X-Git-Url: https://review.openocd.org/gitweb?p=openocd.git;a=blobdiff_plain;f=src%2Ftarget%2Farm_disassembler.c;h=b93df64d10b2f5fd8a8824c06f1909f2e4a0ef2d;hp=4d1342137ee2b3c8e97617e4438c04bb117b4cd0;hb=ec93209f51afc09e273a4742dc0b5f2cefc15e76;hpb=b71e3aff6d239857523625846b9682168eaa9472

diff --git a/src/target/arm_disassembler.c b/src/target/arm_disassembler.c
index 4d1342137e..b93df64d10 100644
--- a/src/target/arm_disassembler.c
+++ b/src/target/arm_disassembler.c
@@ -2,6 +2,8 @@
  *   Copyright (C) 2006 by Dominic Rath                                    *
  *   Dominic.Rath@gmx.de                                                   *
  *                                                                         *
+ *   Copyright (C) 2009 by David Brownell                                  *
+ *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
  *   it under the terms of the GNU General Public License as published by  *
  *   the Free Software Foundation; either version 2 of the License, or     *
@@ -26,23 +28,89 @@
 #include "log.h"
 
 
+/*
+ * This disassembler supports two main functions for OpenOCD:
+ *
+ *  - Various "disassemble" commands.  OpenOCD can serve as a
+ *    machine-language debugger, without help from GDB.
+ *
+ *  - Single stepping.  Not all ARM cores support hardware single
+ *    stepping.  To work without that support, the debugger must
+ *    be able to decode instructions to find out where to put a
+ *    "next instruction" breakpoint.
+ *
+ * In addition, interpretation of ETM trace data needs some of the
+ * decoding mechanisms.
+ *
+ * At this writing (September 2009) neither function is complete.
+ *
+ *  - ARM decoding
+ *     * Old-style syntax (not UAL) is generally used
+ *     * VFP instructions are not understood (ARMv5 and later)
+ *       except as coprocessor 10/11 operations
+ *     * Most ARM instructions through ARMv6 are decoded, but some
+ *       of the post-ARMv4 opcodes may not be handled yet
+ *     * NEON instructions are not understood (ARMv7-A)
+ *
+ *  - Thumb/Thumb2 decoding
+ *     * UAL syntax should be consistently used
+ *     * Any Thumb2 instructions used in Cortex-M3 (ARMv7-M) should
+ *       be handled properly.  Accordingly, so should the subset
+ *       used in Cortex-M0/M1; and "original" 16-bit Thumb from
+ *       ARMv4T and ARMv5T.
+ *     * Conditional effects of Thumb2 "IT" (if-then) instructions
+ *       are not handled:  the affected instructions are not shown
+ *       with their now-conditional suffixes.
+ *     * Some ARMv6 and ARMv7-M Thumb2 instructions may not be
+ *       handled (minimally for coprocessor access).
+ *     * SIMD instructions, and some other Thumb2 instructions
+ *       from ARMv7-A, are not understood.
+ *
+ *  - ThumbEE decoding
+ *     * As a Thumb2 variant, the Thumb2 comments (above) apply.
+ *     * Opcodes changed by ThumbEE mode are not handled; these
+ *       instructions wrongly decode as LDM and STM.
+ *
+ *  - Jazelle decoding ...  no support whatsoever for Jazelle mode
+ *    or decoding.  ARM encourages use of the more generic ThumbEE
+ *    mode, instead of Jazelle mode, in current chips.
+ *
+ *  - Single-step/emulation ... spotty support, which is only weakly
+ *    tested.  Thumb2 is not supported.  (Arguably a full simulator
+ *    is not needed to support just single stepping.  Recognizing
+ *    branch vs non-branch instructions suffices, except when the
+ *    instruction faults and triggers a synchronous exception which
+ *    can be intercepted using other means.)
+ *
+ * ARM DDI 0406B "ARM Architecture Reference Manual, ARM v7-A and
+ * ARM v7-R edition" gives the most complete coverage of the various
+ * generations of ARM instructions.  At this writing it is publicly
+ * accessible to anyone willing to create an account at the ARM
+ * web site; see http://www.arm.com/documentation/ for information.
+ *
+ * ARM DDI 0403C "ARMv7-M Architecture Reference Manual" provides
+ * more details relevant to the Thumb2-only processors (such as
+ * the Cortex-M implementations).
+ */
+
 /* textual represenation of the condition field */
 /* ALways (default) is ommitted (empty string) */
-char *arm_condition_strings[] =
+static const char *arm_condition_strings[] =
 {
 	"EQ", "NE", "CS", "CC", "MI", "PL", "VS", "VC", "HI", "LS", "GE", "LT", "GT", "LE", "", "NV"
 };
 
 /* make up for C's missing ROR */
-uint32_t ror(uint32_t value, int places)
+static uint32_t ror(uint32_t value, int places)
 {
 	return (value >> places) | (value << (32 - places));
 }
 
-int evaluate_pld(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_pld(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	/* PLD */
-	if ((opcode & 0x0d70f0000) == 0x0550f000)
+	if ((opcode & 0x0d70f000) == 0x0550f000)
 	{
 		instruction->type = ARM_PLD;
 
@@ -60,7 +128,8 @@ int evaluate_pld(uint32_t opcode, uint32_t address, arm_instruction_t *instructi
 	return -1;
 }
 
-int evaluate_swi(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_swi(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	instruction->type = ARM_SWI;
 
@@ -71,7 +140,8 @@ int evaluate_swi(uint32_t opcode, uint32_t address, arm_instruction_t *instructi
 	return ERROR_OK;
 }
 
