luna - luajit/src/lj_asm

   1/*
   2** ARM IR assembler (SSA IR -> machine code).
   3** Copyright (C) 2005-2026 Mike Pall. See Copyright Notice in luajit.h
   4*/
   5
   6/* -- Register allocator extensions --------------------------------------- */
   7
   8/* Allocate a register with a hint. */
   9static Reg ra_hintalloc(ASMState *as, IRRef ref, Reg hint, RegSet allow)
  10{
  11  Reg r = IR(ref)->r;
  12  if (ra_noreg(r)) {
  13    if (!ra_hashint(r) && !iscrossref(as, ref))
  14      ra_sethint(IR(ref)->r, hint);  /* Propagate register hint. */
  15    r = ra_allocref(as, ref, allow);
  16  }
  17  ra_noweak(as, r);
  18  return r;
  19}
  20
  21/* Allocate a scratch register pair. */
  22static Reg ra_scratchpair(ASMState *as, RegSet allow)
  23{
  24  RegSet pick1 = as->freeset & allow;
  25  RegSet pick2 = pick1 & (pick1 >> 1) & RSET_GPREVEN;
  26  Reg r;
  27  if (pick2) {
  28    r = rset_picktop(pick2);
  29  } else {
  30    RegSet pick = pick1 & (allow >> 1) & RSET_GPREVEN;
  31    if (pick) {
  32      r = rset_picktop(pick);
  33      ra_restore(as, regcost_ref(as->cost[r+1]));
  34    } else {
  35      pick = pick1 & (allow << 1) & RSET_GPRODD;
  36      if (pick) {
  37	r = ra_restore(as, regcost_ref(as->cost[rset_picktop(pick)-1]));
  38      } else {
  39	r = ra_evict(as, allow & (allow >> 1) & RSET_GPREVEN);
  40	ra_restore(as, regcost_ref(as->cost[r+1]));
  41      }
  42    }
  43  }
  44  lj_assertA(rset_test(RSET_GPREVEN, r), "odd reg %d", r);
  45  ra_modified(as, r);
  46  ra_modified(as, r+1);
  47  RA_DBGX((as, "scratchpair    $r $r", r, r+1));
  48  return r;
  49}
  50
  51#if !LJ_SOFTFP
  52/* Allocate two source registers for three-operand instructions. */
  53static Reg ra_alloc2(ASMState *as, IRIns *ir, RegSet allow)
  54{
  55  IRIns *irl = IR(ir->op1), *irr = IR(ir->op2);
  56  Reg left = irl->r, right = irr->r;
  57  if (ra_hasreg(left)) {
  58    ra_noweak(as, left);
  59    if (ra_noreg(right))
  60      right = ra_allocref(as, ir->op2, rset_exclude(allow, left));
  61    else
  62      ra_noweak(as, right);
  63  } else if (ra_hasreg(right)) {
  64    ra_noweak(as, right);
  65    left = ra_allocref(as, ir->op1, rset_exclude(allow, right));
  66  } else if (ra_hashint(right)) {
  67    right = ra_allocref(as, ir->op2, allow);
  68    left = ra_alloc1(as, ir->op1, rset_exclude(allow, right));
  69  } else {
  70    left = ra_allocref(as, ir->op1, allow);
  71    right = ra_alloc1(as, ir->op2, rset_exclude(allow, left));
  72  }
  73  return left | (right << 8);
  74}
  75#endif
  76
  77/* -- Guard handling ------------------------------------------------------ */
  78
  79/* Generate an exit stub group at the bottom of the reserved MCode memory. */
  80static MCode *asm_exitstub_gen(ASMState *as, ExitNo group)
  81{
  82  ExitNo i;
  83  int ind = 0;
  84  MCode *target = (MCode *)(void *)lj_vm_exit_handler;
  85  MCode *mxp = as->mcbot;
  86  if (mxp + 6+EXITSTUBS_PER_GROUP >= as->mctop)
  87    asm_mclimit(as);
  88  if ((((target - mxp - 2) + 0x00800000u) >> 24) == 0) {
  89    /* str lr, [sp]; bl ->vm_exit_handler;
  90    ** .long DISPATCH_address, group.
  91    */
  92    *mxp++ = ARMI_STR | ARMI_LS_P | ARMI_LS_U | ARMF_D(RID_LR) | ARMF_N(RID_SP);
  93    *mxp = ARMI_BL | ((target - mxp - 2) & 0x00ffffffu); mxp++;
  94  } else if ((as->flags & JIT_F_ARMV6T2)) {
  95    /*
  96    ** str lr, [sp]; movw/movt lr, vm_exit_handler; blx lr;
  97    ** .long DISPATCH_address, group;
  98    */
  99    *mxp++ = ARMI_STR | ARMI_LS_P | ARMI_LS_U | ARMF_D(RID_LR) | ARMF_N(RID_SP);
 100    *mxp++ = emit_movw_k((uint32_t)target) | ARMF_D(RID_LR);
 101    *mxp++ = emit_movt_k((uint32_t)target) | ARMF_D(RID_LR);
 102    *mxp++ = ARMI_BLXr | ARMF_M(RID_LR);
 103    ind = 2;
 104  } else {
 105    /* .long vm_exit_handler;
 106    ** str lr, [sp]; ldr lr, [pc, #-16]; blx lr;
 107    ** .long DISPATCH_address, group;
 108    */
 109    *mxp++ = (MCode)target;
 110    *mxp++ = ARMI_STR | ARMI_LS_P | ARMI_LS_U | ARMF_D(RID_LR) | ARMF_N(RID_SP);
 111    *mxp++ = ARMI_LDRL | ARMF_D(RID_LR) | 16;
 112    *mxp++ = ARMI_BLXr | ARMF_M(RID_LR);
 113    ind = 1;
 114  }
 115  *mxp++ = (MCode)i32ptr(J2GG(as->J)->dispatch);  /* DISPATCH address */
 116  *mxp++ = group*EXITSTUBS_PER_GROUP;
 117  for (i = 0; i < EXITSTUBS_PER_GROUP; i++)
 118    *mxp++ = ARMI_B | ((-6-ind-i) & 0x00ffffffu);
 119  lj_mcode_sync(as->mcbot, mxp);
 120  lj_mcode_commitbot(as->J, mxp);
 121  as->mcbot = mxp;
 122  as->mclim = as->mcbot + MCLIM_REDZONE;
 123  return mxp - EXITSTUBS_PER_GROUP;
 124}
 125
 126/* Setup all needed exit stubs. */
 127static void asm_exitstub_setup(ASMState *as, ExitNo nexits)
 128{
 129  ExitNo i;
 130  if (nexits >= EXITSTUBS_PER_GROUP*LJ_MAX_EXITSTUBGR)
 131    lj_trace_err(as->J, LJ_TRERR_SNAPOV);
 132  for (i = 0; i < (nexits+EXITSTUBS_PER_GROUP-1)/EXITSTUBS_PER_GROUP; i++)
 133    if (as->J->exitstubgroup[i] == NULL)
 134      as->J->exitstubgroup[i] = asm_exitstub_gen(as, i);
 135}
 136
 137/* Emit conditional branch to exit for guard. */
 138static void asm_guardcc(ASMState *as, ARMCC cc)
 139{
 140  MCode *target = exitstub_addr(as->J, as->snapno);
 141  MCode *p = as->mcp;
 142  if (LJ_UNLIKELY(p == as->invmcp)) {
 143    as->loopinv = 1;
 144    *p = ARMI_BL | ((target-p-2) & 0x00ffffffu);
 145    emit_branch(as, ARMF_CC(ARMI_B, cc^1), p+1);
 146    return;
 147  }
 148  emit_branch(as, ARMF_CC(ARMI_BL, cc), target);
 149}
 150
 151/* -- Operand fusion ------------------------------------------------------ */
 152
 153/* Limit linear search to this distance. Avoids O(n^2) behavior. */
 154#define CONFLICT_SEARCH_LIM	31
 155
 156/* Check if there's no conflicting instruction between curins and ref. */
 157static int noconflict(ASMState *as, IRRef ref, IROp conflict)
 158{
 159  IRIns *ir = as->ir;
 160  IRRef i = as->curins;
 161  if (i > ref + CONFLICT_SEARCH_LIM)
 162    return 0;  /* Give up, ref is too far away. */
 163  while (--i > ref)
 164    if (ir[i].o == conflict)
 165      return 0;  /* Conflict found. */
 166  return 1;  /* Ok, no conflict. */
 167}
 168
 169/* Fuse the array base of colocated arrays. */
 170static int32_t asm_fuseabase(ASMState *as, IRRef ref)
 171{
 172  IRIns *ir = IR(ref);
 173  if (ir->o == IR_TNEW && ir->op1 <= LJ_MAX_COLOSIZE &&
 174      !neverfuse(as) && noconflict(as, ref, IR_NEWREF))
 175    return (int32_t)sizeof(GCtab);
 176  return 0;
 177}
 178
 179/* Fuse array/hash/upvalue reference into register+offset operand. */
 180static Reg asm_fuseahuref(ASMState *as, IRRef ref, int32_t *ofsp, RegSet allow,
 181			  int lim)
 182{
 183  IRIns *ir = IR(ref);
 184  if (ra_noreg(ir->r)) {
 185    if (ir->o == IR_AREF) {
 186      if (mayfuse(as, ref)) {
 187	if (irref_isk(ir->op2)) {
 188	  IRRef tab = IR(ir->op1)->op1;
 189	  int32_t ofs = asm_fuseabase(as, tab);
 190	  IRRef refa = ofs ? tab : ir->op1;
 191	  ofs += 8*IR(ir->op2)->i;
 192	  if (ofs > -lim && ofs < lim) {
 193	    *ofsp = ofs;
 194	    return ra_alloc1(as, refa, allow);
 195	  }
 196	}
 197      }
 198    } else if (ir->o == IR_HREFK) {
 199      if (mayfuse(as, ref)) {
 200	int32_t ofs = (int32_t)(IR(ir->op2)->op2 * sizeof(Node));
 201	if (ofs < lim) {
 202	  *ofsp = ofs;
 203	  return ra_alloc1(as, ir->op1, allow);
 204	}
 205      }
 206    } else if (ir->o == IR_UREFC) {
 207      if (irref_isk(ir->op1)) {
 208	GCfunc *fn = ir_kfunc(IR(ir->op1));
 209	int32_t ofs = i32ptr(&gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv.tv);
 210	*ofsp = (ofs & 255);  /* Mask out less bits to allow LDRD. */
 211	return ra_allock(as, (ofs & ~255), allow);
 212      }
 213    } else if (ir->o == IR_TMPREF) {
 214      *ofsp = 0;
 215      return RID_SP;
 216    }
 217  }
 218  *ofsp = 0;
 219  return ra_alloc1(as, ref, allow);
 220}
 221
 222/* Fuse m operand into arithmetic/logic instructions. */
 223static uint32_t asm_fuseopm(ASMState *as, ARMIns ai, IRRef ref, RegSet allow)
 224{
 225  IRIns *ir = IR(ref);
 226  if (ra_hasreg(ir->r)) {
 227    ra_noweak(as, ir->r);
 228    return ARMF_M(ir->r);
 229  } else if (irref_isk(ref)) {
 230    uint32_t k = emit_isk12(ai, ir->i);
 231    if (k)
 232      return k;
 233  } else if (mayfuse(as, ref)) {
 234    if (ir->o >= IR_BSHL && ir->o <= IR_BROR) {
 235      Reg m = ra_alloc1(as, ir->op1, allow);
 236      ARMShift sh = ir->o == IR_BSHL ? ARMSH_LSL :
 237		    ir->o == IR_BSHR ? ARMSH_LSR :
 238		    ir->o == IR_BSAR ? ARMSH_ASR : ARMSH_ROR;
 239      if (irref_isk(ir->op2)) {
 240	return m | ARMF_SH(sh, (IR(ir->op2)->i & 31));
 241      } else {
 242	Reg s = ra_alloc1(as, ir->op2, rset_exclude(allow, m));
 243	return m | ARMF_RSH(sh, s);
 244      }
 245    } else if (ir->o == IR_ADD && ir->op1 == ir->op2) {
 246      Reg m = ra_alloc1(as, ir->op1, allow);
 247      return m | ARMF_SH(ARMSH_LSL, 1);
 248    }
 249  }
 250  return ra_allocref(as, ref, allow);
 251}
 252
 253/* Fuse shifts into loads/stores. Only bother with BSHL 2 => lsl #2. */
 254static IRRef asm_fuselsl2(ASMState *as, IRRef ref)
 255{
 256  IRIns *ir = IR(ref);
 257  if (ra_noreg(ir->r) && mayfuse(as, ref) && ir->o == IR_BSHL &&
 258      irref_isk(ir->op2) && IR(ir->op2)->i == 2)
 259    return ir->op1;
 260  return 0;  /* No fusion. */
 261}
 262
 263/* Fuse XLOAD/XSTORE reference into load/store operand. */
 264static void asm_fusexref(ASMState *as, ARMIns ai, Reg rd, IRRef ref,
 265			 RegSet allow, int32_t ofs)
 266{
 267  IRIns *ir = IR(ref);
 268  Reg base;
 269  if (ra_noreg(ir->r) && canfuse(as, ir)) {
 270    int32_t lim = (!LJ_SOFTFP && (ai & 0x08000000)) ? 1024 :
 271		   (ai & 0x04000000) ? 4096 : 256;
 272    if (ir->o == IR_ADD) {
 273      int32_t ofs2;
 274      if (irref_isk(ir->op2) &&
 275	  (ofs2 = ofs + IR(ir->op2)->i) > -lim && ofs2 < lim &&
 276	  (!(!LJ_SOFTFP && (ai & 0x08000000)) || !(ofs2 & 3))) {
 277	ofs = ofs2;
 278	ref = ir->op1;
 279      } else if (ofs == 0 && !(!LJ_SOFTFP && (ai & 0x08000000))) {
 280	IRRef lref = ir->op1, rref = ir->op2;
 281	Reg rn, rm;
 282	if ((ai & 0x04000000)) {
 283	  IRRef sref = asm_fuselsl2(as, rref);
 284	  if (sref) {
 285	    rref = sref;
 286	    ai |= ARMF_SH(ARMSH_LSL, 2);
 287	  } else if ((sref = asm_fuselsl2(as, lref)) != 0) {
 288	    lref = rref;
 289	    rref = sref;
 290	    ai |= ARMF_SH(ARMSH_LSL, 2);
 291	  }
 292	}
 293	rn = ra_alloc1(as, lref, allow);
 294	rm = ra_alloc1(as, rref, rset_exclude(allow, rn));
 295	if ((ai & 0x04000000)) ai |= ARMI_LS_R;
 296	emit_dnm(as, ai|ARMI_LS_P|ARMI_LS_U, rd, rn, rm);
 297	return;
 298      }
 299    } else if (ir->o == IR_STRREF && !(!LJ_SOFTFP && (ai & 0x08000000))) {
 300      lj_assertA(ofs == 0, "bad usage");
 301      ofs = (int32_t)sizeof(GCstr);
 302      if (irref_isk(ir->op2)) {
 303	ofs += IR(ir->op2)->i;
 304	ref = ir->op1;
 305      } else if (irref_isk(ir->op1)) {
 306	ofs += IR(ir->op1)->i;
 307	ref = ir->op2;
 308      } else {
 309	/* NYI: Fuse ADD with constant. */
 310	Reg rn = ra_alloc1(as, ir->op1, allow);
 311	uint32_t m = asm_fuseopm(as, 0, ir->op2, rset_exclude(allow, rn));
 312	if ((ai & 0x04000000))
 313	  emit_lso(as, ai, rd, rd, ofs);
 314	else
 315	  emit_lsox(as, ai, rd, rd, ofs);
 316	emit_dn(as, ARMI_ADD^m, rd, rn);
 317	return;
 318      }
 319      if (ofs <= -lim || ofs >= lim) {
 320	Reg rn = ra_alloc1(as, ref, allow);
 321	Reg rm = ra_allock(as, ofs, rset_exclude(allow, rn));
 322	if ((ai & 0x04000000)) ai |= ARMI_LS_R;
 323	emit_dnm(as, ai|ARMI_LS_P|ARMI_LS_U, rd, rn, rm);
 324	return;
 325      }
 326    }
 327  }
 328  base = ra_alloc1(as, ref, allow);
 329#if !LJ_SOFTFP
 330  if ((ai & 0x08000000))
 331    emit_vlso(as, ai, rd, base, ofs);
 332  else
 333#endif
 334  if ((ai & 0x04000000))
 335    emit_lso(as, ai, rd, base, ofs);
 336  else
 337    emit_lsox(as, ai, rd, base, ofs);
 338}
 339
 340#if !LJ_SOFTFP
 341/*
 342** Fuse to multiply-add/sub instruction.
