSH_realigned_r32( R_EAX );

	load_reg( R_EAX, Rn );

	ADD_imm8s_r32( 4, R_EAX );

	MMU_TRANSLATE_READ_EXC( R_EAX, -5 );

	ADD_imm8s_sh4r( 8, REG_OFFSET(r[Rn]) );

	// Note translate twice in case of page boundaries. Maybe worth

	// adding a page-boundary check to skip the second translation

    } else {

	load_reg( R_EAX, Rm );

	check_ralign32( R_EAX );

	MMU_TRANSLATE_READ( R_EAX );

	load_reg( R_ECX, Rn );

	check_ralign32( R_ECX );

	PUSH_realigned_r32( R_EAX );

	MMU_TRANSLATE_READ_EXC( R_ECX, -5 );

	MOV_r32_r32( R_ECX, R_EAX );

	ADD_imm8s_sh4r( 4, REG_OFFSET(r[Rn]) );

	ADD_imm8s_sh4r( 4, REG_OFFSET(r[Rm]) );

    }

    MEM_READ_LONG( R_EAX, R_EAX );

    POP_r32( R_ECX );

    PUSH_r32( R_EAX );

    MEM_READ_LONG( R_ECX, R_EAX );

    POP_realigned_r32( R_ECX );

    IMUL_r32( R_ECX );

    ADD_r32_sh4r( R_EAX, R_MACL );

    ADC_r32_sh4r( R_EDX, R_MACH );

    load_spreg( R_ECX, R_S );

    TEST_r32_r32(R_ECX, R_ECX);

    JE_rel8( nosat );

    call_func0( signsat48 );

    JMP_TARGET( nosat );

    sh4_x86.tstate = TSTATE_NONE;

:}

MAC.W @Rm+, @Rn+ {:  

    COUNT_INST(I_MACW);

    if( Rm == Rn ) {

	load_reg( R_EAX, Rm );

	check_ralign16( R_EAX );

	MMU_TRANSLATE_READ( R_EAX );

	PUSH_realigned_r32( R_EAX );

	load_reg( R_EAX, Rn );

	ADD_imm8s_r32( 2, R_EAX );

	MMU_TRANSLATE_READ_EXC( R_EAX, -5 );

	ADD_imm8s_sh4r( 4, REG_OFFSET(r[Rn]) );

	// Note translate twice in case of page boundaries. Maybe worth

	// adding a page-boundary check to skip the second translation

    } else {

	load_reg( R_EAX, Rm );

	check_ralign16( R_EAX );

	MMU_TRANSLATE_READ( R_EAX );

	load_reg( R_ECX, Rn );

	check_ralign16( R_ECX );

	PUSH_realigned_r32( R_EAX );

	MMU_TRANSLATE_READ_EXC( R_ECX, -5 );

	MOV_r32_r32( R_ECX, R_EAX );

	ADD_imm8s_sh4r( 2, REG_OFFSET(r[Rn]) );

	ADD_imm8s_sh4r( 2, REG_OFFSET(r[Rm]) );

    }

    MEM_READ_WORD( R_EAX, R_EAX );

    POP_r32( R_ECX );

    PUSH_r32( R_EAX );

    MEM_READ_WORD( R_ECX, R_EAX );

    POP_realigned_r32( R_ECX );

    IMUL_r32( R_ECX );

    load_spreg( R_ECX, R_S );

    TEST_r32_r32( R_ECX, R_ECX );

    JE_rel8( nosat );

    ADD_r32_sh4r( R_EAX, R_MACL );  // 6

    JNO_rel8( end );            // 2

    load_imm32( R_EDX, 1 );         // 5

    store_spreg( R_EDX, R_MACH );   // 6

    JS_rel8( positive );        // 2

    load_imm32( R_EAX, 0x80000000 );// 5

    store_spreg( R_EAX, R_MACL );   // 6

    JMP_rel8(end2);           // 2

    JMP_TARGET(positive);

    load_imm32( R_EAX, 0x7FFFFFFF );// 5

    store_spreg( R_EAX, R_MACL );   // 6

    JMP_rel8(end3);            // 2

    JMP_TARGET(nosat);