-int evaluate_blx_imm(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_blx_imm(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	int offset;
 	uint32_t immediate;
@@ -103,7 +173,8 @@ int evaluate_blx_imm(uint32_t opcode, uint32_t address, arm_instruction_t *instr
 	return ERROR_OK;
 }
 
-int evaluate_b_bl(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_b_bl(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t L;
 	uint32_t immediate;
@@ -140,7 +211,8 @@ int evaluate_b_bl(uint32_t opcode, uint32_t address, arm_instruction_t *instruct
 
 /* Coprocessor load/store and double register transfers */
 /* both normal and extended instruction space (condition field b1111) */
-int evaluate_ldc_stc_mcrr_mrrc(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_ldc_stc_mcrr_mrrc(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t cp_num = (opcode & 0xf00) >> 8;
 
@@ -220,9 +292,10 @@ int evaluate_ldc_stc_mcrr_mrrc(uint32_t opcode, uint32_t address, arm_instructio
 /* Coprocessor data processing instructions */
 /* Coprocessor register transfer instructions */
 /* both normal and extended instruction space (condition field b1111) */
-int evaluate_cdp_mcr_mrc(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_cdp_mcr_mrc(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
-	char* cond;
+	const char *cond;
 	char* mnemonic;
 	uint8_t cp_num, opcode_1, CRd_Rd, CRn, CRm, opcode_2;
 
@@ -269,7 +342,8 @@ int evaluate_cdp_mcr_mrc(uint32_t opcode, uint32_t address, arm_instruction_t *i
 }
 
 /* Load/store instructions */
-int evaluate_load_store(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_load_store(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t I, P, U, B, W, L;
 	uint8_t Rn, Rd;
@@ -436,8 +510,326 @@ int evaluate_load_store(uint32_t opcode, uint32_t address, arm_instruction_t *in
 	return ERROR_OK;
 }
 