 343** VMLA rounds twice (UMA, not FMA) -- no need to check for JIT_F_OPT_FMA.
 344** VFMA needs VFPv4, which is uncommon on the remaining ARM32 targets.
 345*/
 346static int asm_fusemadd(ASMState *as, IRIns *ir, ARMIns ai, ARMIns air)
 347{
 348  IRRef lref = ir->op1, rref = ir->op2;
 349  IRIns *irm;
 350  if (lref != rref &&
 351      ((mayfuse(as, lref) && (irm = IR(lref), irm->o == IR_MUL) &&
 352	ra_noreg(irm->r)) ||
 353       (mayfuse(as, rref) && (irm = IR(rref), irm->o == IR_MUL) &&
 354	(rref = lref, ai = air, ra_noreg(irm->r))))) {
 355    Reg dest = ra_dest(as, ir, RSET_FPR);
 356    Reg add = ra_hintalloc(as, rref, dest, RSET_FPR);
 357    Reg right, left = ra_alloc2(as, irm,
 358			rset_exclude(rset_exclude(RSET_FPR, dest), add));
 359    right = (left >> 8); left &= 255;
 360    emit_dnm(as, ai, (dest & 15), (left & 15), (right & 15));
 361    if (dest != add) emit_dm(as, ARMI_VMOV_D, (dest & 15), (add & 15));
 362    return 1;
 363  }
 364  return 0;
 365}
 366#endif
 367
 368/* -- Calls --------------------------------------------------------------- */
 369
 370/* Generate a call to a C function. */
 371static void asm_gencall(ASMState *as, const CCallInfo *ci, IRRef *args)
 372{
 373  uint32_t n, nargs = CCI_XNARGS(ci);
 374  int32_t ofs = 0;
 375#if LJ_SOFTFP
 376  Reg gpr = REGARG_FIRSTGPR;
 377#else
 378  Reg gpr, fpr = REGARG_FIRSTFPR, fprodd = 0;
 379#endif
 380  if ((void *)ci->func)
 381    emit_call(as, (void *)ci->func);
 382#if !LJ_SOFTFP
 383  for (gpr = REGARG_FIRSTGPR; gpr <= REGARG_LASTGPR; gpr++)
 384    as->cost[gpr] = REGCOST(~0u, ASMREF_L);
 385  gpr = REGARG_FIRSTGPR;
 386#endif
 387  for (n = 0; n < nargs; n++) {  /* Setup args. */
 388    IRRef ref = args[n];
 389    IRIns *ir = IR(ref);
 390#if !LJ_SOFTFP
 391    if (ref && irt_isfp(ir->t)) {
 392      RegSet of = as->freeset;
 393      Reg src;
 394      if (!LJ_ABI_SOFTFP && !(ci->flags & CCI_VARARG)) {
 395	if (irt_isnum(ir->t)) {
 396	  if (fpr <= REGARG_LASTFPR) {
 397	    ra_leftov(as, fpr, ref);
 398	    fpr++;
 399	    continue;
 400	  }
 401	} else if (fprodd) {  /* Ick. */
 402	  src = ra_alloc1(as, ref, RSET_FPR);
 403	  emit_dm(as, ARMI_VMOV_S, (fprodd & 15), (src & 15) | 0x00400000);
 404	  fprodd = 0;
 405	  continue;
 406	} else if (fpr <= REGARG_LASTFPR) {
 407	  ra_leftov(as, fpr, ref);
 408	  fprodd = fpr++;
 409	  continue;
 410	}
 411	/* Workaround to protect argument GPRs from being used for remat. */
 412	as->freeset &= ~RSET_RANGE(REGARG_FIRSTGPR, REGARG_LASTGPR+1);
 413	src = ra_alloc1(as, ref, RSET_FPR);  /* May alloc GPR to remat FPR. */
 414	as->freeset |= (of & RSET_RANGE(REGARG_FIRSTGPR, REGARG_LASTGPR+1));
 415	fprodd = 0;
 416	goto stackfp;
 417      }
 418      /* Workaround to protect argument GPRs from being used for remat. */
 419      as->freeset &= ~RSET_RANGE(REGARG_FIRSTGPR, REGARG_LASTGPR+1);
 420      src = ra_alloc1(as, ref, RSET_FPR);  /* May alloc GPR to remat FPR. */
 421      as->freeset |= (of & RSET_RANGE(REGARG_FIRSTGPR, REGARG_LASTGPR+1));
 422      if (irt_isnum(ir->t)) gpr = (gpr+1) & ~1u;
 423      if (gpr <= REGARG_LASTGPR) {
 424	lj_assertA(rset_test(as->freeset, gpr),
 425		   "reg %d not free", gpr);  /* Must have been evicted. */
 426	if (irt_isnum(ir->t)) {
 427	  lj_assertA(rset_test(as->freeset, gpr+1),
 428		     "reg %d not free", gpr+1);  /* Ditto. */
 429	  emit_dnm(as, ARMI_VMOV_RR_D, gpr, gpr+1, (src & 15));
 430	  gpr += 2;
 431	} else {
 432	  emit_dn(as, ARMI_VMOV_R_S, gpr, (src & 15));
 433	  gpr++;
 434	}
 435      } else {
 436      stackfp:
 437	if (irt_isnum(ir->t)) ofs = (ofs + 4) & ~4;
 438	emit_spstore(as, ir, src, ofs);
 439	ofs += irt_isnum(ir->t) ? 8 : 4;
 440      }
 441    } else
 442#endif
 443    {
 444      if (gpr <= REGARG_LASTGPR) {
 445	lj_assertA(rset_test(as->freeset, gpr),
 446		   "reg %d not free", gpr);  /* Must have been evicted. */
 447	if (ref) ra_leftov(as, gpr, ref);
 448	gpr++;
 449      } else {
 450	if (ref) {
 451	  Reg r = ra_alloc1(as, ref, RSET_GPR);
 452	  emit_spstore(as, ir, r, ofs);
 453	}
 454	ofs += 4;
 455      }
 456    }
 457  }
 458}
 459
 460/* Setup result reg/sp for call. Evict scratch regs. */
 461static void asm_setupresult(ASMState *as, IRIns *ir, const CCallInfo *ci)
 462{
 463  RegSet drop = RSET_SCRATCH;
 464  int hiop = ((ir+1)->o == IR_HIOP && !irt_isnil((ir+1)->t));
 465  if (ra_hasreg(ir->r))
 466    rset_clear(drop, ir->r);  /* Dest reg handled below. */
 467  if (hiop && ra_hasreg((ir+1)->r))
 468    rset_clear(drop, (ir+1)->r);  /* Dest reg handled below. */
 469  ra_evictset(as, drop);  /* Evictions must be performed first. */
 470  if (ra_used(ir)) {
 471    lj_assertA(!irt_ispri(ir->t), "PRI dest");
 472    if (!LJ_SOFTFP && irt_isfp(ir->t)) {
 473      if (LJ_ABI_SOFTFP || (ci->flags & (CCI_CASTU64|CCI_VARARG))) {
 474	Reg dest = (ra_dest(as, ir, RSET_FPR) & 15);
 475	if (irt_isnum(ir->t))
 476	  emit_dnm(as, ARMI_VMOV_D_RR, RID_RETLO, RID_RETHI, dest);
 477	else
 478	  emit_dn(as, ARMI_VMOV_S_R, RID_RET, dest);
 479      } else {
 480	ra_destreg(as, ir, RID_FPRET);
 481      }
 482    } else if (hiop) {
 483      ra_destpair(as, ir);
 484    } else {
 485      ra_destreg(as, ir, RID_RET);
 486    }
 487  }
 488  UNUSED(ci);
 489}
 490
 491static void asm_callx(ASMState *as, IRIns *ir)
 492{
 493  IRRef args[CCI_NARGS_MAX*2];
 494  CCallInfo ci;
 495  IRRef func;
 496  IRIns *irf;
 497  ci.flags = asm_callx_flags(as, ir);
 498  asm_collectargs(as, ir, &ci, args);
 499  asm_setupresult(as, ir, &ci);
 500  func = ir->op2; irf = IR(func);
 501  if (irf->o == IR_CARG) { func = irf->op1; irf = IR(func); }
 502  if (irref_isk(func)) {  /* Call to constant address. */
 503    ci.func = (ASMFunction)(void *)(irf->i);
 504  } else {  /* Need a non-argument register for indirect calls. */
 505    Reg freg = ra_alloc1(as, func, RSET_RANGE(RID_R4, RID_R12+1));
 506    emit_m(as, ARMI_BLXr, freg);
 507    ci.func = (ASMFunction)(void *)0;
 508  }
 509  asm_gencall(as, &ci, args);
 510}
 511
 512/* -- Returns ------------------------------------------------------------- */
 513
 514/* Return to lower frame. Guard that it goes to the right spot. */
 515static void asm_retf(ASMState *as, IRIns *ir)
 516{
 517  Reg base = ra_alloc1(as, REF_BASE, RSET_GPR);
 518  void *pc = ir_kptr(IR(ir->op2));
 519  int32_t delta = 1+LJ_FR2+bc_a(*((const BCIns *)pc - 1));
 520  as->topslot -= (BCReg)delta;
 521  if ((int32_t)as->topslot < 0) as->topslot = 0;
 522  irt_setmark(IR(REF_BASE)->t);  /* Children must not coalesce with BASE reg. */
 523  /* Need to force a spill on REF_BASE now to update the stack slot. */
 524  emit_lso(as, ARMI_STR, base, RID_SP, ra_spill(as, IR(REF_BASE)));
 525  emit_setgl(as, base, jit_base);
 526  emit_addptr(as, base, -8*delta);
 527  asm_guardcc(as, CC_NE);
 528  emit_nm(as, ARMI_CMP, RID_TMP,
 529	  ra_allock(as, i32ptr(pc), rset_exclude(RSET_GPR, base)));
 530  emit_lso(as, ARMI_LDR, RID_TMP, base, -4);
 531}
 532
 533/* -- Buffer operations --------------------------------------------------- */
 534
 535#if LJ_HASBUFFER
 536static void asm_bufhdr_write(ASMState *as, Reg sb)
 537{
 538  Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, sb));
 539  IRIns irgc;
 540  int32_t addr = i32ptr((void *)&J2G(as->J)->cur_L);
 541  irgc.ot = IRT(0, IRT_PGC);  /* GC type. */
 542  emit_storeofs(as, &irgc, RID_TMP, sb, offsetof(SBuf, L));
 543  if ((as->flags & JIT_F_ARMV6T2)) {
 544    emit_dnm(as, ARMI_BFI, RID_TMP, lj_fls(SBUF_MASK_FLAG), tmp);
 545  } else {
 546    emit_dnm(as, ARMI_ORR, RID_TMP, RID_TMP, tmp);
 547    emit_dn(as, ARMI_AND|ARMI_K12|SBUF_MASK_FLAG, tmp, tmp);
 548  }
 549  emit_lso(as, ARMI_LDR, RID_TMP,
 550	   ra_allock(as, (addr & ~4095),
 551		     rset_exclude(rset_exclude(RSET_GPR, sb), tmp)),
 552	   (addr & 4095));
 553  emit_loadofs(as, &irgc, tmp, sb, offsetof(SBuf, L));
 554}
 555#endif
 556
 557/* -- Type conversions ---------------------------------------------------- */
 558
 559#if !LJ_SOFTFP
 560static void asm_tointg(ASMState *as, IRIns *ir, Reg left)
 561{
 562  Reg tmp = ra_scratch(as, rset_exclude(RSET_FPR, left));
 563  Reg dest = ra_dest(as, ir, RSET_GPR);
 564  asm_guardcc(as, CC_NE);
 565  emit_d(as, ARMI_VMRS, 0);
 566  emit_dm(as, ARMI_VCMP_D, (tmp & 15), (left & 15));
 567  emit_dm(as, ARMI_VCVT_F64_S32, (tmp & 15), (tmp & 15));
 568  emit_dn(as, ARMI_VMOV_R_S, dest, (tmp & 15));
 569  emit_dm(as, ARMI_VCVT_S32_F64, (tmp & 15), (left & 15));
 570}
 571
 572static void asm_tobit(ASMState *as, IRIns *ir)
 573{
 574  RegSet allow = RSET_FPR;
 575  Reg left = ra_alloc1(as, ir->op1, allow);
 576  Reg right = ra_alloc1(as, ir->op2, rset_clear(allow, left));
 577  Reg tmp = ra_scratch(as, rset_clear(allow, right));
 578  Reg dest = ra_dest(as, ir, RSET_GPR);
 579  emit_dn(as, ARMI_VMOV_R_S, dest, (tmp & 15));
 580  emit_dnm(as, ARMI_VADD_D, (tmp & 15), (left & 15), (right & 15));
 581}
 582#endif
 583
 584static void asm_conv(ASMState *as, IRIns *ir)
 585{
 586  IRType st = (IRType)(ir->op2 & IRCONV_SRCMASK);
 587#if !LJ_SOFTFP
 588  int stfp = (st == IRT_NUM || st == IRT_FLOAT);
 589#endif
 590  IRRef lref = ir->op1;
 591  /* 64 bit integer conversions are handled by SPLIT. */
 592  lj_assertA(!irt_isint64(ir->t) && !(st == IRT_I64 || st == IRT_U64),
 593	     "IR %04d has unsplit 64 bit type",
 594	     (int)(ir - as->ir) - REF_BIAS);
 595#if LJ_SOFTFP
 596  /* FP conversions are handled by SPLIT. */
 597  lj_assertA(!irt_isfp(ir->t) && !(st == IRT_NUM || st == IRT_FLOAT),
 598	     "IR %04d has FP type",
 599	     (int)(ir - as->ir) - REF_BIAS);
 600  /* Can't check for same types: SPLIT uses CONV int.int + BXOR for sfp NEG. */
 601#else
 602  lj_assertA(irt_type(ir->t) != st, "inconsistent types for CONV");
 603  if (irt_isfp(ir->t)) {
 604    Reg dest = ra_dest(as, ir, RSET_FPR);
 605    if (stfp) {  /* FP to FP conversion. */
 606      emit_dm(as, st == IRT_NUM ? ARMI_VCVT_F32_F64 : ARMI_VCVT_F64_F32,
 607	      (dest & 15), (ra_alloc1(as, lref, RSET_FPR) & 15));