    ADD_r32_sh4r( R_EAX, R_MACL );  // 6

    ADC_r32_sh4r( R_EDX, R_MACH );  // 6

    JMP_TARGET(end);

    JMP_TARGET(end2);

    JMP_TARGET(end3);

    sh4_x86.tstate = TSTATE_NONE;

:}

MOVT Rn {:  

    COUNT_INST(I_MOVT);

    load_spreg( R_EAX, R_T );

    store_reg( R_EAX, Rn );

:}

MUL.L Rm, Rn {:  

    COUNT_INST(I_MULL);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    MUL_r32( R_ECX );

    store_spreg( R_EAX, R_MACL );

    sh4_x86.tstate = TSTATE_NONE;

:}

MULS.W Rm, Rn {:

    COUNT_INST(I_MULSW);

    load_reg16s( R_EAX, Rm );

    load_reg16s( R_ECX, Rn );

    MUL_r32( R_ECX );

    store_spreg( R_EAX, R_MACL );

    sh4_x86.tstate = TSTATE_NONE;

:}

MULU.W Rm, Rn {:  

    COUNT_INST(I_MULUW);

    load_reg16u( R_EAX, Rm );

    load_reg16u( R_ECX, Rn );

    MUL_r32( R_ECX );

    store_spreg( R_EAX, R_MACL );

    sh4_x86.tstate = TSTATE_NONE;

:}

NEG Rm, Rn {:

    COUNT_INST(I_NEG);

    load_reg( R_EAX, Rm );

    NEG_r32( R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

NEGC Rm, Rn {:  

    COUNT_INST(I_NEGC);

    load_reg( R_EAX, Rm );

    XOR_r32_r32( R_ECX, R_ECX );

    LDC_t();

    SBB_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

NOT Rm, Rn {:  

    COUNT_INST(I_NOT);

    load_reg( R_EAX, Rm );

    NOT_r32( R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

OR Rm, Rn {:  

    COUNT_INST(I_OR);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );

    OR_r32_r32( R_EAX, R_ECX );

    store_reg( R_ECX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

OR #imm, R0 {:

    COUNT_INST(I_ORI);

    load_reg( R_EAX, 0 );

    OR_imm32_r32(imm, R_EAX);

    store_reg( R_EAX, 0 );

    sh4_x86.tstate = TSTATE_NONE;

:}

OR.B #imm, @(R0, GBR) {:  

    COUNT_INST(I_ORB);

    load_reg( R_EAX, 0 );

    load_spreg( R_ECX, R_GBR );

    ADD_r32_r32( R_ECX, R_EAX );

    MMU_TRANSLATE_WRITE( R_EAX );

    PUSH_realigned_r32(R_EAX);

    MEM_READ_BYTE( R_EAX, R_EAX );

    POP_realigned_r32(R_ECX);

    OR_imm32_r32(imm, R_EAX );

    MEM_WRITE_BYTE( R_ECX, R_EAX );

    sh4_x86.tstate = TSTATE_NONE;

:}

ROTCL Rn {:

    COUNT_INST(I_ROTCL);

    load_reg( R_EAX, Rn );

    if( sh4_x86.tstate != TSTATE_C ) {

	LDC_t();

    }

    RCL1_r32( R_EAX );

    store_reg( R_EAX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

ROTCR Rn {:  

    COUNT_INST(I_ROTCR);

    load_reg( R_EAX, Rn );

    if( sh4_x86.tstate != TSTATE_C ) {

	LDC_t();

    }

    RCR1_r32( R_EAX );

    store_reg( R_EAX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

ROTL Rn {:  

    COUNT_INST(I_ROTL);

    load_reg( R_EAX, Rn );

    ROL1_r32( R_EAX );

    store_reg( R_EAX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

ROTR Rn {:  

    COUNT_INST(I_ROTR);

    load_reg( R_EAX, Rn );