+static int evaluate_extend(uint32_t opcode, uint32_t address, char *cp)
+{
+	unsigned rm = (opcode >> 0) & 0xf;
+	unsigned rd = (opcode >> 12) & 0xf;
+	unsigned rn = (opcode >> 16) & 0xf;
+	char *type, *rot;
+
+	switch ((opcode >> 24) & 0x3) {
+	case 0:
+		type = "B16";
+		break;
+	case 1:
+		sprintf(cp, "UNDEFINED");
+		return ARM_UNDEFINED_INSTRUCTION;
+	case 2:
+		type = "B";
+		break;
+	default:
+		type = "H";
+		break;
+	}
+
+	switch ((opcode >> 10) & 0x3) {
+	case 0:
+		rot = "";
+		break;
+	case 1:
+		rot = ", ROR #8";
+		break;
+	case 2:
+		rot = ", ROR #16";
+		break;
+	default:
+		rot = ", ROR #24";
+		break;
+	}
+
+	if (rn == 0xf) {
+		sprintf(cp, "%cXT%s%s\tr%d, r%d%s",
+				(opcode & (1 << 22)) ? 'U' : 'S',
+				type, COND(opcode),
+				rd, rm, rot);
+		return ARM_MOV;
+	} else {
+		sprintf(cp, "%cXTA%s%s\tr%d, r%d, r%d%s",
+				(opcode & (1 << 22)) ? 'U' : 'S',
+				type, COND(opcode),
+				rd, rn, rm, rot);
+		return ARM_ADD;
+	}
+}
+
+static int evaluate_p_add_sub(uint32_t opcode, uint32_t address, char *cp)
+{
+	char *prefix;
+	char *op;
+	int type;
+
+	switch ((opcode >> 20) & 0x7) {
+	case 1:
+		prefix = "S";
+		break;
+	case 2:
+		prefix = "Q";
+		break;
+	case 3:
+		prefix = "SH";
+		break;
+	case 5:
+		prefix = "U";
+		break;
+	case 6:
+		prefix = "UQ";
+		break;
+	case 7:
+		prefix = "UH";
+		break;
+	default:
+		goto undef;
+	}
+
+	switch ((opcode >> 5) & 0x7) {
+	case 0:
+		op = "ADD16";
+		type = ARM_ADD;
+		break;
+	case 1:
+		op = "ADDSUBX";
+		type = ARM_ADD;
+		break;
+	case 2:
+		op = "SUBADDX";
+		type = ARM_SUB;
+		break;
+	case 3:
+		op = "SUB16";
+		type = ARM_SUB;
+		break;
+	case 4:
+		op = "ADD8";
+		type = ARM_ADD;
+		break;
+	case 7:
+		op = "SUB8";
+		type = ARM_SUB;
+		break;
+	default:
+		goto undef;
+	}
+
+	sprintf(cp, "%s%s%s\tr%d, r%d, r%d", prefix, op, COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf);
+	return type;
+
+undef:
+	/* these opcodes might be used someday */
+	sprintf(cp, "UNDEFINED");
+	return ARM_UNDEFINED_INSTRUCTION;
+}
+
+/* ARMv6 and later support "media" instructions (includes SIMD) */
+static int evaluate_media(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction)
+{
+	char *cp = instruction->text;
+	char *mnemonic = NULL;
+
+	sprintf(cp,
+		"0x%8.8" PRIx32 "\t0x%8.8" PRIx32 "\t",
+		address, opcode);
+	cp = strchr(cp, 0);
+
+	/* parallel add/subtract */
+	if ((opcode & 0x01800000) == 0x00000000) {
+		instruction->type = evaluate_p_add_sub(opcode, address, cp);
+		return ERROR_OK;
+	}
+
+	/* halfword pack */
+	if ((opcode & 0x01f00020) == 0x00800000) {
+		char *type, *shift;
+		unsigned imm = (unsigned) (opcode >> 7) & 0x1f;
+
+		if (opcode & (1 << 6)) {
+			type = "TB";
+			shift = "ASR";
+			if (imm == 0)
+				imm = 32;
+		} else {
+			type = "BT";
+			shift = "LSL";
+		}
+		sprintf(cp, "PKH%s%s\tr%d, r%d, r%d, %s #%d",
+			type, COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf,
+			shift, imm);
+		return ERROR_OK;
+	}
+
+	/* word saturate */
+	if ((opcode & 0x01a00020) == 0x00a00000) {
+		char *shift;
+		unsigned imm = (unsigned) (opcode >> 7) & 0x1f;
+
+		if (opcode & (1 << 6)) {
+			shift = "ASR";
+			if (imm == 0)
+				imm = 32;
+		} else {
+			shift = "LSL";
+		}
+
+		sprintf(cp, "%cSAT%s\tr%d, #%d, r%d, %s #%d",
+			(opcode & (1 << 22)) ? 'U' : 'S',
+			COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0x1f,
+			(int) (opcode >> 0) & 0xf,
+			shift, imm);
+		return ERROR_OK;
+	}
+
+	/* sign extension */
+	if ((opcode & 0x018000f0) == 0x00800070) {
+		instruction->type = evaluate_extend(opcode, address, cp);
+		return ERROR_OK;
+	}
+
+	/* multiplies */
+	if ((opcode & 0x01f00080) == 0x01000000) {
+		unsigned rn = (opcode >> 12) & 0xf;
+
+		if (rn != 0xf)
+			sprintf(cp, "SML%cD%s%s\tr%d, r%d, r%d, r%d",
+				(opcode & (1 << 6)) ? 'S' : 'A',
+				(opcode & (1 << 5)) ? "X" : "",
+				COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf,
+				rn);
+		else
+			sprintf(cp, "SMU%cD%s%s\tr%d, r%d, r%d",
+				(opcode & (1 << 6)) ? 'S' : 'A',
+				(opcode & (1 << 5)) ? "X" : "",
+				COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf);
+		return ERROR_OK;
+	}
+	if ((opcode & 0x01f00000) == 0x01400000) {
+		sprintf(cp, "SML%cLD%s%s\tr%d, r%d, r%d, r%d",
+			(opcode & (1 << 6)) ? 'S' : 'A',
+			(opcode & (1 << 5)) ? "X" : "",
+			COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf,
+			(int) (opcode >> 8) & 0xf);
+		return ERROR_OK;
+	}
+	if ((opcode & 0x01f00000) == 0x01500000) {
+		unsigned rn = (opcode >> 12) & 0xf;
+
+		switch (opcode & 0xc0) {
+		case 3:
+			if (rn == 0xf)
+				goto undef;
+			/* FALL THROUGH */
+		case 0:
+			break;
+		default:
+			goto undef;
+		}
+
+		if (rn != 0xf)
+			sprintf(cp, "SMML%c%s%s\tr%d, r%d, r%d, r%d",
+				(opcode & (1 << 6)) ? 'S' : 'A',
+				(opcode & (1 << 5)) ? "R" : "",
+				COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf,
+				rn);
+		else
+			sprintf(cp, "SMMUL%s%s\tr%d, r%d, r%d",
+				(opcode & (1 << 5)) ? "R" : "",
+				COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf);
+		return ERROR_OK;
+	}
+
+
+	/* simple matches against the remaining decode bits */
+	switch (opcode & 0x01f000f0) {
+	case 0x00a00030:
+	case 0x00e00030:
+		/* parallel halfword saturate */
+		sprintf(cp, "%cSAT16%s\tr%d, #%d, r%d",
+			(opcode & (1 << 22)) ? 'U' : 'S',
+			COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf);
+		return ERROR_OK;
+	case 0x00b00030:
+		mnemonic = "REV";
+		break;
+	case 0x00b000b0:
+		mnemonic = "REV16";
+		break;
+	case 0x00f000b0:
+		mnemonic = "REVSH";
+		break;
+	case 0x008000b0:
+		/* select bytes */
+		sprintf(cp, "SEL%s\tr%d, r%d, r%d", COND(opcode),
+			(int) (opcode >> 12) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf);
+		return ERROR_OK;
+	case 0x01800010:
+		/* unsigned sum of absolute differences */
+		if (((opcode >> 12) & 0xf) == 0xf)
+			sprintf(cp, "USAD8%s\tr%d, r%d, r%d", COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf);
+		else
+			sprintf(cp, "USADA8%s\tr%d, r%d, r%d, r%d", COND(opcode),
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 12) & 0xf);
+		return ERROR_OK;
+	}
+	if (mnemonic) {
+		unsigned rm = (opcode >> 0) & 0xf;
+		unsigned rd = (opcode >> 12) & 0xf;
+
+		sprintf(cp, "%s%s\tr%d, r%d", mnemonic, COND(opcode), rm, rd);
+		return ERROR_OK;
+	}
+
+undef:
+	/* these opcodes might be used someday */
+	sprintf(cp, "UNDEFINED");
+	return ERROR_OK;
+}
+
 /* Miscellaneous load/store instructions */
-int evaluate_misc_load_store(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_misc_load_store(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t P, U, I, W, L, S, H;
 	uint8_t Rn, Rd;
@@ -564,7 +956,8 @@ int evaluate_misc_load_store(uint32_t opcode, uint32_t address, arm_instruction_
 }
 
 /* Load/store multiples instructions */
-int evaluate_ldm_stm(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_ldm_stm(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t P, U, S, W, L, Rn;
 	uint32_t register_list;
@@ -652,7 +1045,8 @@ int evaluate_ldm_stm(uint32_t opcode, uint32_t address, arm_instruction_t *instr
 }
 