 608    } else {  /* Integer to FP conversion. */
 609      Reg left = ra_alloc1(as, lref, RSET_GPR);
 610      ARMIns ai = irt_isfloat(ir->t) ?
 611	(st == IRT_INT ? ARMI_VCVT_F32_S32 : ARMI_VCVT_F32_U32) :
 612	(st == IRT_INT ? ARMI_VCVT_F64_S32 : ARMI_VCVT_F64_U32);
 613      emit_dm(as, ai, (dest & 15), (dest & 15));
 614      emit_dn(as, ARMI_VMOV_S_R, left, (dest & 15));
 615    }
 616  } else if (stfp) {  /* FP to integer conversion. */
 617    if (irt_isguard(ir->t)) {
 618      /* Checked conversions are only supported from number to int. */
 619      lj_assertA(irt_isint(ir->t) && st == IRT_NUM,
 620		 "bad type for checked CONV");
 621      asm_tointg(as, ir, ra_alloc1(as, lref, RSET_FPR));
 622    } else {
 623      Reg left = ra_alloc1(as, lref, RSET_FPR);
 624      Reg tmp = ra_scratch(as, rset_exclude(RSET_FPR, left));
 625      Reg dest = ra_dest(as, ir, RSET_GPR);
 626      ARMIns ai;
 627      lj_assertA(!irt_isu32(ir->t), "bad CONV u32.fp emitted");
 628      emit_dn(as, ARMI_VMOV_R_S, dest, (tmp & 15));
 629      ai = st == IRT_NUM ? ARMI_VCVT_S32_F64 : ARMI_VCVT_S32_F32;
 630      emit_dm(as, ai, (tmp & 15), (left & 15));
 631    }
 632  } else
 633#endif
 634  {
 635    Reg dest = ra_dest(as, ir, RSET_GPR);
 636    if (st >= IRT_I8 && st <= IRT_U16) {  /* Extend to 32 bit integer. */
 637      Reg left = ra_alloc1(as, lref, RSET_GPR);
 638      lj_assertA(irt_isint(ir->t) || irt_isu32(ir->t), "bad type for CONV EXT");
 639      if ((as->flags & JIT_F_ARMV6)) {
 640	ARMIns ai = st == IRT_I8 ? ARMI_SXTB :
 641		    st == IRT_U8 ? ARMI_UXTB :
 642		    st == IRT_I16 ? ARMI_SXTH : ARMI_UXTH;
 643	emit_dm(as, ai, dest, left);
 644      } else if (st == IRT_U8) {
 645	emit_dn(as, ARMI_AND|ARMI_K12|255, dest, left);
 646      } else {
 647	uint32_t shift = st == IRT_I8 ? 24 : 16;
 648	ARMShift sh = st == IRT_U16 ? ARMSH_LSR : ARMSH_ASR;
 649	emit_dm(as, ARMI_MOV|ARMF_SH(sh, shift), dest, RID_TMP);
 650	emit_dm(as, ARMI_MOV|ARMF_SH(ARMSH_LSL, shift), RID_TMP, left);
 651      }
 652    } else {  /* Handle 32/32 bit no-op (cast). */
 653      ra_leftov(as, dest, lref);  /* Do nothing, but may need to move regs. */
 654    }
 655  }
 656}
 657
 658static void asm_strto(ASMState *as, IRIns *ir)
 659{
 660  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_strscan_num];
 661  IRRef args[2];
 662  Reg rlo = 0, rhi = 0, tmp;
 663  int destused = ra_used(ir);
 664  int32_t ofs = 0;
 665  ra_evictset(as, RSET_SCRATCH);
 666#if LJ_SOFTFP
 667  if (destused) {
 668    if (ra_hasspill(ir->s) && ra_hasspill((ir+1)->s) &&
 669	(ir->s & 1) == 0 && ir->s + 1 == (ir+1)->s) {
 670      int i;
 671      for (i = 0; i < 2; i++) {
 672	Reg r = (ir+i)->r;
 673	if (ra_hasreg(r)) {
 674	  ra_free(as, r);
 675	  ra_modified(as, r);
 676	  emit_spload(as, ir+i, r, sps_scale((ir+i)->s));
 677	}
 678      }
 679      ofs = sps_scale(ir->s);
 680      destused = 0;
 681    } else {
 682      rhi = ra_dest(as, ir+1, RSET_GPR);
 683      rlo = ra_dest(as, ir, rset_exclude(RSET_GPR, rhi));
 684    }
 685  }
 686  asm_guardcc(as, CC_EQ);
 687  if (destused) {
 688    emit_lso(as, ARMI_LDR, rhi, RID_SP, 4);
 689    emit_lso(as, ARMI_LDR, rlo, RID_SP, 0);
 690  }
 691#else
 692  UNUSED(rhi);
 693  if (destused) {
 694    if (ra_hasspill(ir->s)) {
 695      ofs = sps_scale(ir->s);
 696      destused = 0;
 697      if (ra_hasreg(ir->r)) {
 698	ra_free(as, ir->r);
 699	ra_modified(as, ir->r);
 700	emit_spload(as, ir, ir->r, ofs);
 701      }
 702    } else {
 703      rlo = ra_dest(as, ir, RSET_FPR);
 704    }
 705  }
 706  asm_guardcc(as, CC_EQ);
 707  if (destused)
 708    emit_vlso(as, ARMI_VLDR_D, rlo, RID_SP, 0);
 709#endif
 710  emit_n(as, ARMI_CMP|ARMI_K12|0, RID_RET);  /* Test return status. */
 711  args[0] = ir->op1;      /* GCstr *str */
 712  args[1] = ASMREF_TMP1;  /* TValue *n  */
 713  asm_gencall(as, ci, args);
 714  tmp = ra_releasetmp(as, ASMREF_TMP1);
 715  if (ofs == 0)
 716    emit_dm(as, ARMI_MOV, tmp, RID_SP);
 717  else
 718    emit_opk(as, ARMI_ADD, tmp, RID_SP, ofs, RSET_GPR);
 719}
 720
 721/* -- Memory references --------------------------------------------------- */
 722
 723/* Get pointer to TValue. */
 724static void asm_tvptr(ASMState *as, Reg dest, IRRef ref, MSize mode)
 725{
 726  if ((mode & IRTMPREF_IN1)) {
 727    IRIns *ir = IR(ref);
 728    if (irt_isnum(ir->t)) {
 729      if ((mode & IRTMPREF_OUT1)) {
 730#if LJ_SOFTFP
 731	lj_assertA(irref_isk(ref), "unsplit FP op");
 732	emit_dm(as, ARMI_MOV, dest, RID_SP);
 733	emit_lso(as, ARMI_STR,
 734		 ra_allock(as, (int32_t)ir_knum(ir)->u32.lo, RSET_GPR),
 735		 RID_SP, 0);
 736	emit_lso(as, ARMI_STR,
 737		 ra_allock(as, (int32_t)ir_knum(ir)->u32.hi, RSET_GPR),
 738		 RID_SP, 4);
 739#else
 740	Reg src = ra_alloc1(as, ref, RSET_FPR);
 741	emit_dm(as, ARMI_MOV, dest, RID_SP);
 742	emit_vlso(as, ARMI_VSTR_D, src, RID_SP, 0);
 743#endif
 744      } else if (irref_isk(ref)) {
 745	/* Use the number constant itself as a TValue. */
 746	ra_allockreg(as, i32ptr(ir_knum(ir)), dest);
 747      } else {
 748#if LJ_SOFTFP
 749	lj_assertA(0, "unsplit FP op");
 750#else
 751	/* Otherwise force a spill and use the spill slot. */
 752	emit_opk(as, ARMI_ADD, dest, RID_SP, ra_spill(as, ir), RSET_GPR);
 753#endif
 754      }
 755    } else {
 756      /* Otherwise use [sp] and [sp+4] to hold the TValue.
 757      ** This assumes the following call has max. 4 args.
 758      */
 759      Reg type;
 760      emit_dm(as, ARMI_MOV, dest, RID_SP);
 761      if (!irt_ispri(ir->t)) {
 762	Reg src = ra_alloc1(as, ref, RSET_GPR);
 763	emit_lso(as, ARMI_STR, src, RID_SP, 0);
 764      }
 765      if (LJ_SOFTFP && (ir+1)->o == IR_HIOP && !irt_isnil((ir+1)->t))
 766	type = ra_alloc1(as, ref+1, RSET_GPR);
 767      else
 768	type = ra_allock(as, irt_toitype(ir->t), RSET_GPR);
 769      emit_lso(as, ARMI_STR, type, RID_SP, 4);
 770    }
 771  } else {
 772    emit_dm(as, ARMI_MOV, dest, RID_SP);
 773  }
 774}
 775
 776static void asm_aref(ASMState *as, IRIns *ir)
 777{
 778  Reg dest = ra_dest(as, ir, RSET_GPR);
 779  Reg idx, base;
 780  if (irref_isk(ir->op2)) {
 781    IRRef tab = IR(ir->op1)->op1;
 782    int32_t ofs = asm_fuseabase(as, tab);
 783    IRRef refa = ofs ? tab : ir->op1;
 784    uint32_t k = emit_isk12(ARMI_ADD, ofs + 8*IR(ir->op2)->i);
 785    if (k) {
 786      base = ra_alloc1(as, refa, RSET_GPR);
 787      emit_dn(as, ARMI_ADD^k, dest, base);
 788      return;
 789    }
 790  }
 791  base = ra_alloc1(as, ir->op1, RSET_GPR);
 792  idx = ra_alloc1(as, ir->op2, rset_exclude(RSET_GPR, base));
 793  emit_dnm(as, ARMI_ADD|ARMF_SH(ARMSH_LSL, 3), dest, base, idx);
 794}
 795
 796/* Inlined hash lookup. Specialized for key type and for const keys.
 797** The equivalent C code is:
 798**   Node *n = hashkey(t, key);
 799**   do {
 800**     if (lj_obj_equal(&n->key, key)) return &n->val;
 801**   } while ((n = nextnode(n)));
 802**   return niltv(L);
 803*/
 804static void asm_href(ASMState *as, IRIns *ir, IROp merge)
 805{
 806  RegSet allow = RSET_GPR;
 807  int destused = ra_used(ir);
 808  Reg dest = ra_dest(as, ir, allow);
 809  Reg tab = ra_alloc1(as, ir->op1, rset_clear(allow, dest));
 810  Reg key = 0, keyhi = 0, keynumhi = RID_NONE, tmp = RID_TMP;
 811  IRRef refkey = ir->op2;
 812  IRIns *irkey = IR(refkey);
 813  IRType1 kt = irkey->t;
 814  int32_t k = 0, khi = emit_isk12(ARMI_CMP, irt_toitype(kt));
 815  uint32_t khash;
 816  MCLabel l_end, l_loop;
 817  rset_clear(allow, tab);
 818  if (!irref_isk(refkey) || irt_isstr(kt)) {
 819#if LJ_SOFTFP
 820    key = ra_alloc1(as, refkey, allow);
 821    rset_clear(allow, key);
 822    if (irkey[1].o == IR_HIOP) {
 823      if (ra_hasreg((irkey+1)->r)) {
 824	keynumhi = (irkey+1)->r;
 825	keyhi = RID_TMP;
 826	ra_noweak(as, keynumhi);
 827      } else {
 828	keyhi = keynumhi = ra_allocref(as, refkey+1, allow);
 829      }
 830      rset_clear(allow, keynumhi);
 831      khi = 0;
 832    }
 833#else
 834    if (irt_isnum(kt)) {
 835      key = ra_scratch(as, allow);
 836      rset_clear(allow, key);
 837      keyhi = keynumhi = ra_scratch(as, allow);
 838      rset_clear(allow, keyhi);
 839      khi = 0;
 840    } else {
 841      key = ra_alloc1(as, refkey, allow);
 842      rset_clear(allow, key);
 843    }
 844#endif
 845  } else if (irt_isnum(kt)) {
 846    int32_t val = (int32_t)ir_knum(irkey)->u32.lo;
 847    k = emit_isk12(ARMI_CMP, val);
 848    if (!k) {
 849      key = ra_allock(as, val, allow);
 850      rset_clear(allow, key);
 851    }
 852    val = (int32_t)ir_knum(irkey)->u32.hi;
 853    khi = emit_isk12(ARMI_CMP, val);
 854    if (!khi) {
 855      keyhi = ra_allock(as, val, allow);
 856      rset_clear(allow, keyhi);
 857    }
 858  } else if (!irt_ispri(kt)) {
 859    k = emit_isk12(ARMI_CMP, irkey->i);
 860    if (!k) {
 861      key = ra_alloc1(as, refkey, allow);
 862      rset_clear(allow, key);
 863    }
 864  }
 865  if (!irt_ispri(kt))
 866    tmp = ra_scratchpair(as, allow);
 867
 868  /* Key not found in chain: jump to exit (if merged) or load niltv. */
 869  l_end = emit_label(as);
 870  as->invmcp = NULL;
 871  if (merge == IR_NE)
 872    asm_guardcc(as, CC_AL);
 873  else if (destused)
 874    emit_loada(as, dest, niltvg(J2G(as->J)));
 875
 876  /* Follow hash chain until the end. */
 877  l_loop = --as->mcp;
 878  emit_n(as, ARMI_CMP|ARMI_K12|0, dest);
 879  emit_lso(as, ARMI_LDR, dest, dest, (int32_t)offsetof(Node, next));
 880
 881  /* Type and value comparison. */
 882  if (merge == IR_EQ)
 883    asm_guardcc(as, CC_EQ);
 884  else
 885    emit_branch(as, ARMF_CC(ARMI_B, CC_EQ), l_end);
 886  if (!irt_ispri(kt)) {
 887    emit_nm(as, ARMF_CC(ARMI_CMP, CC_EQ)^k, tmp, key);
 888    emit_nm(as, ARMI_CMP^khi, tmp+1, keyhi);
 889    emit_lsox(as, ARMI_LDRD, tmp, dest, (int32_t)offsetof(Node, key));
 890  } else {
 891    emit_n(as, ARMI_CMP^khi, tmp);
 892    emit_lso(as, ARMI_LDR, tmp, dest, (int32_t)offsetof(Node, key.it));
 893  }
 894  *l_loop = ARMF_CC(ARMI_B, CC_NE) | ((as->mcp-l_loop-2) & 0x00ffffffu);
 895
 896  /* Load main position relative to tab->node into dest. */
 897  khash = irref_isk(refkey) ? ir_khash(as, irkey) : 1;
 898  if (khash == 0) {
 899    emit_lso(as, ARMI_LDR, dest, tab, (int32_t)offsetof(GCtab, node));
 900  } else {
 901    emit_dnm(as, ARMI_ADD|ARMF_SH(ARMSH_LSL, 3), dest, dest, tmp);
 902    emit_dnm(as, ARMI_ADD|ARMF_SH(ARMSH_LSL, 1), tmp, tmp, tmp);
 903    if (irt_isstr(kt)) {  /* Fetch of str->sid is cheaper than ra_allock. */
 904      emit_dnm(as, ARMI_AND, tmp, tmp+1, RID_TMP);
 905      emit_lso(as, ARMI_LDR, dest, tab, (int32_t)offsetof(GCtab, node));