    ROR1_r32( R_EAX );

    store_reg( R_EAX, Rn );

    SETC_t();

    sh4_x86.tstate = TSTATE_C;

:}

SHAD Rm, Rn {:

    COUNT_INST(I_SHAD);

    /* Annoyingly enough, not directly convertible */

    load_reg( R_EAX, Rn );

    load_reg( R_ECX, Rm );

    CMP_imm32_r32( 0, R_ECX );

    JGE_rel8(doshl);

    NEG_r32( R_ECX );      // 2

    AND_imm8_r8( 0x1F, R_CL ); // 3

    JE_rel8(emptysar);     // 2

    SAR_r32_CL( R_EAX );       // 2

    JMP_rel8(end);          // 2

    JMP_TARGET(emptysar);

    SAR_imm8_r32(31, R_EAX );  // 3

    JMP_rel8(end2);

    JMP_TARGET(doshl);

    AND_imm8_r8( 0x1F, R_CL ); // 3

    SHL_r32_CL( R_EAX );       // 2

    JMP_TARGET(end);

    JMP_TARGET(end2);

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLD Rm, Rn {:  

    COUNT_INST(I_SHLD);

    load_reg( R_EAX, Rn );

    load_reg( R_ECX, Rm );

    CMP_imm32_r32( 0, R_ECX );

    JGE_rel8(doshl);

    NEG_r32( R_ECX );      // 2

    AND_imm8_r8( 0x1F, R_CL ); // 3

    JE_rel8(emptyshr );

    SHR_r32_CL( R_EAX );       // 2

    JMP_rel8(end);          // 2

    JMP_TARGET(emptyshr);

    XOR_r32_r32( R_EAX, R_EAX );

    JMP_rel8(end2);

    JMP_TARGET(doshl);

    AND_imm8_r8( 0x1F, R_CL ); // 3

    SHL_r32_CL( R_EAX );       // 2

    JMP_TARGET(end);

    JMP_TARGET(end2);

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHAL Rn {: 

    COUNT_INST(I_SHAL);

    load_reg( R_EAX, Rn );

    SHL1_r32( R_EAX );

    SETC_t();

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_C;

:}

SHAR Rn {:  

    COUNT_INST(I_SHAR);

    load_reg( R_EAX, Rn );

    SAR1_r32( R_EAX );

    SETC_t();

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_C;

:}

SHLL Rn {:  

    COUNT_INST(I_SHLL);

    load_reg( R_EAX, Rn );

    SHL1_r32( R_EAX );

    SETC_t();

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_C;

:}

SHLL2 Rn {:

    COUNT_INST(I_SHLL);

    load_reg( R_EAX, Rn );

    SHL_imm8_r32( 2, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLL8 Rn {:  

    COUNT_INST(I_SHLL);

    load_reg( R_EAX, Rn );

    SHL_imm8_r32( 8, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLL16 Rn {:  

    COUNT_INST(I_SHLL);

    load_reg( R_EAX, Rn );

    SHL_imm8_r32( 16, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLR Rn {:  

    COUNT_INST(I_SHLR);

    load_reg( R_EAX, Rn );

    SHR1_r32( R_EAX );

    SETC_t();

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_C;

:}

SHLR2 Rn {:  

    COUNT_INST(I_SHLR);

    load_reg( R_EAX, Rn );

    SHR_imm8_r32( 2, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLR8 Rn {:  

    COUNT_INST(I_SHLR);

    load_reg( R_EAX, Rn );

    SHR_imm8_r32( 8, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SHLR16 Rn {:  

    COUNT_INST(I_SHLR);

    load_reg( R_EAX, Rn );

    SHR_imm8_r32( 16, R_EAX );

    store_reg( R_EAX, Rn );

    sh4_x86.tstate = TSTATE_NONE;

:}

SUB Rm, Rn {:  

    COUNT_INST(I_SUB);

    load_reg( R_EAX, Rm );

    load_reg( R_ECX, Rn );