 /* Multiplies, extra load/stores */
-int evaluate_mul_and_extra_ld_st(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_mul_and_extra_ld_st(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	/* Multiply (accumulate) (long) and Swap/swap byte */
 	if ((opcode & 0x000000f0) == 0x00000090)
@@ -743,7 +1137,8 @@ int evaluate_mul_and_extra_ld_st(uint32_t opcode, uint32_t address, arm_instruct
 	return evaluate_misc_load_store(opcode, address, instruction);
 }
 
-int evaluate_mrs_msr(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_mrs_msr(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	int R = (opcode & 0x00400000) >> 22;
 	char *PSR = (R) ? "SPSR" : "CPSR";
@@ -797,7 +1192,8 @@ int evaluate_mrs_msr(uint32_t opcode, uint32_t address, arm_instruction_t *instr
 }
 
 /* Miscellaneous instructions */
-int evaluate_misc_instr(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_misc_instr(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	/* MRS/MSR */
 	if ((opcode & 0x000000f0) == 0x00000000)
@@ -819,6 +1215,21 @@ int evaluate_misc_instr(uint32_t opcode, uint32_t address, arm_instruction_t *in
 		instruction->info.b_bl_bx_blx.target_address = -1;
 	}
 
+	/* BXJ - "Jazelle" support (ARMv5-J) */
+	if ((opcode & 0x006000f0) == 0x00200020)
+	{
+		uint8_t Rm;
+		instruction->type = ARM_BX;
+		Rm = opcode & 0xf;
+
+		snprintf(instruction->text, 128,
+				"0x%8.8" PRIx32 "\t0x%8.8" PRIx32 "\tBXJ%s r%i",
+				 address, opcode, COND(opcode), Rm);
+
+		instruction->info.b_bl_bx_blx.reg_operand = Rm;
+		instruction->info.b_bl_bx_blx.target_address = -1;
+	}
+
 	/* CLZ */
 	if ((opcode & 0x006000f0) == 0x00600010)
 	{
@@ -972,7 +1383,8 @@ int evaluate_misc_instr(uint32_t opcode, uint32_t address, arm_instruction_t *in
 	return ERROR_OK;
 }
 
-int evaluate_data_proc(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_data_proc(uint32_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t I, op, S, Rn, Rd;
 	char *mnemonic = NULL;
@@ -1179,10 +1591,10 @@ int evaluate_data_proc(uint32_t opcode, uint32_t address, arm_instruction_t *ins
 	return ERROR_OK;
 }
 
-int arm_evaluate_opcode(uint32_t opcode, uint32_t address, arm_instruction_t *instruction)
+int arm_evaluate_opcode(uint32_t opcode, uint32_t address, struct arm_instruction *instruction)
 {
 	/* clear fields, to avoid confusion */
-	memset(instruction, 0, sizeof(arm_instruction_t));
+	memset(instruction, 0, sizeof(struct arm_instruction));
 	instruction->opcode = opcode;
 	instruction->instruction_size = 4;
 
@@ -1270,17 +1682,24 @@ int arm_evaluate_opcode(uint32_t opcode, uint32_t address, arm_instruction_t *in
 	/* catch opcodes with [27:25] = b011 */
 	if ((opcode & 0x0e000000) == 0x06000000)
 	{
-		/* Undefined instruction */
-		if ((opcode & 0x00000010) == 0x00000010)
+		/* Load/store register offset */
+		if ((opcode & 0x00000010) == 0x00000000)
+			return evaluate_load_store(opcode, address, instruction);
+
+		/* Architecturally Undefined instruction
+		 * ... don't expect these to ever be used
+		 */
+		if ((opcode & 0x07f000f0) == 0x07f000f0)
 		{
 			instruction->type = ARM_UNDEFINED_INSTRUCTION;
-			snprintf(instruction->text, 128, "0x%8.8" PRIx32 "\t0x%8.8" PRIx32 "\tUNDEFINED INSTRUCTION", address, opcode);
+			snprintf(instruction->text, 128,
+				"0x%8.8" PRIx32 "\t0x%8.8" PRIx32 "\tUNDEF",
+				address, opcode);
 			return ERROR_OK;
 		}
 
-		/* Load/store register offset */
-		return evaluate_load_store(opcode, address, instruction);
-
+		/* "media" instructions */
+		return evaluate_media(opcode, address, instruction);
 	}
 
 	/* catch opcodes with [27:25] = b100 */
@@ -1324,7 +1743,8 @@ int arm_evaluate_opcode(uint32_t opcode, uint32_t address, arm_instruction_t *in
 	return -1;
 }
 
-int evaluate_b_bl_blx_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_b_bl_blx_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t offset = opcode & 0x7ff;
 	uint32_t opc = (opcode >> 11) & 0x3;
@@ -1348,6 +1768,7 @@ int evaluate_b_bl_blx_thumb(uint16_t opcode, uint32_t address, arm_instruction_t
 		case 1:
 			instruction->type = ARM_BLX;
 			mnemonic = "BLX";
+			target_address &= 0xfffffffc;
 			break;
 		/* BL/BLX prefix */
 		case 2:
@@ -1363,8 +1784,12 @@ int evaluate_b_bl_blx_thumb(uint16_t opcode, uint32_t address, arm_instruction_t
 	}
 
 	/* TODO: deal correctly with dual opcode (prefixed) BL/BLX;
-	 * these are effectively 32-bit instructions even in Thumb1.
-	 * Might be simplest to always use the Thumb2 decoder.
+	 * these are effectively 32-bit instructions even in Thumb1.  For
+	 * disassembly, it's simplest to always use the Thumb2 decoder.
+	 *
+	 * But some cores will evidently handle them as two instructions,
+	 * where exceptions may occur between the two.  The ETMv3.2+ ID
+	 * register has a bit which exposes this behavior.
 	 */
 
 	snprintf(instruction->text, 128,
@@ -1377,7 +1802,8 @@ int evaluate_b_bl_blx_thumb(uint16_t opcode, uint32_t address, arm_instruction_t
 	return ERROR_OK;
 }
 