 906      emit_lso(as, ARMI_LDR, tmp+1, key, (int32_t)offsetof(GCstr, sid));
 907      emit_lso(as, ARMI_LDR, RID_TMP, tab, (int32_t)offsetof(GCtab, hmask));
 908    } else if (irref_isk(refkey)) {
 909      emit_opk(as, ARMI_AND, tmp, RID_TMP, (int32_t)khash,
 910	       rset_exclude(rset_exclude(RSET_GPR, tab), dest));
 911      emit_lso(as, ARMI_LDR, dest, tab, (int32_t)offsetof(GCtab, node));
 912      emit_lso(as, ARMI_LDR, RID_TMP, tab, (int32_t)offsetof(GCtab, hmask));
 913    } else {  /* Must match with hash*() in lj_tab.c. */
 914      if (ra_hasreg(keynumhi)) {  /* Canonicalize +-0.0 to 0.0. */
 915	if (keyhi == RID_TMP)
 916	  emit_dm(as, ARMF_CC(ARMI_MOV, CC_NE), keyhi, keynumhi);
 917	emit_d(as, ARMF_CC(ARMI_MOV, CC_EQ)|ARMI_K12|0, keyhi);
 918      }
 919      emit_dnm(as, ARMI_AND, tmp, tmp, RID_TMP);
 920      emit_dnm(as, ARMI_SUB|ARMF_SH(ARMSH_ROR, 32-HASH_ROT3), tmp, tmp, tmp+1);
 921      emit_lso(as, ARMI_LDR, dest, tab, (int32_t)offsetof(GCtab, node));
 922      emit_dnm(as, ARMI_EOR|ARMF_SH(ARMSH_ROR, 32-((HASH_ROT2+HASH_ROT1)&31)),
 923	       tmp, tmp+1, tmp);
 924      emit_lso(as, ARMI_LDR, RID_TMP, tab, (int32_t)offsetof(GCtab, hmask));
 925      emit_dnm(as, ARMI_SUB|ARMF_SH(ARMSH_ROR, 32-HASH_ROT1), tmp+1, tmp+1, tmp);
 926      if (ra_hasreg(keynumhi)) {
 927	emit_dnm(as, ARMI_EOR, tmp+1, tmp, key);
 928	emit_dnm(as, ARMI_ORR|ARMI_S, RID_TMP, tmp, key);  /* Test for +-0.0. */
 929	emit_dnm(as, ARMI_ADD, tmp, keynumhi, keynumhi);
 930#if !LJ_SOFTFP
 931	emit_dnm(as, ARMI_VMOV_RR_D, key, keynumhi,
 932		 (ra_alloc1(as, refkey, RSET_FPR) & 15));
 933#endif
 934      } else {
 935	emit_dnm(as, ARMI_EOR, tmp+1, tmp, key);
 936	emit_opk(as, ARMI_ADD, tmp, key, (int32_t)HASH_BIAS,
 937		 rset_exclude(rset_exclude(RSET_GPR, tab), key));
 938      }
 939    }
 940  }
 941}
 942
 943static void asm_hrefk(ASMState *as, IRIns *ir)
 944{
 945  IRIns *kslot = IR(ir->op2);
 946  IRIns *irkey = IR(kslot->op1);
 947  int32_t ofs = (int32_t)(kslot->op2 * sizeof(Node));
 948  int32_t kofs = ofs + (int32_t)offsetof(Node, key);
 949  Reg dest = (ra_used(ir) || ofs > 4095) ? ra_dest(as, ir, RSET_GPR) : RID_NONE;
 950  Reg node = ra_alloc1(as, ir->op1, RSET_GPR);
 951  Reg key = RID_NONE, type = RID_TMP, idx = node;
 952  RegSet allow = rset_exclude(RSET_GPR, node);
 953  lj_assertA(ofs % sizeof(Node) == 0, "unaligned HREFK slot");
 954  if (ofs > 4095) {
 955    idx = dest;
 956    rset_clear(allow, dest);
 957    kofs = (int32_t)offsetof(Node, key);
 958  } else if (ra_hasreg(dest)) {
 959    emit_opk(as, ARMI_ADD, dest, node, ofs, allow);
 960  }
 961  asm_guardcc(as, CC_NE);
 962  if (!irt_ispri(irkey->t)) {
 963    RegSet even = (as->freeset & allow);
 964    even = even & (even >> 1) & RSET_GPREVEN;
 965    if (even) {
 966      key = ra_scratch(as, even);
 967      if (rset_test(as->freeset, key+1)) {
 968	type = key+1;
 969	ra_modified(as, type);
 970      }
 971    } else {
 972      key = ra_scratch(as, allow);
 973    }
 974    rset_clear(allow, key);
 975  }
 976  rset_clear(allow, type);
 977  if (irt_isnum(irkey->t)) {
 978    emit_opk(as, ARMF_CC(ARMI_CMP, CC_EQ), 0, type,
 979	     (int32_t)ir_knum(irkey)->u32.hi, allow);
 980    emit_opk(as, ARMI_CMP, 0, key,
 981	     (int32_t)ir_knum(irkey)->u32.lo, allow);
 982  } else {
 983    if (ra_hasreg(key))
 984      emit_opk(as, ARMF_CC(ARMI_CMP, CC_EQ), 0, key, irkey->i, allow);
 985    emit_n(as, ARMI_CMN|ARMI_K12|-irt_toitype(irkey->t), type);
 986  }
 987  emit_lso(as, ARMI_LDR, type, idx, kofs+4);
 988  if (ra_hasreg(key)) emit_lso(as, ARMI_LDR, key, idx, kofs);
 989  if (ofs > 4095)
 990    emit_opk(as, ARMI_ADD, dest, node, ofs, RSET_GPR);
 991}
 992
 993static void asm_uref(ASMState *as, IRIns *ir)
 994{
 995  Reg dest = ra_dest(as, ir, RSET_GPR);
 996  int guarded = (irt_t(ir->t) & (IRT_GUARD|IRT_TYPE)) == (IRT_GUARD|IRT_PGC);
 997  if (irref_isk(ir->op1) && !guarded) {
 998    GCfunc *fn = ir_kfunc(IR(ir->op1));
 999    MRef *v = &gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv.v;
1000    emit_lsptr(as, ARMI_LDR, dest, v);
1001  } else {
1002    if (guarded) {
1003      asm_guardcc(as, ir->o == IR_UREFC ? CC_NE : CC_EQ);
1004      emit_n(as, ARMI_CMP|ARMI_K12|1, RID_TMP);
1005    }
1006    if (ir->o == IR_UREFC)
1007      emit_opk(as, ARMI_ADD, dest, dest,
1008	       (int32_t)offsetof(GCupval, tv), RSET_GPR);
1009    else
1010      emit_lso(as, ARMI_LDR, dest, dest, (int32_t)offsetof(GCupval, v));
1011    if (guarded)
1012      emit_lso(as, ARMI_LDRB, RID_TMP, dest,
1013	       (int32_t)offsetof(GCupval, closed));
1014    if (irref_isk(ir->op1)) {
1015      GCfunc *fn = ir_kfunc(IR(ir->op1));
1016      int32_t k = (int32_t)gcrefu(fn->l.uvptr[(ir->op2 >> 8)]);
1017      emit_loadi(as, dest, k);
1018    } else {
1019      emit_lso(as, ARMI_LDR, dest, ra_alloc1(as, ir->op1, RSET_GPR),
1020	       (int32_t)offsetof(GCfuncL, uvptr) + 4*(int32_t)(ir->op2 >> 8));
1021    }
1022  }
1023}
1024
1025static void asm_fref(ASMState *as, IRIns *ir)
1026{
1027  UNUSED(as); UNUSED(ir);
1028  lj_assertA(!ra_used(ir), "unfused FREF");
1029}
1030
1031static void asm_strref(ASMState *as, IRIns *ir)
1032{
1033  Reg dest = ra_dest(as, ir, RSET_GPR);
1034  IRRef ref = ir->op2, refk = ir->op1;
1035  Reg r;
1036  if (irref_isk(ref)) {
1037    IRRef tmp = refk; refk = ref; ref = tmp;
1038  } else if (!irref_isk(refk)) {
1039    uint32_t k, m = ARMI_K12|sizeof(GCstr);
1040    Reg right, left = ra_alloc1(as, ir->op1, RSET_GPR);
1041    IRIns *irr = IR(ir->op2);
1042    if (ra_hasreg(irr->r)) {
1043      ra_noweak(as, irr->r);
1044      right = irr->r;
1045    } else if (mayfuse(as, irr->op2) &&
1046	       irr->o == IR_ADD && irref_isk(irr->op2) &&
1047	       (k = emit_isk12(ARMI_ADD,
1048			       (int32_t)sizeof(GCstr) + IR(irr->op2)->i))) {
1049      m = k;
1050      right = ra_alloc1(as, irr->op1, rset_exclude(RSET_GPR, left));
1051    } else {
1052      right = ra_allocref(as, ir->op2, rset_exclude(RSET_GPR, left));
1053    }
1054    emit_dn(as, ARMI_ADD^m, dest, dest);
1055    emit_dnm(as, ARMI_ADD, dest, left, right);
1056    return;
1057  }
1058  r = ra_alloc1(as, ref, RSET_GPR);
1059  emit_opk(as, ARMI_ADD, dest, r,
1060	   sizeof(GCstr) + IR(refk)->i, rset_exclude(RSET_GPR, r));
1061}
1062
1063/* -- Loads and stores ---------------------------------------------------- */
1064
1065static ARMIns asm_fxloadins(ASMState *as, IRIns *ir)
1066{
1067  UNUSED(as);
1068  switch (irt_type(ir->t)) {
1069  case IRT_I8: return ARMI_LDRSB;
1070  case IRT_U8: return ARMI_LDRB;
1071  case IRT_I16: return ARMI_LDRSH;
1072  case IRT_U16: return ARMI_LDRH;
1073  case IRT_NUM: lj_assertA(!LJ_SOFTFP, "unsplit FP op"); return ARMI_VLDR_D;
1074  case IRT_FLOAT: if (!LJ_SOFTFP) return ARMI_VLDR_S;  /* fallthrough */
1075  default: return ARMI_LDR;
1076  }
1077}
1078
1079static ARMIns asm_fxstoreins(ASMState *as, IRIns *ir)
1080{
1081  UNUSED(as);
1082  switch (irt_type(ir->t)) {
1083  case IRT_I8: case IRT_U8: return ARMI_STRB;
1084  case IRT_I16: case IRT_U16: return ARMI_STRH;
1085  case IRT_NUM: lj_assertA(!LJ_SOFTFP, "unsplit FP op"); return ARMI_VSTR_D;
1086  case IRT_FLOAT: if (!LJ_SOFTFP) return ARMI_VSTR_S;  /* fallthrough */
1087  default: return ARMI_STR;
1088  }
1089}
1090
1091static void asm_fload(ASMState *as, IRIns *ir)
1092{
1093  Reg dest = ra_dest(as, ir, RSET_GPR);
1094  ARMIns ai = asm_fxloadins(as, ir);
1095  Reg idx;
1096  int32_t ofs;
1097  if (ir->op1 == REF_NIL) {  /* FLOAD from GG_State with offset. */
1098    idx = ra_allock(as, (int32_t)(ir->op2<<2) + (int32_t)J2GG(as->J), RSET_GPR);
1099    ofs = 0;
1100  } else {
1101    idx = ra_alloc1(as, ir->op1, RSET_GPR);
1102    if (ir->op2 == IRFL_TAB_ARRAY) {
1103      ofs = asm_fuseabase(as, ir->op1);
1104      if (ofs) {  /* Turn the t->array load into an add for colocated arrays. */
1105	emit_dn(as, ARMI_ADD|ARMI_K12|ofs, dest, idx);
1106	return;
1107      }
1108    }
1109    ofs = field_ofs[ir->op2];
1110  }
1111  if ((ai & 0x04000000))
1112    emit_lso(as, ai, dest, idx, ofs);
1113  else
1114    emit_lsox(as, ai, dest, idx, ofs);
1115}
1116
1117static void asm_fstore(ASMState *as, IRIns *ir)
1118{
1119  if (ir->r != RID_SINK) {
1120    Reg src = ra_alloc1(as, ir->op2, RSET_GPR);
1121    IRIns *irf = IR(ir->op1);
1122    Reg idx = ra_alloc1(as, irf->op1, rset_exclude(RSET_GPR, src));
1123    int32_t ofs = field_ofs[irf->op2];
1124    ARMIns ai = asm_fxstoreins(as, ir);
1125    if ((ai & 0x04000000))
1126      emit_lso(as, ai, src, idx, ofs);
1127    else
1128      emit_lsox(as, ai, src, idx, ofs);
1129  }
1130}
1131
1132static void asm_xload(ASMState *as, IRIns *ir)
1133{
1134  Reg dest = ra_dest(as, ir,
1135		     (!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR);
1136  lj_assertA(!(ir->op2 & IRXLOAD_UNALIGNED), "unaligned XLOAD");
1137  asm_fusexref(as, asm_fxloadins(as, ir), dest, ir->op1, RSET_GPR, 0);
1138}
1139
1140static void asm_xstore_(ASMState *as, IRIns *ir, int32_t ofs)
1141{
1142  if (ir->r != RID_SINK) {
1143    Reg src = ra_alloc1(as, ir->op2,
1144			(!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR);
1145    asm_fusexref(as, asm_fxstoreins(as, ir), src, ir->op1,
1146		 rset_exclude(RSET_GPR, src), ofs);
1147  }
1148}
1149
1150#define asm_xstore(as, ir)	asm_xstore_(as, ir, 0)
1151
1152static void asm_ahuvload(ASMState *as, IRIns *ir)
1153{
1154  int hiop = (LJ_SOFTFP && (ir+1)->o == IR_HIOP);
1155  IRType t = hiop ? IRT_NUM : irt_type(ir->t);
1156  Reg dest = RID_NONE, type = RID_NONE, idx;
1157  RegSet allow = RSET_GPR;
1158  int32_t ofs = 0;
1159  if (hiop && ra_used(ir+1)) {
1160    type = ra_dest(as, ir+1, allow);
1161    rset_clear(allow, type);
1162  }
1163  if (ra_used(ir)) {
1164    lj_assertA((LJ_SOFTFP ? 0 : irt_isnum(ir->t)) ||
1165	       irt_isint(ir->t) || irt_isaddr(ir->t),
1166	       "bad load type %d", irt_type(ir->t));
1167    dest = ra_dest(as, ir, (!LJ_SOFTFP && t == IRT_NUM) ? RSET_FPR : allow);
1168    rset_clear(allow, dest);
1169  }
1170  idx = asm_fuseahuref(as, ir->op1, &ofs, allow,
1171		       (!LJ_SOFTFP && t == IRT_NUM) ? 1024 : 4096);
1172  if (ir->o == IR_VLOAD) ofs += 8 * ir->op2;
1173  if (!hiop || type == RID_NONE) {
1174    rset_clear(allow, idx);
1175    if (ofs < 256 && ra_hasreg(dest) && (dest & 1) == 0 &&
1176	rset_test((as->freeset & allow), dest+1)) {
1177      type = dest+1;
1178      ra_modified(as, type);
1179    } else {
1180      type = RID_TMP;
1181    }
1182  }
1183  asm_guardcc(as, t == IRT_NUM ? CC_HS : CC_NE);
1184  emit_n(as, ARMI_CMN|ARMI_K12|-irt_toitype_(t), type);
1185  if (ra_hasreg(dest)) {
1186#if !LJ_SOFTFP
1187    if (t == IRT_NUM)