-int evaluate_add_sub_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_add_sub_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t Rd = (opcode >> 0) & 0x7;
 	uint8_t Rn = (opcode >> 3) & 0x7;
@@ -1393,6 +1819,7 @@ int evaluate_add_sub_thumb(uint16_t opcode, uint32_t address, arm_instruction_t
 	}
 	else
 	{
+		/* REVISIT:  if reg_imm == 0, display as "MOVS" */
 		instruction->type = ARM_ADD;
 		mnemonic = "ADDS";
 	}
@@ -1421,7 +1848,8 @@ int evaluate_add_sub_thumb(uint16_t opcode, uint32_t address, arm_instruction_t
 	return ERROR_OK;
 }
 
-int evaluate_shift_imm_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_shift_imm_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t Rd = (opcode >> 0) & 0x7;
 	uint8_t Rm = (opcode >> 3) & 0x7;
@@ -1466,7 +1894,8 @@ int evaluate_shift_imm_thumb(uint16_t opcode, uint32_t address, arm_instruction_
 	return ERROR_OK;
 }
 
-int evaluate_data_proc_imm_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_data_proc_imm_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t imm = opcode & 0xff;
 	uint8_t Rd = (opcode >> 8) & 0x7;
@@ -1508,10 +1937,12 @@ int evaluate_data_proc_imm_thumb(uint16_t opcode, uint32_t address, arm_instruct
 	return ERROR_OK;
 }
 
-int evaluate_data_proc_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_data_proc_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t high_reg, op, Rm, Rd,H1,H2;
 	char *mnemonic = NULL;
+	bool nop = false;
 
 	high_reg = (opcode & 0x0400) >> 10;
 	op = (opcode & 0x03C0) >> 6;
@@ -1546,6 +1977,8 @@ int evaluate_data_proc_thumb(uint16_t opcode, uint32_t address, arm_instruction_
 			case 0x2:
 				instruction->type = ARM_MOV;
 				mnemonic = "MOV";
+				if (Rd == Rm)
+					nop = true;
 				break;
 			case 0x3:
 				if ((opcode & 0x7) == 0x0)
@@ -1639,7 +2072,7 @@ int evaluate_data_proc_thumb(uint16_t opcode, uint32_t address, arm_instruction_
 				break;
 			case 0x9:
 				instruction->type = ARM_RSB;
-				mnemonic = "NEGS";
+				mnemonic = "RSBS";
 				instruction->info.data_proc.variant = 0 /*immediate*/;
 				instruction->info.data_proc.shifter_operand.immediate.immediate = 0;
 				instruction->info.data_proc.Rn = Rm;
@@ -1671,35 +2104,52 @@ int evaluate_data_proc_thumb(uint16_t opcode, uint32_t address, arm_instruction_
 		}
 	}
 
-	snprintf(instruction->text, 128,
-			"0x%8.8" PRIx32 "  0x%4.4x    \t%s\tr%i, r%i",
-			 address, opcode, mnemonic, Rd, Rm);
+	if (nop)
+		snprintf(instruction->text, 128,
+				"0x%8.8" PRIx32 "  0x%4.4x    \tNOP\t\t\t"
+				"; (%s r%i, r%i)",
+				 address, opcode, mnemonic, Rd, Rm);
+	else
+		snprintf(instruction->text, 128,
+				"0x%8.8" PRIx32 "  0x%4.4x    \t%s\tr%i, r%i",
+				 address, opcode, mnemonic, Rd, Rm);
 
 	return ERROR_OK;
 }
 
-int evaluate_load_literal_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+/* PC-relative data addressing is word-aligned even with Thumb */
+static inline uint32_t thumb_alignpc4(uint32_t addr)
+{
+	return (addr + 4) & ~3;
+}
+
+static int evaluate_load_literal_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t immediate;
 	uint8_t Rd = (opcode >> 8) & 0x7;
 
 	instruction->type = ARM_LDR;
 	immediate = opcode & 0x000000ff;
-
-	snprintf(instruction->text, 128,
-		"0x%8.8" PRIx32 "  0x%4.4x    \tLDR\tr%i, [pc, #%#" PRIx32 "]",
-		address, opcode, Rd, immediate*4);
+	immediate *= 4;
 
 	instruction->info.load_store.Rd = Rd;
 	instruction->info.load_store.Rn = 15 /*PC*/;
 	instruction->info.load_store.index_mode = 0; /*offset*/
 	instruction->info.load_store.offset_mode = 0; /*immediate*/
-	instruction->info.load_store.offset.offset = immediate*4;
+	instruction->info.load_store.offset.offset = immediate;
+
+	snprintf(instruction->text, 128,
+		"0x%8.8" PRIx32 "  0x%4.4x    \t"
+		"LDR\tr%i, [pc, #%#" PRIx32 "]\t; %#8.8" PRIx32,
+		address, opcode, Rd, immediate,
+		thumb_alignpc4(address) + immediate);
 
 	return ERROR_OK;
 }
 
-int evaluate_load_store_reg_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_load_store_reg_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint8_t Rd = (opcode >> 0) & 0x7;
 	uint8_t Rn = (opcode >> 3) & 0x7;
@@ -1756,7 +2206,8 @@ int evaluate_load_store_reg_thumb(uint16_t opcode, uint32_t address, arm_instruc
 	return ERROR_OK;
 }
 
-int evaluate_load_store_imm_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_load_store_imm_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t offset = (opcode >> 6) & 0x1f;
 	uint8_t Rd = (opcode >> 0) & 0x7;
@@ -1802,7 +2253,8 @@ int evaluate_load_store_imm_thumb(uint16_t opcode, uint32_t address, arm_instruc
 	return ERROR_OK;
 }
 
-int evaluate_load_store_stack_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_load_store_stack_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t offset = opcode  & 0xff;
 	uint8_t Rd = (opcode >> 8) & 0x7;
@@ -1833,7 +2285,8 @@ int evaluate_load_store_stack_thumb(uint16_t opcode, uint32_t address, arm_instr
 	return ERROR_OK;
 }
 
-int evaluate_add_sp_pc_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_add_sp_pc_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t imm = opcode  & 0xff;
 	uint8_t Rd = (opcode >> 8) & 0x7;
@@ -1866,7 +2319,8 @@ int evaluate_add_sp_pc_thumb(uint16_t opcode, uint32_t address, arm_instruction_
 	return ERROR_OK;
 }
 
-int evaluate_adjust_stack_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_adjust_stack_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t imm = opcode  & 0x7f;
 	uint8_t opc = opcode & (1 << 7);
@@ -1896,7 +2350,8 @@ int evaluate_adjust_stack_thumb(uint16_t opcode, uint32_t address, arm_instructi
 	return ERROR_OK;
 }
 
-int evaluate_breakpoint_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_breakpoint_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t imm = opcode  & 0xff;
 
@@ -1909,7 +2364,8 @@ int evaluate_breakpoint_thumb(uint16_t opcode, uint32_t address, arm_instruction
 	return ERROR_OK;
 }
 
-int evaluate_load_store_multiple_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_load_store_multiple_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t reg_list = opcode  & 0xff;
 	uint32_t L = opcode & (1 << 11);
@@ -1922,19 +2378,27 @@ int evaluate_load_store_multiple_thumb(uint16_t opcode, uint32_t address, arm_in
 	char ptr_name[7] = "";
 	int i;
 
+	/* REVISIT:  in ThumbEE mode, there are no LDM or STM instructions.
+	 * The STMIA and LDMIA opcodes are used for other instructions.
+	 */
+
 	if ((opcode & 0xf000) == 0xc000)
 	{ /* generic load/store multiple */
+		char *wback = "!";
+
 		if (L)
 		{
 			instruction->type = ARM_LDM;
 			mnemonic = "LDM";
+			if (opcode & (1 << Rn))
+				wback = "";
 		}
 		else
 		{
 			instruction->type = ARM_STM;
 			mnemonic = "STM";
 		}
-		snprintf(ptr_name,7,"r%i!, ",Rn);
+		snprintf(ptr_name, sizeof ptr_name, "r%i%s, ", Rn, wback);
 	}
 	else
 	{ /* push/pop */
@@ -1978,7 +2442,8 @@ int evaluate_load_store_multiple_thumb(uint16_t opcode, uint32_t address, arm_in
 	return ERROR_OK;
 }
 
-int evaluate_cond_branch_thumb(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+static int evaluate_cond_branch_thumb(uint16_t opcode,
+		uint32_t address, struct arm_instruction *instruction)
 {
 	uint32_t offset = opcode  & 0xff;
 	uint8_t cond = (opcode >> 8) & 0xf;
@@ -2020,7 +2485,7 @@ int evaluate_cond_branch_thumb(uint16_t opcode, uint32_t address, arm_instructio
 }
 
 static int evaluate_cb_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	unsigned offset;
 
@@ -2038,7 +2503,7 @@ static int evaluate_cb_thumb(uint16_t opcode, uint32_t address,
 }
 
 static int evaluate_extend_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	/* added in ARMv6 */
 	snprintf(instruction->text, 128,
@@ -2052,7 +2517,7 @@ static int evaluate_extend_thumb(uint16_t opcode, uint32_t address,
 }
 
 static int evaluate_cps_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	/* added in ARMv6 */
 	if ((opcode & 0x0ff0) == 0x0650)
@@ -2062,7 +2527,7 @@ static int evaluate_cps_thumb(uint16_t opcode, uint32_t address,
 				(opcode & 0x80) ? "BE" : "LE");
 	else /* ASSUME (opcode & 0x0fe0) == 0x0660 */
 		snprintf(instruction->text, 128,
-				"0x%8.8" PRIx32 "  0x%4.4x    \tCPSI%c %s%s%s",
+				"0x%8.8" PRIx32 "  0x%4.4x    \tCPSI%c\t%s%s%s",
 				address, opcode,
 				(opcode & 0x0010) ? 'D' : 'E',
 				(opcode & 0x0004) ? "A" : "",
@@ -2073,12 +2538,12 @@ static int evaluate_cps_thumb(uint16_t opcode, uint32_t address,
 }
 
 static int evaluate_byterev_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	char *suffix;
 
 	/* added in ARMv6 */
-	switch (opcode & 0x00c0) {
+	switch ((opcode >> 6) & 3) {
 	case 0:
 		suffix = "";
 		break;
@@ -2098,7 +2563,7 @@ static int evaluate_byterev_thumb(uint16_t opcode, uint32_t address,
 }
 
 static int evaluate_hint_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	char *hint;
 
@@ -2131,7 +2596,7 @@ static int evaluate_hint_thumb(uint16_t opcode, uint32_t address,
 }
 
 static int evaluate_ifthen_thumb(uint16_t opcode, uint32_t address,
-		arm_instruction_t *instruction)
+		struct arm_instruction *instruction)
 {
 	unsigned cond = (opcode >> 4) & 0x0f;
 	char *x = "", *y = "", *z = "";
@@ -2155,10 +2620,10 @@ static int evaluate_ifthen_thumb(uint16_t opcode, uint32_t address,
 	return ERROR_OK;
 }
 