1188      emit_vlso(as, ARMI_VLDR_D, dest, idx, ofs);
1189    else
1190#endif
1191      emit_lso(as, ARMI_LDR, dest, idx, ofs);
1192  }
1193  emit_lso(as, ARMI_LDR, type, idx, ofs+4);
1194}
1195
1196static void asm_ahustore(ASMState *as, IRIns *ir)
1197{
1198  if (ir->r != RID_SINK) {
1199    RegSet allow = RSET_GPR;
1200    Reg idx, src = RID_NONE, type = RID_NONE;
1201    int32_t ofs = 0;
1202#if !LJ_SOFTFP
1203    if (irt_isnum(ir->t)) {
1204      src = ra_alloc1(as, ir->op2, RSET_FPR);
1205      idx = asm_fuseahuref(as, ir->op1, &ofs, allow, 1024);
1206      emit_vlso(as, ARMI_VSTR_D, src, idx, ofs);
1207    } else
1208#endif
1209    {
1210      int hiop = (LJ_SOFTFP && (ir+1)->o == IR_HIOP);
1211      if (!irt_ispri(ir->t)) {
1212	src = ra_alloc1(as, ir->op2, allow);
1213	rset_clear(allow, src);
1214      }
1215      if (hiop)
1216	type = ra_alloc1(as, (ir+1)->op2, allow);
1217      else
1218	type = ra_allock(as, (int32_t)irt_toitype(ir->t), allow);
1219      idx = asm_fuseahuref(as, ir->op1, &ofs, rset_exclude(allow, type), 4096);
1220      if (ra_hasreg(src)) emit_lso(as, ARMI_STR, src, idx, ofs);
1221      emit_lso(as, ARMI_STR, type, idx, ofs+4);
1222    }
1223  }
1224}
1225
1226static void asm_sload(ASMState *as, IRIns *ir)
1227{
1228  int32_t ofs = 8*((int32_t)ir->op1-1) + ((ir->op2 & IRSLOAD_FRAME) ? 4 : 0);
1229  int hiop = (LJ_SOFTFP && (ir+1)->o == IR_HIOP);
1230  IRType t = hiop ? IRT_NUM : irt_type(ir->t);
1231  Reg dest = RID_NONE, type = RID_NONE, base;
1232  RegSet allow = RSET_GPR;
1233  lj_assertA(!(ir->op2 & IRSLOAD_PARENT),
1234	     "bad parent SLOAD");  /* Handled by asm_head_side(). */
1235  lj_assertA(irt_isguard(ir->t) || !(ir->op2 & IRSLOAD_TYPECHECK),
1236	     "inconsistent SLOAD variant");
1237#if LJ_SOFTFP
1238  lj_assertA(!(ir->op2 & IRSLOAD_CONVERT),
1239	     "unsplit SLOAD convert");  /* Handled by LJ_SOFTFP SPLIT. */
1240  if (hiop && ra_used(ir+1)) {
1241    type = ra_dest(as, ir+1, allow);
1242    rset_clear(allow, type);
1243  }
1244#else
1245  if ((ir->op2 & IRSLOAD_CONVERT) && irt_isguard(ir->t) && t == IRT_INT) {
1246    dest = ra_scratch(as, RSET_FPR);
1247    asm_tointg(as, ir, dest);
1248    t = IRT_NUM;  /* Continue with a regular number type check. */
1249  } else
1250#endif
1251  if (ra_used(ir)) {
1252    Reg tmp = RID_NONE;
1253    if ((ir->op2 & IRSLOAD_CONVERT))
1254      tmp = ra_scratch(as, t == IRT_INT ? RSET_FPR : RSET_GPR);
1255    lj_assertA((LJ_SOFTFP ? 0 : irt_isnum(ir->t)) ||
1256	       irt_isint(ir->t) || irt_isaddr(ir->t),
1257	       "bad SLOAD type %d", irt_type(ir->t));
1258    dest = ra_dest(as, ir, (!LJ_SOFTFP && t == IRT_NUM) ? RSET_FPR : allow);
1259    rset_clear(allow, dest);
1260    base = ra_alloc1(as, REF_BASE, allow);
1261    if ((ir->op2 & IRSLOAD_CONVERT)) {
1262      if (t == IRT_INT) {
1263	emit_dn(as, ARMI_VMOV_R_S, dest, (tmp & 15));
1264	emit_dm(as, ARMI_VCVT_S32_F64, (tmp & 15), (tmp & 15));
1265	t = IRT_NUM;  /* Check for original type. */
1266      } else {
1267	emit_dm(as, ARMI_VCVT_F64_S32, (dest & 15), (dest & 15));
1268	emit_dn(as, ARMI_VMOV_S_R, tmp, (dest & 15));
1269	t = IRT_INT;  /* Check for original type. */
1270      }
1271      dest = tmp;
1272    }
1273    goto dotypecheck;
1274  }
1275  base = ra_alloc1(as, REF_BASE, allow);
1276dotypecheck:
1277  rset_clear(allow, base);
1278  if ((ir->op2 & IRSLOAD_TYPECHECK)) {
1279    if (ra_noreg(type)) {
1280      if (ofs < 256 && ra_hasreg(dest) && (dest & 1) == 0 &&
1281	  rset_test((as->freeset & allow), dest+1)) {
1282	type = dest+1;
1283	ra_modified(as, type);
1284      } else {
1285	type = RID_TMP;
1286      }
1287    }
1288    asm_guardcc(as, t == IRT_NUM ? CC_HS : CC_NE);
1289    if ((ir->op2 & IRSLOAD_KEYINDEX)) {
1290      emit_n(as, ARMI_CMN|ARMI_K12|1, type);
1291      emit_dn(as, ARMI_EOR^emit_isk12(ARMI_EOR, ~LJ_KEYINDEX), type, type);
1292    } else {
1293      emit_n(as, ARMI_CMN|ARMI_K12|-irt_toitype_(t), type);
1294    }
1295  }
1296  if (ra_hasreg(dest)) {
1297#if !LJ_SOFTFP
1298    if (t == IRT_NUM) {
1299      if (ofs < 1024) {
1300	emit_vlso(as, ARMI_VLDR_D, dest, base, ofs);
1301      } else {
1302	if (ra_hasreg(type)) emit_lso(as, ARMI_LDR, type, base, ofs+4);
1303	emit_vlso(as, ARMI_VLDR_D, dest, RID_TMP, 0);
1304	emit_opk(as, ARMI_ADD, RID_TMP, base, ofs, allow);
1305	return;
1306      }
1307    } else
1308#endif
1309      emit_lso(as, ARMI_LDR, dest, base, ofs);
1310  }
1311  if (ra_hasreg(type)) emit_lso(as, ARMI_LDR, type, base, ofs+4);
1312}
1313
1314/* -- Allocations --------------------------------------------------------- */
1315
1316#if LJ_HASFFI
1317static void asm_cnew(ASMState *as, IRIns *ir)
1318{
1319  CTState *cts = ctype_ctsG(J2G(as->J));
1320  CTypeID id = (CTypeID)IR(ir->op1)->i;
1321  CTSize sz;
1322  CTInfo info = lj_ctype_info(cts, id, &sz);
1323  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_mem_newgco];
1324  IRRef args[4];
1325  RegSet allow = (RSET_GPR & ~RSET_SCRATCH);
1326  RegSet drop = RSET_SCRATCH;
1327  lj_assertA(sz != CTSIZE_INVALID || (ir->o == IR_CNEW && ir->op2 != REF_NIL),
1328	     "bad CNEW/CNEWI operands");
1329
1330  as->gcsteps++;
1331  if (ra_hasreg(ir->r))
1332    rset_clear(drop, ir->r);  /* Dest reg handled below. */
1333  ra_evictset(as, drop);
1334  if (ra_used(ir))
1335    ra_destreg(as, ir, RID_RET);  /* GCcdata * */
1336
1337  /* Initialize immutable cdata object. */
1338  if (ir->o == IR_CNEWI) {
1339    int32_t ofs = sizeof(GCcdata);
1340    lj_assertA(sz == 4 || sz == 8, "bad CNEWI size %d", sz);
1341    if (sz == 8) {
1342      ofs += 4; ir++;
1343      lj_assertA(ir->o == IR_HIOP, "expected HIOP for CNEWI");
1344    }
1345    for (;;) {
1346      Reg r = ra_alloc1(as, ir->op2, allow);
1347      emit_lso(as, ARMI_STR, r, RID_RET, ofs);
1348      rset_clear(allow, r);
1349      if (ofs == sizeof(GCcdata)) break;
1350      ofs -= 4; ir--;
1351    }
1352  } else if (ir->op2 != REF_NIL) {  /* Create VLA/VLS/aligned cdata. */
1353    ci = &lj_ir_callinfo[IRCALL_lj_cdata_newv];
1354    args[0] = ASMREF_L;     /* lua_State *L */
1355    args[1] = ir->op1;      /* CTypeID id   */
1356    args[2] = ir->op2;      /* CTSize sz    */
1357    args[3] = ASMREF_TMP1;  /* CTSize align */
1358    asm_gencall(as, ci, args);
1359    emit_loadi(as, ra_releasetmp(as, ASMREF_TMP1), (int32_t)ctype_align(info));
1360    return;
1361  }
1362
1363  /* Initialize gct and ctypeid. lj_mem_newgco() already sets marked. */
1364  {
1365    uint32_t k = emit_isk12(ARMI_MOV, id);
1366    Reg r = k ? RID_R1 : ra_allock(as, id, allow);
1367    emit_lso(as, ARMI_STRB, RID_TMP, RID_RET, offsetof(GCcdata, gct));
1368    emit_lsox(as, ARMI_STRH, r, RID_RET, offsetof(GCcdata, ctypeid));
1369    emit_d(as, ARMI_MOV|ARMI_K12|~LJ_TCDATA, RID_TMP);
1370    if (k) emit_d(as, ARMI_MOV^k, RID_R1);
1371  }
1372  args[0] = ASMREF_L;     /* lua_State *L */
1373  args[1] = ASMREF_TMP1;  /* MSize size   */
1374  asm_gencall(as, ci, args);
1375  ra_allockreg(as, (int32_t)(sz+sizeof(GCcdata)),
1376	       ra_releasetmp(as, ASMREF_TMP1));
1377}
1378#endif
1379
1380/* -- Write barriers ------------------------------------------------------ */
1381
1382static void asm_tbar(ASMState *as, IRIns *ir)
1383{
1384  Reg tab = ra_alloc1(as, ir->op1, RSET_GPR);
1385  Reg link = ra_scratch(as, rset_exclude(RSET_GPR, tab));
1386  Reg gr = ra_allock(as, i32ptr(J2G(as->J)),
1387		     rset_exclude(rset_exclude(RSET_GPR, tab), link));
1388  Reg mark = RID_TMP;
1389  MCLabel l_end = emit_label(as);
1390  emit_lso(as, ARMI_STR, link, tab, (int32_t)offsetof(GCtab, gclist));
1391  emit_lso(as, ARMI_STRB, mark, tab, (int32_t)offsetof(GCtab, marked));
1392  emit_lso(as, ARMI_STR, tab, gr,
1393	   (int32_t)offsetof(global_State, gc.grayagain));
1394  emit_dn(as, ARMI_BIC|ARMI_K12|LJ_GC_BLACK, mark, mark);
1395  emit_lso(as, ARMI_LDR, link, gr,
1396	   (int32_t)offsetof(global_State, gc.grayagain));
1397  emit_branch(as, ARMF_CC(ARMI_B, CC_EQ), l_end);
1398  emit_n(as, ARMI_TST|ARMI_K12|LJ_GC_BLACK, mark);
1399  emit_lso(as, ARMI_LDRB, mark, tab, (int32_t)offsetof(GCtab, marked));
1400}
1401
1402static void asm_obar(ASMState *as, IRIns *ir)
1403{
1404  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_gc_barrieruv];
1405  IRRef args[2];
1406  MCLabel l_end;
1407  Reg obj, val, tmp;
1408  /* No need for other object barriers (yet). */
1409  lj_assertA(IR(ir->op1)->o == IR_UREFC, "bad OBAR type");
1410  ra_evictset(as, RSET_SCRATCH);
1411  l_end = emit_label(as);
1412  args[0] = ASMREF_TMP1;  /* global_State *g */
1413  args[1] = ir->op1;      /* TValue *tv      */
1414  asm_gencall(as, ci, args);
1415  if ((l_end[-1] >> 28) == CC_AL)
1416    l_end[-1] = ARMF_CC(l_end[-1], CC_NE);
1417  else
1418    emit_branch(as, ARMF_CC(ARMI_B, CC_EQ), l_end);
1419  ra_allockreg(as, i32ptr(J2G(as->J)), ra_releasetmp(as, ASMREF_TMP1));
1420  obj = IR(ir->op1)->r;
1421  tmp = ra_scratch(as, rset_exclude(RSET_GPR, obj));
1422  emit_n(as, ARMF_CC(ARMI_TST, CC_NE)|ARMI_K12|LJ_GC_BLACK, tmp);
1423  emit_n(as, ARMI_TST|ARMI_K12|LJ_GC_WHITES, RID_TMP);
1424  val = ra_alloc1(as, ir->op2, rset_exclude(RSET_GPR, obj));
1425  emit_lso(as, ARMI_LDRB, tmp, obj,
1426	   (int32_t)offsetof(GCupval, marked)-(int32_t)offsetof(GCupval, tv));
1427  emit_lso(as, ARMI_LDRB, RID_TMP, val, (int32_t)offsetof(GChead, marked));
1428}
1429
1430/* -- Arithmetic and logic operations ------------------------------------- */
1431
1432#if !LJ_SOFTFP
1433static void asm_fparith(ASMState *as, IRIns *ir, ARMIns ai)
1434{
1435  Reg dest = ra_dest(as, ir, RSET_FPR);
1436  Reg right, left = ra_alloc2(as, ir, RSET_FPR);
1437  right = (left >> 8); left &= 255;
1438  emit_dnm(as, ai, (dest & 15), (left & 15), (right & 15));
1439}
1440
1441static void asm_fpunary(ASMState *as, IRIns *ir, ARMIns ai)
1442{
1443  Reg dest = ra_dest(as, ir, RSET_FPR);
1444  Reg left = ra_hintalloc(as, ir->op1, dest, RSET_FPR);
1445  emit_dm(as, ai, (dest & 15), (left & 15));
1446}
1447
1448static void asm_callround(ASMState *as, IRIns *ir, int id)
1449{
1450  /* The modified regs must match with the *.dasc implementation. */
1451  RegSet drop = RID2RSET(RID_R0)|RID2RSET(RID_R1)|RID2RSET(RID_R2)|
1452		RID2RSET(RID_R3)|RID2RSET(RID_R12);
1453  RegSet of;
1454  Reg dest, src;
1455  ra_evictset(as, drop);
1456  dest = ra_dest(as, ir, RSET_FPR);
1457  emit_dnm(as, ARMI_VMOV_D_RR, RID_RETLO, RID_RETHI, (dest & 15));
1458  emit_call(as, id == IRFPM_FLOOR ? (void *)lj_vm_floor_sf :
1459		id == IRFPM_CEIL ? (void *)lj_vm_ceil_sf :
1460				   (void *)lj_vm_trunc_sf);
1461  /* Workaround to protect argument GPRs from being used for remat. */
1462  of = as->freeset;
1463  as->freeset &= ~RSET_RANGE(RID_R0, RID_R1+1);
1464  as->cost[RID_R0] = as->cost[RID_R1] = REGCOST(~0u, ASMREF_L);
1465  src = ra_alloc1(as, ir->op1, RSET_FPR);  /* May alloc GPR to remat FPR. */
1466  as->freeset |= (of & RSET_RANGE(RID_R0, RID_R1+1));
1467  emit_dnm(as, ARMI_VMOV_RR_D, RID_R0, RID_R1, (src & 15));
1468}
1469
1470static void asm_fpmath(ASMState *as, IRIns *ir)
1471{
1472  if (ir->op2 <= IRFPM_TRUNC)
1473    asm_callround(as, ir, ir->op2);
1474  else if (ir->op2 == IRFPM_SQRT)
1475    asm_fpunary(as, ir, ARMI_VSQRT_D);
1476  else
1477    asm_callid(as, ir, IRCALL_lj_vm_floor + ir->op2);
1478}
1479#endif
1480
1481static int asm_swapops(ASMState *as, IRRef lref, IRRef rref)
1482{
1483  IRIns *ir;
1484  if (irref_isk(rref))
1485    return 0;  /* Don't swap constants to the left. */
1486  if (irref_isk(lref))
1487    return 1;  /* But swap constants to the right. */
1488  ir = IR(rref);
1489  if ((ir->o >= IR_BSHL && ir->o <= IR_BROR) ||
1490      (ir->o == IR_ADD && ir->op1 == ir->op2))
1491    return 0;  /* Don't swap fusable operands to the left. */
1492  ir = IR(lref);
1493  if ((ir->o >= IR_BSHL && ir->o <= IR_BROR) ||
1494      (ir->o == IR_ADD && ir->op1 == ir->op2))
1495    return 1;  /* But swap fusable operands to the right. */
1496  return 0;  /* Otherwise don't swap. */
1497}
1498
1499static void asm_intop(ASMState *as, IRIns *ir, ARMIns ai)
1500{
1501  IRRef lref = ir->op1, rref = ir->op2;
1502  Reg left, dest = ra_dest(as, ir, RSET_GPR);
1503  uint32_t m;
1504  if (asm_swapops(as, lref, rref)) {
1505    IRRef tmp = lref; lref = rref; rref = tmp;
1506    if ((ai & ~ARMI_S) == ARMI_SUB || (ai & ~ARMI_S) == ARMI_SBC)
1507      ai ^= (ARMI_SUB^ARMI_RSB);
1508  }
1509  left = ra_hintalloc(as, lref, dest, RSET_GPR);
1510  m = asm_fuseopm(as, ai, rref, rset_exclude(RSET_GPR, left));
1511  if (irt_isguard(ir->t)) {  /* For IR_ADDOV etc. */
1512    asm_guardcc(as, CC_VS);
1513    ai |= ARMI_S;
1514  }
1515  emit_dn(as, ai^m, dest, left);
1516}
1517
1518/* Try to drop cmp r, #0. */
1519static ARMIns asm_drop_cmp0(ASMState *as, ARMIns ai)
1520{
1521  if (as->flagmcp == as->mcp) {
1522    uint32_t cc = (as->mcp[1] >> 28);
1523    as->flagmcp = NULL;
1524    if (cc <= CC_NE) {
1525      as->mcp++;
1526      ai |= ARMI_S;
1527    } else if (cc == CC_GE) {
1528      *++as->mcp ^= ((CC_GE^CC_PL) << 28);
1529      ai |= ARMI_S;
1530    } else if (cc == CC_LT) {
1531      *++as->mcp ^= ((CC_LT^CC_MI) << 28);
1532      ai |= ARMI_S;
1533    }  /* else: other conds don't work in general. */
1534  }
1535  return ai;
1536}
1537
1538static void asm_intop_s(ASMState *as, IRIns *ir, ARMIns ai)
1539{
1540  asm_intop(as, ir, asm_drop_cmp0(as, ai));
1541}
1542
1543static void asm_intneg(ASMState *as, IRIns *ir, ARMIns ai)
1544{
1545  Reg dest = ra_dest(as, ir, RSET_GPR);
1546  Reg left = ra_hintalloc(as, ir->op1, dest, RSET_GPR);
1547  emit_dn(as, ai|ARMI_K12|0, dest, left);
1548}
1549
1550/* NYI: use add/shift for MUL(OV) with constants. FOLD only does 2^k. */
1551static void asm_intmul(ASMState *as, IRIns *ir)
1552{
1553  Reg dest = ra_dest(as, ir, RSET_GPR);
1554  Reg left = ra_alloc1(as, ir->op1, rset_exclude(RSET_GPR, dest));
1555  Reg right = ra_alloc1(as, ir->op2, rset_exclude(RSET_GPR, left));
1556  Reg tmp = RID_NONE;
1557  /* ARMv5 restriction: dest != left and dest_hi != left. */
1558  if (dest == left && left != right) { left = right; right = dest; }
1559  if (irt_isguard(ir->t)) {  /* IR_MULOV */
1560    if (!(as->flags & JIT_F_ARMV6) && dest == left)
1561      tmp = left = ra_scratch(as, rset_exclude(RSET_GPR, left));
1562    asm_guardcc(as, CC_NE);
1563    emit_nm(as, ARMI_TEQ|ARMF_SH(ARMSH_ASR, 31), RID_TMP, dest);
1564    emit_dnm(as, ARMI_SMULL|ARMF_S(right), dest, RID_TMP, left);
1565  } else {
1566    if (!(as->flags & JIT_F_ARMV6) && dest == left) tmp = left = RID_TMP;
1567    emit_nm(as, ARMI_MUL|ARMF_S(right), dest, left);
1568  }
1569  /* Only need this for the dest == left == right case. */
1570  if (ra_hasreg(tmp)) emit_dm(as, ARMI_MOV, tmp, right);
1571}
1572
1573static void asm_add(ASMState *as, IRIns *ir)
1574{
1575#if !LJ_SOFTFP
1576  if (irt_isnum(ir->t)) {
1577    if (!asm_fusemadd(as, ir, ARMI_VMLA_D, ARMI_VMLA_D))
1578      asm_fparith(as, ir, ARMI_VADD_D);
1579    return;
1580  }
1581#endif
1582  asm_intop_s(as, ir, ARMI_ADD);
1583}
1584
1585static void asm_sub(ASMState *as, IRIns *ir)
1586{
1587#if !LJ_SOFTFP
1588  if (irt_isnum(ir->t)) {
1589    if (!asm_fusemadd(as, ir, ARMI_VNMLS_D, ARMI_VMLS_D))
1590      asm_fparith(as, ir, ARMI_VSUB_D);
1591    return;
1592  }
1593#endif
1594  asm_intop_s(as, ir, ARMI_SUB);
1595}
1596
1597static void asm_mul(ASMState *as, IRIns *ir)
1598{
1599#if !LJ_SOFTFP
1600  if (irt_isnum(ir->t)) {
1601    asm_fparith(as, ir, ARMI_VMUL_D);
1602    return;
1603  }
1604#endif
1605  asm_intmul(as, ir);
1606}
1607
1608#define asm_addov(as, ir)	asm_add(as, ir)
1609#define asm_subov(as, ir)	asm_sub(as, ir)
1610#define asm_mulov(as, ir)	asm_mul(as, ir)
1611
1612#if !LJ_SOFTFP
1613#define asm_fpdiv(as, ir)	asm_fparith(as, ir, ARMI_VDIV_D)
1614#define asm_abs(as, ir)		asm_fpunary(as, ir, ARMI_VABS_D)
1615#endif
1616
1617static void asm_neg(ASMState *as, IRIns *ir)
1618{
1619#if !LJ_SOFTFP
1620  if (irt_isnum(ir->t)) {
1621    asm_fpunary(as, ir, ARMI_VNEG_D);
1622    return;
1623  }
1624#endif
1625  asm_intneg(as, ir, ARMI_RSB);
1626}
1627
1628static void asm_bitop(ASMState *as, IRIns *ir, ARMIns ai)
1629{
1630  ai = asm_drop_cmp0(as, ai);
1631  if (ir->op2 == 0) {
1632    Reg dest = ra_dest(as, ir, RSET_GPR);
1633    uint32_t m = asm_fuseopm(as, ai, ir->op1, RSET_GPR);
1634    emit_d(as, ai^m, dest);
1635  } else {
1636    /* NYI: Turn BAND !k12 into uxtb, uxth or bfc or shl+shr. */
1637    asm_intop(as, ir, ai);
1638  }
1639}
1640
1641#define asm_bnot(as, ir)	asm_bitop(as, ir, ARMI_MVN)
1642
1643static void asm_bswap(ASMState *as, IRIns *ir)
1644{
1645  Reg dest = ra_dest(as, ir, RSET_GPR);
1646  Reg left = ra_alloc1(as, ir->op1, RSET_GPR);
1647  if ((as->flags & JIT_F_ARMV6)) {
1648    emit_dm(as, ARMI_REV, dest, left);
1649  } else {
1650    Reg tmp2 = dest;
1651    if (tmp2 == left)
1652      tmp2 = ra_scratch(as, rset_exclude(rset_exclude(RSET_GPR, dest), left));
1653    emit_dnm(as, ARMI_EOR|ARMF_SH(ARMSH_LSR, 8), dest, tmp2, RID_TMP);
1654    emit_dm(as, ARMI_MOV|ARMF_SH(ARMSH_ROR, 8), tmp2, left);
1655    emit_dn(as, ARMI_BIC|ARMI_K12|256*8|255, RID_TMP, RID_TMP);
1656    emit_dnm(as, ARMI_EOR|ARMF_SH(ARMSH_ROR, 16), RID_TMP, left, left);
1657  }
1658}
1659
1660#define asm_band(as, ir)	asm_bitop(as, ir, ARMI_AND)
1661#define asm_bor(as, ir)		asm_bitop(as, ir, ARMI_ORR)
1662#define asm_bxor(as, ir)	asm_bitop(as, ir, ARMI_EOR)
1663
1664static void asm_bitshift(ASMState *as, IRIns *ir, ARMShift sh)
1665{
1666  if (irref_isk(ir->op2)) {  /* Constant shifts. */
1667    /* NYI: Turn SHL+SHR or BAND+SHR into uxtb, uxth or ubfx. */
1668    /* NYI: Turn SHL+ASR into sxtb, sxth or sbfx. */
1669    Reg dest = ra_dest(as, ir, RSET_GPR);
1670    Reg left = ra_alloc1(as, ir->op1, RSET_GPR);
1671    int32_t shift = (IR(ir->op2)->i & 31);
1672    emit_dm(as, ARMI_MOV|ARMF_SH(sh, shift), dest, left);
1673  } else {
1674    Reg dest = ra_dest(as, ir, RSET_GPR);
1675    Reg left = ra_alloc1(as, ir->op1, RSET_GPR);
1676    Reg right = ra_alloc1(as, ir->op2, rset_exclude(RSET_GPR, left));
1677    emit_dm(as, ARMI_MOV|ARMF_RSH(sh, right), dest, left);
1678  }
1679}
1680
1681#define asm_bshl(as, ir)	asm_bitshift(as, ir, ARMSH_LSL)
1682#define asm_bshr(as, ir)	asm_bitshift(as, ir, ARMSH_LSR)
1683#define asm_bsar(as, ir)	asm_bitshift(as, ir, ARMSH_ASR)
1684#define asm_bror(as, ir)	asm_bitshift(as, ir, ARMSH_ROR)
1685#define asm_brol(as, ir)	lj_assertA(0, "unexpected BROL")
1686
1687static void asm_intmin_max(ASMState *as, IRIns *ir, int cc)
1688{
1689  uint32_t kcmp = 0, kmov = 0;
1690  Reg dest = ra_dest(as, ir, RSET_GPR);
1691  Reg left = ra_hintalloc(as, ir->op1, dest, RSET_GPR);
1692  Reg right = 0;
1693  if (irref_isk(ir->op2)) {
1694    kcmp = emit_isk12(ARMI_CMP, IR(ir->op2)->i);
1695    if (kcmp) kmov = emit_isk12(ARMI_MOV, IR(ir->op2)->i);
1696  }
1697  if (!kmov) {
1698    kcmp = 0;
1699    right = ra_alloc1(as, ir->op2, rset_exclude(RSET_GPR, left));
1700  }
1701  if (kmov || dest != right) {
1702    emit_dm(as, ARMF_CC(ARMI_MOV, cc)^kmov, dest, right);
1703    cc ^= 1;  /* Must use opposite conditions for paired moves. */
1704  } else {
1705    cc ^= (CC_LT^CC_GT);  /* Otherwise may swap CC_LT <-> CC_GT. */
1706  }
1707  if (dest != left) emit_dm(as, ARMF_CC(ARMI_MOV, cc), dest, left);
1708  emit_nm(as, ARMI_CMP^kcmp, left, right);
1709}
1710
1711#if LJ_SOFTFP
1712static void asm_sfpmin_max(ASMState *as, IRIns *ir, int cc)
1713{
1714  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_softfp_cmp];
1715  RegSet drop = RSET_SCRATCH;
1716  Reg r;
1717  IRRef args[4];
1718  args[0] = ir->op1; args[1] = (ir+1)->op1;
1719  args[2] = ir->op2; args[3] = (ir+1)->op2;
1720  /* __aeabi_cdcmple preserves r0-r3. */
1721  if (ra_hasreg(ir->r)) rset_clear(drop, ir->r);
1722  if (ra_hasreg((ir+1)->r)) rset_clear(drop, (ir+1)->r);
1723  if (!rset_test(as->freeset, RID_R2) &&
1724      regcost_ref(as->cost[RID_R2]) == args[2]) rset_clear(drop, RID_R2);
1725  if (!rset_test(as->freeset, RID_R3) &&
1726      regcost_ref(as->cost[RID_R3]) == args[3]) rset_clear(drop, RID_R3);
1727  ra_evictset(as, drop);
1728  ra_destpair(as, ir);
1729  emit_dm(as, ARMF_CC(ARMI_MOV, cc), RID_RETHI, RID_R3);
1730  emit_dm(as, ARMF_CC(ARMI_MOV, cc), RID_RETLO, RID_R2);
1731  emit_call(as, (void *)ci->func);
1732  for (r = RID_R0; r <= RID_R3; r++)
1733    ra_leftov(as, r, args[r-RID_R0]);
1734}
1735#else
1736static void asm_fpmin_max(ASMState *as, IRIns *ir, int cc)
1737{
1738  Reg dest = (ra_dest(as, ir, RSET_FPR) & 15);
1739  Reg right, left = ra_alloc2(as, ir, RSET_FPR);
1740  right = ((left >> 8) & 15); left &= 15;
1741  if (dest != left) emit_dm(as, ARMF_CC(ARMI_VMOV_D, cc^1), dest, left);
1742  if (dest != right) emit_dm(as, ARMF_CC(ARMI_VMOV_D, cc), dest, right);
1743  emit_d(as, ARMI_VMRS, 0);
1744  emit_dm(as, ARMI_VCMP_D, left, right);
1745}
1746#endif
1747
1748static void asm_min_max(ASMState *as, IRIns *ir, int cc, int fcc)
1749{
1750#if LJ_SOFTFP
1751  UNUSED(fcc);
1752#else
1753  if (irt_isnum(ir->t))
1754    asm_fpmin_max(as, ir, fcc);
1755  else
1756#endif
1757    asm_intmin_max(as, ir, cc);
1758}
1759
1760#define asm_min(as, ir)		asm_min_max(as, ir, CC_GT, CC_PL)
1761#define asm_max(as, ir)		asm_min_max(as, ir, CC_LT, CC_LE)
1762
1763/* -- Comparisons --------------------------------------------------------- */
1764