-int thumb_evaluate_opcode(uint16_t opcode, uint32_t address, arm_instruction_t *instruction)
+int thumb_evaluate_opcode(uint16_t opcode, uint32_t address, struct arm_instruction *instruction)
 {
 	/* clear fields, to avoid confusion */
-	memset(instruction, 0, sizeof(arm_instruction_t));
+	memset(instruction, 0, sizeof(struct arm_instruction));
 	instruction->opcode = opcode;
 	instruction->instruction_size = 2;
 
@@ -2292,57 +2757,1562 @@ int thumb_evaluate_opcode(uint16_t opcode, uint32_t address, arm_instruction_t *
 	return -1;
 }
 
-/*
- * REVISIT for Thumb2 instructions, instruction->type and friends aren't
- * always set.  That means eventual arm_simulate_step() support for Thumb2
- * will need work in this area.
- */
-int thumb2_opcode(target_t *target, uint32_t address, arm_instruction_t *instruction)
+static int t2ev_b_bl(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
 {
-	int retval;
-	uint16_t op;
-	uint32_t opcode;
+	unsigned offset;
+	unsigned b21 = 1 << 21;
+	unsigned b22 = 1 << 22;
 
-	/* clear low bit ... it's set on function pointers */
-	address &= ~1;
+	/* instead of combining two smaller 16-bit branch instructions,
+	 * Thumb2 uses only one larger 32-bit instruction.
+	 */
+	offset = opcode & 0x7ff;
+	offset |= (opcode & 0x03ff0000) >> 5;
+	if (opcode & (1 << 26)) {
+		offset |= 0xff << 23;
+		if ((opcode & (1 << 11)) == 0)
+			b21 = 0;
+		if ((opcode & (1 << 13)) == 0)
+			b22 = 0;
+	} else {
+		if (opcode & (1 << 11))
+			b21 = 0;
+		if (opcode & (1 << 13))
+			b22 = 0;
+	}
+	offset |= b21;
+	offset |= b22;
 
-	/* clear fields, to avoid confusion */
-	memset(instruction, 0, sizeof(arm_instruction_t));
 
-	/* read first halfword, see if this is the only one */
-	retval = target_read_u16(target, address, &op);
-	if (retval != ERROR_OK)
-		return retval;
+	address += 4;
+	address += offset << 1;
 
-	switch (op & 0xf800) {
-	case 0xf800:
-	case 0xf000:
-	case 0xe800:
-		/* 32-bit instructions */
-		instruction->instruction_size = 4;
-		opcode = op << 16;
-		retval = target_read_u16(target, address + 2, &op);
-		if (retval != ERROR_OK)
-			return retval;
-		opcode |= op;
-		instruction->opcode = opcode;
+	instruction->type = (opcode & (1 << 14)) ? ARM_BL : ARM_B;
+	instruction->info.b_bl_bx_blx.reg_operand = -1;
+	instruction->info.b_bl_bx_blx.target_address = address;
+	sprintf(cp, "%s\t%#8.8" PRIx32,
+			(opcode & (1 << 14)) ? "BL" : "B.W",
+			address);
+
+	return ERROR_OK;
+}
+
+static int t2ev_cond_b(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	unsigned offset;
+	unsigned b17 = 1 << 17;
+	unsigned b18 = 1 << 18;
+	unsigned cond = (opcode >> 22) & 0x0f;
+
+	offset = opcode & 0x7ff;
+	offset |= (opcode & 0x003f0000) >> 5;
+	if (opcode & (1 << 26)) {
+		offset |= 0xffff << 19;
+		if ((opcode & (1 << 11)) == 0)
+			b17 = 0;
+		if ((opcode & (1 << 13)) == 0)
+			b18 = 0;
+	} else {
+		if (opcode & (1 << 11))
+			b17 = 0;
+		if (opcode & (1 << 13))
+			b18 = 0;
+	}
+	offset |= b17;
+	offset |= b18;
+
+	address += 4;
+	address += offset << 1;
+
+	instruction->type = ARM_B;
+	instruction->info.b_bl_bx_blx.reg_operand = -1;
+	instruction->info.b_bl_bx_blx.target_address = address;
+	sprintf(cp, "B%s.W\t%#8.8" PRIx32,
+			arm_condition_strings[cond],
+			address);
+
+	return ERROR_OK;
+}
+
+static const char *special_name(int number)
+{
+	char *special = "(RESERVED)";
+
+	switch (number) {
+	case 0:
+		special = "apsr";
+		break;
+	case 1:
+		special = "iapsr";
+		break;
+	case 2:
+		special = "eapsr";
+		break;
+	case 3:
+		special = "xpsr";
+		break;
+	case 5:
+		special = "ipsr";
+		break;
+	case 6:
+		special = "epsr";
+		break;
+	case 7:
+		special = "iepsr";
+		break;
+	case 8:
+		special = "msp";
+		break;
+	case 9:
+		special = "psp";
+		break;
+	case 16:
+		special = "primask";
+		break;
+	case 17:
+		special = "basepri";
+		break;
+	case 18:
+		special = "basepri_max";
+		break;
+	case 19:
+		special = "faultmask";
+		break;
+	case 20:
+		special = "control";
+		break;
+	}
+	return special;
+}
+
+static int t2ev_hint(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	const char *mnemonic;
+
+	if (opcode & 0x0700) {
+		instruction->type = ARM_UNDEFINED_INSTRUCTION;
+		strcpy(cp, "UNDEFINED");
+		return ERROR_OK;
+	}
+
+	if (opcode & 0x00f0) {
+		sprintf(cp, "DBG\t#%d", (int) opcode & 0xf);
+		return ERROR_OK;
+	}
+
+	switch (opcode & 0x0f) {
+	case 0:
+		mnemonic = "NOP.W";
+		break;
+	case 1:
+		mnemonic = "YIELD.W";
+		break;
+	case 2:
+		mnemonic = "WFE.W";
+		break;
+	case 3:
+		mnemonic = "WFI.W";
+		break;
+	case 4:
+		mnemonic = "SEV.W";
 		break;
 	default:
-		/* 16-bit:  Thumb1 + IT + CBZ/CBNZ + ... */
-		return thumb_evaluate_opcode(op, address, instruction);
+		mnemonic = "HINT.W (UNRECOGNIZED)";
+		break;
 	}
+	strcpy(cp, mnemonic);
+	return ERROR_OK;
+}
 