1765/* Map of comparisons to flags. ORDER IR. */
1766static const uint8_t asm_compmap[IR_ABC+1] = {
1767  /* op  FP swp  int cc   FP cc */
1768  /* LT       */ CC_GE + (CC_HS << 4),
1769  /* GE    x  */ CC_LT + (CC_HI << 4),
1770  /* LE       */ CC_GT + (CC_HI << 4),
1771  /* GT    x  */ CC_LE + (CC_HS << 4),
1772  /* ULT   x  */ CC_HS + (CC_LS << 4),
1773  /* UGE      */ CC_LO + (CC_LO << 4),
1774  /* ULE   x  */ CC_HI + (CC_LO << 4),
1775  /* UGT      */ CC_LS + (CC_LS << 4),
1776  /* EQ       */ CC_NE + (CC_NE << 4),
1777  /* NE       */ CC_EQ + (CC_EQ << 4),
1778  /* ABC      */ CC_LS + (CC_LS << 4)  /* Same as UGT. */
1779};
1780
1781#if LJ_SOFTFP
1782/* FP comparisons. */
1783static void asm_sfpcomp(ASMState *as, IRIns *ir)
1784{
1785  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_softfp_cmp];
1786  RegSet drop = RSET_SCRATCH;
1787  Reg r;
1788  IRRef args[4];
1789  int swp = (((ir->o ^ (ir->o >> 2)) & ~(ir->o >> 3) & 1) << 1);
1790  args[swp^0] = ir->op1; args[swp^1] = (ir+1)->op1;
1791  args[swp^2] = ir->op2; args[swp^3] = (ir+1)->op2;
1792  /* __aeabi_cdcmple preserves r0-r3. This helps to reduce spills. */
1793  for (r = RID_R0; r <= RID_R3; r++)
1794    if (!rset_test(as->freeset, r) &&
1795	regcost_ref(as->cost[r]) == args[r-RID_R0]) rset_clear(drop, r);
1796  ra_evictset(as, drop);
1797  asm_guardcc(as, (asm_compmap[ir->o] >> 4));
1798  emit_call(as, (void *)ci->func);
1799  for (r = RID_R0; r <= RID_R3; r++)
1800    ra_leftov(as, r, args[r-RID_R0]);
1801}
1802#else
1803/* FP comparisons. */
1804static void asm_fpcomp(ASMState *as, IRIns *ir)
1805{
1806  Reg left, right;
1807  ARMIns ai;
1808  int swp = ((ir->o ^ (ir->o >> 2)) & ~(ir->o >> 3) & 1);
1809  if (!swp && irref_isk(ir->op2) && ir_knum(IR(ir->op2))->u64 == 0) {
1810    left = (ra_alloc1(as, ir->op1, RSET_FPR) & 15);
1811    right = 0;
1812    ai = ARMI_VCMPZ_D;
1813  } else {
1814    left = ra_alloc2(as, ir, RSET_FPR);
1815    if (swp) {
1816      right = (left & 15); left = ((left >> 8) & 15);
1817    } else {
1818      right = ((left >> 8) & 15); left &= 15;
1819    }
1820    ai = ARMI_VCMP_D;
1821  }
1822  asm_guardcc(as, (asm_compmap[ir->o] >> 4));
1823  emit_d(as, ARMI_VMRS, 0);
1824  emit_dm(as, ai, left, right);
1825}
1826#endif
1827
1828/* Integer comparisons. */
1829static void asm_intcomp(ASMState *as, IRIns *ir)
1830{
1831  ARMCC cc = (asm_compmap[ir->o] & 15);
1832  IRRef lref = ir->op1, rref = ir->op2;
1833  Reg left;
1834  uint32_t m;
1835  int cmpprev0 = 0;
1836  lj_assertA(irt_isint(ir->t) || irt_isu32(ir->t) || irt_isaddr(ir->t),
1837	     "bad comparison data type %d", irt_type(ir->t));
1838  if (asm_swapops(as, lref, rref)) {
1839    Reg tmp = lref; lref = rref; rref = tmp;
1840    if (cc >= CC_GE) cc ^= 7;  /* LT <-> GT, LE <-> GE */
1841    else if (cc > CC_NE) cc ^= 11;  /* LO <-> HI, LS <-> HS */
1842  }
1843  if (irref_isk(rref) && IR(rref)->i == 0) {
1844    IRIns *irl = IR(lref);
1845    cmpprev0 = (irl+1 == ir);
1846    /* Combine comp(BAND(left, right), 0) into tst left, right. */
1847    if (cmpprev0 && irl->o == IR_BAND && !ra_used(irl)) {
1848      IRRef blref = irl->op1, brref = irl->op2;
1849      uint32_t m2 = 0;
1850      Reg bleft;
1851      if (asm_swapops(as, blref, brref)) {
1852	Reg tmp = blref; blref = brref; brref = tmp;
1853      }
1854      if (irref_isk(brref)) {
1855	m2 = emit_isk12(ARMI_AND, IR(brref)->i);
1856	if ((m2 & (ARMI_AND^ARMI_BIC)))
1857	  goto notst;  /* Not beneficial if we miss a constant operand. */
1858      }
1859      if (cc == CC_GE) cc = CC_PL;
1860      else if (cc == CC_LT) cc = CC_MI;
1861      else if (cc > CC_NE) goto notst;  /* Other conds don't work with tst. */
1862      bleft = ra_alloc1(as, blref, RSET_GPR);
1863      if (!m2) m2 = asm_fuseopm(as, 0, brref, rset_exclude(RSET_GPR, bleft));
1864      asm_guardcc(as, cc);
1865      emit_n(as, ARMI_TST^m2, bleft);
1866      return;
1867    }
1868  }
1869notst:
1870  left = ra_alloc1(as, lref, RSET_GPR);
1871  m = asm_fuseopm(as, ARMI_CMP, rref, rset_exclude(RSET_GPR, left));
1872  asm_guardcc(as, cc);
1873  emit_n(as, ARMI_CMP^m, left);
1874  /* Signed comparison with zero and referencing previous ins? */
1875  if (cmpprev0 && (cc <= CC_NE || cc >= CC_GE))
1876    as->flagmcp = as->mcp;  /* Allow elimination of the compare. */
1877}
1878
1879static void asm_comp(ASMState *as, IRIns *ir)
1880{
1881#if !LJ_SOFTFP
1882  if (irt_isnum(ir->t))
1883    asm_fpcomp(as, ir);
1884  else
1885#endif
1886    asm_intcomp(as, ir);
1887}
1888
1889#define asm_equal(as, ir)	asm_comp(as, ir)
1890
1891#if LJ_HASFFI
1892/* 64 bit integer comparisons. */
1893static void asm_int64comp(ASMState *as, IRIns *ir)
1894{
1895  int signedcomp = (ir->o <= IR_GT);
1896  ARMCC cclo, cchi;
1897  Reg leftlo, lefthi;
1898  uint32_t mlo, mhi;
1899  RegSet allow = RSET_GPR, oldfree;
1900
1901  /* Always use unsigned comparison for loword. */
1902  cclo = asm_compmap[ir->o + (signedcomp ? 4 : 0)] & 15;
1903  leftlo = ra_alloc1(as, ir->op1, allow);
1904  oldfree = as->freeset;
1905  mlo = asm_fuseopm(as, ARMI_CMP, ir->op2, rset_clear(allow, leftlo));
1906  allow &= ~(oldfree & ~as->freeset);  /* Update for allocs of asm_fuseopm. */
1907
1908  /* Use signed or unsigned comparison for hiword. */
1909  cchi = asm_compmap[ir->o] & 15;
1910  lefthi = ra_alloc1(as, (ir+1)->op1, allow);
1911  mhi = asm_fuseopm(as, ARMI_CMP, (ir+1)->op2, rset_clear(allow, lefthi));
1912
1913  /* All register allocations must be performed _before_ this point. */
1914  if (signedcomp) {
1915    MCLabel l_around = emit_label(as);
1916    asm_guardcc(as, cclo);
1917    emit_n(as, ARMI_CMP^mlo, leftlo);
1918    emit_branch(as, ARMF_CC(ARMI_B, CC_NE), l_around);
1919    if (cchi == CC_GE || cchi == CC_LE) cchi ^= 6;  /* GE -> GT, LE -> LT */
1920    asm_guardcc(as, cchi);
1921  } else {
1922    asm_guardcc(as, cclo);
1923    emit_n(as, ARMF_CC(ARMI_CMP, CC_EQ)^mlo, leftlo);
1924  }
1925  emit_n(as, ARMI_CMP^mhi, lefthi);
1926}
1927#endif
1928
1929/* -- Split register ops -------------------------------------------------- */
1930
1931/* Hiword op of a split 32/32 bit op. Previous op is the loword op. */
1932static void asm_hiop(ASMState *as, IRIns *ir)
1933{
1934  /* HIOP is marked as a store because it needs its own DCE logic. */
1935  int uselo = ra_used(ir-1), usehi = ra_used(ir);  /* Loword/hiword used? */
1936  if (LJ_UNLIKELY(!(as->flags & JIT_F_OPT_DCE))) uselo = usehi = 1;
1937#if LJ_HASFFI || LJ_SOFTFP
1938  if ((ir-1)->o <= IR_NE) {  /* 64 bit integer or FP comparisons. ORDER IR. */
1939    as->curins--;  /* Always skip the loword comparison. */
1940#if LJ_SOFTFP
1941    if (!irt_isint(ir->t)) {
1942      asm_sfpcomp(as, ir-1);
1943      return;
1944    }
1945#endif
1946#if LJ_HASFFI
1947    asm_int64comp(as, ir-1);
1948#endif
1949    return;
1950#if LJ_SOFTFP
1951  } else if ((ir-1)->o == IR_MIN || (ir-1)->o == IR_MAX) {
1952    as->curins--;  /* Always skip the loword min/max. */
1953    if (uselo || usehi)
1954      asm_sfpmin_max(as, ir-1, (ir-1)->o == IR_MIN ? CC_HS : CC_LS);
1955    return;
1956#elif LJ_HASFFI
1957  } else if ((ir-1)->o == IR_CONV) {
1958    as->curins--;  /* Always skip the CONV. */
1959    if (usehi || uselo)
1960      asm_conv64(as, ir);
1961    return;
1962#endif
1963  } else if ((ir-1)->o == IR_XSTORE) {
1964    if ((ir-1)->r != RID_SINK)
1965      asm_xstore_(as, ir, 4);
1966    return;
1967  }
1968#endif
1969  if (!usehi) return;  /* Skip unused hiword op for all remaining ops. */
1970  switch ((ir-1)->o) {
1971#if LJ_HASFFI
1972  case IR_ADD:
1973    as->curins--;
1974    asm_intop(as, ir, ARMI_ADC);
1975    asm_intop(as, ir-1, ARMI_ADD|ARMI_S);
1976    break;
1977  case IR_SUB:
1978    as->curins--;
1979    asm_intop(as, ir, ARMI_SBC);
1980    asm_intop(as, ir-1, ARMI_SUB|ARMI_S);
1981    break;
1982  case IR_NEG:
1983    as->curins--;
1984    asm_intneg(as, ir, ARMI_RSC);
1985    asm_intneg(as, ir-1, ARMI_RSB|ARMI_S);
1986    break;
1987  case IR_CNEWI:
1988    /* Nothing to do here. Handled by lo op itself. */
1989    break;
1990#endif
1991#if LJ_SOFTFP
1992  case IR_SLOAD: case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
1993  case IR_STRTO:
1994    if (!uselo)
1995      ra_allocref(as, ir->op1, RSET_GPR);  /* Mark lo op as used. */
1996    break;
1997  case IR_ASTORE: case IR_HSTORE: case IR_USTORE: case IR_TOSTR: case IR_TMPREF:
1998    /* Nothing to do here. Handled by lo op itself. */
1999    break;
2000#endif
2001  case IR_CALLN: case IR_CALLL: case IR_CALLS: case IR_CALLXS:
2002    if (!uselo)
2003      ra_allocref(as, ir->op1, RID2RSET(RID_RETLO));  /* Mark lo op as used. */
2004    break;
2005  default: lj_assertA(0, "bad HIOP for op %d", (ir-1)->o); break;
2006  }
2007}
2008
2009/* -- Profiling ----------------------------------------------------------- */
2010
2011static void asm_prof(ASMState *as, IRIns *ir)
2012{
2013  UNUSED(ir);
2014  asm_guardcc(as, CC_NE);
2015  emit_n(as, ARMI_TST|ARMI_K12|HOOK_PROFILE, RID_TMP);
2016  emit_lsptr(as, ARMI_LDRB, RID_TMP, (void *)&J2G(as->J)->hookmask);
2017}
2018
2019/* -- Stack handling ------------------------------------------------------ */
2020
2021/* Check Lua stack size for overflow. Use exit handler as fallback. */
2022static void asm_stack_check(ASMState *as, BCReg topslot,
2023			    IRIns *irp, RegSet allow, ExitNo exitno)
2024{
2025  int savereg = 0;
2026  Reg pbase;
2027  uint32_t k;
2028  if (irp) {
2029    if (!ra_hasspill(irp->s)) {
2030      pbase = irp->r;
2031      lj_assertA(ra_hasreg(pbase), "base reg lost");
2032    } else if (allow) {
2033      pbase = rset_pickbot(allow);
2034    } else {
2035      pbase = RID_RET;
2036      savereg = 1;
2037    }
2038  } else {
2039    pbase = RID_BASE;
2040  }
2041  emit_branch(as, ARMF_CC(ARMI_BL, CC_LS), exitstub_addr(as->J, exitno));
2042  if (savereg)
2043    emit_lso(as, ARMI_LDR, RID_RET, RID_SP, 0);  /* Restore temp. register. */
2044  k = emit_isk12(0, (int32_t)(8*topslot));
2045  lj_assertA(k, "slot offset %d does not fit in K12", 8*topslot);
2046  emit_n(as, ARMI_CMP^k, RID_TMP);
2047  emit_dnm(as, ARMI_SUB, RID_TMP, RID_TMP, pbase);
2048  emit_lso(as, ARMI_LDR, RID_TMP, RID_TMP,
2049	   (int32_t)offsetof(lua_State, maxstack));
2050  if (irp) {  /* Must not spill arbitrary registers in head of side trace. */
2051    int32_t i = i32ptr(&J2G(as->J)->cur_L);
2052    if (ra_hasspill(irp->s))
2053      emit_lso(as, ARMI_LDR, pbase, RID_SP, sps_scale(irp->s));
2054    emit_lso(as, ARMI_LDR, RID_TMP, RID_TMP, (i & 4095));
2055    if (savereg)
2056      emit_lso(as, ARMI_STR, RID_RET, RID_SP, 0);  /* Save temp. register. */
2057    emit_loadi(as, RID_TMP, (i & ~4095));
2058  } else {
2059    emit_getgl(as, RID_TMP, cur_L);
2060  }
2061}
2062
2063/* Restore Lua stack from on-trace state. */
2064static void asm_stack_restore(ASMState *as, SnapShot *snap)
2065{
2066  SnapEntry *map = &as->T->snapmap[snap->mapofs];
2067  SnapEntry *flinks = &as->T->snapmap[snap_nextofs(as->T, snap)-1];
2068  MSize n, nent = snap->nent;
2069  int32_t bias = 0;
2070  /* Store the value of all modified slots to the Lua stack. */
2071  for (n = 0; n < nent; n++) {
2072    SnapEntry sn = map[n];
2073    BCReg s = snap_slot(sn);
2074    int32_t ofs = 8*((int32_t)s-1) - bias;
2075    IRRef ref = snap_ref(sn);
2076    IRIns *ir = IR(ref);
2077    if ((sn & SNAP_NORESTORE))
2078      continue;
2079    if (irt_isnum(ir->t)) {
2080#if LJ_SOFTFP
2081      RegSet odd = rset_exclude(RSET_GPRODD, RID_BASE);
2082      Reg tmp;
2083      /* LJ_SOFTFP: must be a number constant. */
2084      lj_assertA(irref_isk(ref), "unsplit FP op");
2085      tmp = ra_allock(as, (int32_t)ir_knum(ir)->u32.lo,
2086		      rset_exclude(RSET_GPREVEN, RID_BASE));
2087      emit_lso(as, ARMI_STR, tmp, RID_BASE, ofs);
2088      if (rset_test(as->freeset, tmp+1)) odd = RID2RSET(tmp+1);
2089      tmp = ra_allock(as, (int32_t)ir_knum(ir)->u32.hi, odd);
2090      emit_lso(as, ARMI_STR, tmp, RID_BASE, ofs+4);
2091#else
2092      Reg src = ra_alloc1(as, ref, RSET_FPR);
2093      if (LJ_UNLIKELY(ofs < -1020 || ofs > 1020)) {
2094	int32_t adj = ofs & 0xffffff00;  /* K12-friendly. */
2095	bias += adj;
2096	ofs -= adj;
2097	emit_addptr(as, RID_BASE, -adj);
2098      }
2099      emit_vlso(as, ARMI_VSTR_D, src, RID_BASE, ofs);
2100#endif
2101    } else {
2102      RegSet odd = rset_exclude(RSET_GPRODD, RID_BASE);
2103      Reg type;
2104      lj_assertA(irt_ispri(ir->t) || irt_isaddr(ir->t) || irt_isinteger(ir->t),
2105		 "restore of IR type %d", irt_type(ir->t));
2106      if (!irt_ispri(ir->t)) {
2107	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPREVEN, RID_BASE));
2108	emit_lso(as, ARMI_STR, src, RID_BASE, ofs);
2109	if (rset_test(as->freeset, src+1)) odd = RID2RSET(src+1);
2110      }
2111      if ((sn & (SNAP_CONT|SNAP_FRAME))) {
2112	if (s == 0) continue;  /* Do not overwrite link to previous frame. */
2113	type = ra_allock(as, (int32_t)(*flinks--), odd);
2114#if LJ_SOFTFP
2115      } else if ((sn & SNAP_SOFTFPNUM)) {
2116	type = ra_alloc1(as, ref+1, rset_exclude(RSET_GPRODD, RID_BASE));
2117#endif
2118      } else if ((sn & SNAP_KEYINDEX)) {
2119	type = ra_allock(as, (int32_t)LJ_KEYINDEX, odd);
2120      } else {
2121	type = ra_allock(as, (int32_t)irt_toitype(ir->t), odd);
2122      }
2123      emit_lso(as, ARMI_STR, type, RID_BASE, ofs+4);
2124    }
2125    checkmclim(as);
2126  }
2127  emit_addptr(as, RID_BASE, bias);
2128  lj_assertA(map + nent == flinks, "inconsistent frames in snapshot");
2129}
2130
2131/* -- GC handling --------------------------------------------------------- */
2132
2133/* Marker to prevent patching the GC check exit. */
2134#define ARM_NOPATCH_GC_CHECK	(ARMI_BIC|ARMI_K12)
2135
2136/* Check GC threshold and do one or more GC steps. */
2137static void asm_gc_check(ASMState *as)
2138{
2139  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_gc_step_jit];
2140  IRRef args[2];
2141  MCLabel l_end;
2142  Reg tmp1, tmp2;
2143  ra_evictset(as, RSET_SCRATCH);
2144  l_end = emit_label(as);
2145  /* Exit trace if in GCSatomic or GCSfinalize. Avoids syncing GC objects. */
2146  asm_guardcc(as, CC_NE);  /* Assumes asm_snap_prep() already done. */
2147  *--as->mcp = ARM_NOPATCH_GC_CHECK;
2148  emit_n(as, ARMI_CMP|ARMI_K12|0, RID_RET);
2149  args[0] = ASMREF_TMP1;  /* global_State *g */
2150  args[1] = ASMREF_TMP2;  /* MSize steps     */
2151  asm_gencall(as, ci, args);
2152  tmp1 = ra_releasetmp(as, ASMREF_TMP1);
2153  tmp2 = ra_releasetmp(as, ASMREF_TMP2);
2154  emit_loadi(as, tmp2, as->gcsteps);
2155  /* Jump around GC step if GC total < GC threshold. */
2156  emit_branch(as, ARMF_CC(ARMI_B, CC_LS), l_end);
2157  emit_nm(as, ARMI_CMP, RID_TMP, tmp2);
2158  emit_lso(as, ARMI_LDR, tmp2, tmp1,
2159	   (int32_t)offsetof(global_State, gc.threshold));
2160  emit_lso(as, ARMI_LDR, RID_TMP, tmp1,
2161	   (int32_t)offsetof(global_State, gc.total));
2162  ra_allockreg(as, i32ptr(J2G(as->J)), tmp1);
2163  as->gcsteps = 0;
2164  checkmclim(as);
2165}
2166
2167/* -- Loop handling ------------------------------------------------------- */
2168
2169/* Fixup the loop branch. */
2170static void asm_loop_fixup(ASMState *as)
2171{
2172  MCode *p = as->mctop;
2173  MCode *target = as->mcp;
2174  if (as->loopinv) {  /* Inverted loop branch? */
2175    /* asm_guardcc already inverted the bcc and patched the final bl. */
2176    p[-2] |= ((uint32_t)(target-p) & 0x00ffffffu);
2177  } else {
2178    p[-1] = ARMI_B | ((uint32_t)((target-p)-1) & 0x00ffffffu);
2179  }
2180}
2181
2182/* Fixup the tail of the loop. */
2183static void asm_loop_tail_fixup(ASMState *as)
2184{
2185  UNUSED(as);  /* Nothing to do. */
2186}
2187
2188/* -- Head of trace ------------------------------------------------------- */
2189
2190/* Reload L register from g->cur_L. */
2191static void asm_head_lreg(ASMState *as)
2192{
2193  IRIns *ir = IR(ASMREF_L);
2194  if (ra_used(ir)) {
2195    Reg r = ra_dest(as, ir, RSET_GPR);
2196    emit_getgl(as, r, cur_L);
2197    ra_evictk(as);
2198  }
2199}
2200
2201/* Coalesce BASE register for a root trace. */
2202static void asm_head_root_base(ASMState *as)
2203{
2204  IRIns *ir;
2205  asm_head_lreg(as);
2206  ir = IR(REF_BASE);
2207  if (ra_hasreg(ir->r) && (rset_test(as->modset, ir->r) || irt_ismarked(ir->t)))
2208    ra_spill(as, ir);
2209  ra_destreg(as, ir, RID_BASE);
2210}
2211
2212/* Coalesce BASE register for a side trace. */
2213static Reg asm_head_side_base(ASMState *as, IRIns *irp)
2214{
2215  IRIns *ir;
2216  asm_head_lreg(as);
2217  ir = IR(REF_BASE);
2218  if (ra_hasreg(ir->r) && (rset_test(as->modset, ir->r) || irt_ismarked(ir->t)))
2219    ra_spill(as, ir);
2220  if (ra_hasspill(irp->s)) {
2221    return ra_dest(as, ir, RSET_GPR);
2222  } else {
2223    Reg r = irp->r;
2224    lj_assertA(ra_hasreg(r), "base reg lost");
2225    if (r != ir->r && !rset_test(as->freeset, r))
2226      ra_restore(as, regcost_ref(as->cost[r]));
2227    ra_destreg(as, ir, r);
2228    return r;
2229  }
2230}
2231
2232/* -- Tail of trace ------------------------------------------------------- */
2233
2234/* Fixup the tail code. */
2235static void asm_tail_fixup(ASMState *as, TraceNo lnk)
2236{
2237  MCode *target = lnk ? traceref(as->J, lnk)->mcode : (MCode *)(void *)lj_vm_exit_interp;
2238  MCode *mcp = as->mctail;
2239  int32_t spadj = as->T->spadjust;
2240  if (spadj) {  /* Emit stack adjustment. */
2241    uint32_t k = emit_isk12(ARMI_ADD, spadj);
2242    lj_assertA(k, "stack adjustment %d does not fit in K12", spadj);
2243    *mcp++ = (ARMI_ADD^k) | ARMF_D(RID_SP) | ARMF_N(RID_SP);
2244  }
2245  if ((((target - mcp - 2) + 0x00800000u) >> 24) == 0) {
2246    *mcp = ARMI_B | ((target - mcp - 2) & 0x00ffffffu); mcp++;
2247  } else if ((as->flags & JIT_F_ARMV6T2)) {
2248    *mcp++ = emit_movw_k((uint32_t)target) | ARMF_D(RID_LR);
2249    *mcp++ = emit_movt_k((uint32_t)target) | ARMF_D(RID_LR);
2250    *mcp++ = ARMI_BX | ARMF_M(RID_LR);
2251  } else {
2252    *mcp++ = ARMI_LDRL | ARMI_LS_U | ARMF_D(RID_LR) | 0;
2253    *mcp++ = ARMI_BX | ARMF_M(RID_LR);
2254    *mcp++ = (MCode)target;
2255  }
2256  while (as->mctop > mcp) *--as->mctop = ARMI_NOP;
2257}
2258
2259/* Prepare tail of code. */
2260static void asm_tail_prep(ASMState *as, TraceNo lnk)
2261{
2262  MCode *p = as->mctop - 1;  /* Leave room for exit branch. */
2263  if (as->loopref) {
2264    as->invmcp = as->mcp = p;
2265  } else {
2266    if (!lnk) {
2267      MCode *target = (MCode *)(void *)lj_vm_exit_interp;
2268      if ((((target - p - 2) + 0x00800000u) >> 24) ||
2269	  (((target - p - 1) + 0x00800000u) >> 24)) p -= 2;
2270    }
2271    p--;  /* Leave room for stack pointer adjustment. */
2272    as->mcp = p;
2273    as->invmcp = NULL;
2274  }
2275  *p = 0;  /* Prevent load/store merging. */
2276  as->mctail = p;
2277}
2278
2279/* -- Trace setup --------------------------------------------------------- */
2280
2281/* Ensure there are enough stack slots for call arguments. */
2282static Reg asm_setup_call_slots(ASMState *as, IRIns *ir, const CCallInfo *ci)
2283{
2284  IRRef args[CCI_NARGS_MAX*2];
2285  uint32_t i, nargs = CCI_XNARGS(ci);
2286  int nslots = 0, ngpr = REGARG_NUMGPR, nfpr = REGARG_NUMFPR, fprodd = 0;
2287  asm_collectargs(as, ir, ci, args);
2288  for (i = 0; i < nargs; i++) {
2289    if (!LJ_SOFTFP && args[i] && irt_isfp(IR(args[i])->t)) {
2290      if (!LJ_ABI_SOFTFP && !(ci->flags & CCI_VARARG)) {
2291	if (irt_isnum(IR(args[i])->t)) {
2292	  if (nfpr > 0) nfpr--;
2293	  else fprodd = 0, nslots = (nslots + 3) & ~1;
2294	} else {
2295	  if (fprodd) fprodd--;
2296	  else if (nfpr > 0) fprodd = 1, nfpr--;
2297	  else nslots++;
2298	}
2299      } else if (irt_isnum(IR(args[i])->t)) {
2300	ngpr &= ~1;
2301	if (ngpr > 0) ngpr -= 2; else nslots += 2;
2302      } else {
2303	if (ngpr > 0) ngpr--; else nslots++;
2304      }
2305    } else {
2306      if (ngpr > 0) ngpr--; else nslots++;
2307    }
2308  }
2309  if (nslots > as->evenspill)  /* Leave room for args in stack slots. */
2310    as->evenspill = nslots;
2311  return REGSP_HINT(irt_isfp(ir->t) ? RID_FPRET : RID_RET);
2312}
2313
2314static void asm_setup_target(ASMState *as)
2315{
2316  /* May need extra exit for asm_stack_check on side traces. */
2317  asm_exitstub_setup(as, as->T->nsnap + (as->parent ? 1 : 0));
2318}
2319
2320/* -- Trace patching ------------------------------------------------------ */
2321
2322/* Patch exit jumps of existing machine code to a new target. */
2323void lj_asm_patchexit(jit_State *J, GCtrace *T, ExitNo exitno, MCode *target)
2324{
2325  MCode *p = T->mcode;
2326  MCode *pe = (MCode *)((char *)p + T->szmcode);
2327  MCode *cstart = NULL, *cend = p;
2328  MCode *mcarea = lj_mcode_patch(J, p, 0);
2329  MCode *px = exitstub_addr(J, exitno) - 2;
2330  for (; p < pe; p++) {
2331    /* Look for bl_cc exitstub, replace with b_cc target. */
2332    uint32_t ins = *p;
2333    if ((ins & 0x0f000000u) == 0x0b000000u && ins < 0xf0000000u &&
2334	((ins ^ (px-p)) & 0x00ffffffu) == 0 &&
2335	p[-1] != ARM_NOPATCH_GC_CHECK) {
2336      *p = (ins & 0xfe000000u) | (((target-p)-2) & 0x00ffffffu);
2337      cend = p+1;
2338      if (!cstart) cstart = p;
2339    }
2340  }
2341  lj_assertJ(cstart != NULL, "exit stub %d not found", exitno);
2342  lj_mcode_sync(cstart, cend);
2343  lj_mcode_patch(J, mcarea, 1);
2344}
2345