-	/* FIXME decode the 32-bit instructions */
+static int t2ev_misc(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	const char *mnemonic;
 
-	LOG_DEBUG("Can't decode 32-bit Thumb2 yet (opcode=%08x)", opcode);
+	switch ((opcode >> 4) & 0x0f) {
+	case 0:
+		mnemonic = "LEAVEX";
+		break;
+	case 1:
+		mnemonic = "ENTERX";
+		break;
+	case 2:
+		mnemonic = "CLREX";
+		break;
+	case 4:
+		mnemonic = "DSB";
+		break;
+	case 5:
+		mnemonic = "DMB";
+		break;
+	case 6:
+		mnemonic = "ISB";
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+	strcpy(cp, mnemonic);
+	return ERROR_OK;
+}
 
-	snprintf(instruction->text, 128,
-			"0x%8.8" PRIx32 "  0x%8.8x\t... 32-bit Thumb2 ...",
-			address, opcode);
+static int t2ev_b_misc(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	/* permanently undefined */
+	if ((opcode & 0x07f07000) == 0x07f02000) {
+		instruction->type = ARM_UNDEFINED_INSTRUCTION;
+		strcpy(cp, "UNDEFINED");
+		return ERROR_OK;
+	}
+
+	switch ((opcode >> 12) & 0x5) {
+	case 0x1:
+	case 0x5:
+		return t2ev_b_bl(opcode, address, instruction, cp);
+	case 0x4:
+		goto undef;
+	case 0:
+		if (((opcode >> 23) & 0x07) != 0x07)
+			return t2ev_cond_b(opcode, address, instruction, cp);
+		if (opcode & (1 << 26))
+			goto undef;
+		break;
+	}
+
+	switch ((opcode >> 20) & 0x7f) {
+	case 0x38:
+	case 0x39:
+		sprintf(cp, "MSR\t%s, r%d", special_name(opcode & 0xff),
+				(int) (opcode >> 16) & 0x0f);
+		return ERROR_OK;
+	case 0x3a:
+		return t2ev_hint(opcode, address, instruction, cp);
+	case 0x3b:
+		return t2ev_misc(opcode, address, instruction, cp);
+	case 0x3c:
+		sprintf(cp, "BXJ\tr%d", (int) (opcode >> 16) & 0x0f);
+		return ERROR_OK;
+	case 0x3e:
+	case 0x3f:
+		sprintf(cp, "MRS\tr%d, %s", (int) (opcode >> 8) & 0x0f,
+				special_name(opcode & 0xff));
+		return ERROR_OK;
+	}
+
+undef:
+	return ERROR_INVALID_ARGUMENTS;
+}
+
+static int t2ev_data_mod_immed(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	char *mnemonic = NULL;
+	int rn = (opcode >> 16) & 0xf;
+	int rd = (opcode >> 8) & 0xf;
+	unsigned immed = opcode & 0xff;
+	unsigned func;
+	bool one = false;
+	char *suffix = "";
+	char *suffix2 = "";
+
+	/* ARMv7-M: A5.3.2 Modified immediate constants */
+	func = (opcode >> 11) & 0x0e;
+	if (immed & 0x80)
+		func |= 1;
+	if (opcode & (1 << 26))
+		func |= 0x10;
+
+	/* "Modified" immediates */
+	switch (func >> 1) {
+	case 0:
+		break;
+	case 2:
+		immed <<= 8;
+		/* FALLTHROUGH */
+	case 1:
+		immed += immed << 16;
+		break;
+	case 3:
+		immed += immed << 8;
+		immed += immed << 16;
+		break;
+	default:
+		immed |= 0x80;
+		immed = ror(immed, func);
+	}
+
+	if (opcode & (1 << 20))
+		suffix = "S";
+
+	switch ((opcode >> 21) & 0xf) {
+	case 0:
+		if (rd == 0xf) {
+			instruction->type = ARM_TST;
+			mnemonic = "TST";
+			one = true;
+			suffix = "";
+			rd = rn;
+		} else {
+			instruction->type = ARM_AND;
+			mnemonic = "AND";
+		}
+		break;
+	case 1:
+		instruction->type = ARM_BIC;
+		mnemonic = "BIC";
+		break;
+	case 2:
+		if (rn == 0xf) {
+			instruction->type = ARM_MOV;
+			mnemonic = "MOV";
+			one = true;
+			suffix2 = ".W";
+		} else {
+			instruction->type = ARM_ORR;
+			mnemonic = "ORR";
+		}
+		break;
+	case 3:
+		if (rn == 0xf) {
+			instruction->type = ARM_MVN;
+			mnemonic = "MVN";
+			one = true;
+		} else {
+			// instruction->type = ARM_ORN;
+			mnemonic = "ORN";
+		}
+		break;
+	case 4:
+		if (rd == 0xf) {
+			instruction->type = ARM_TEQ;
+			mnemonic = "TEQ";
+			one = true;
+			suffix = "";
+			rd = rn;
+		} else {
+			instruction->type = ARM_EOR;
+			mnemonic = "EOR";
+		}
+		break;
+	case 8:
+		if (rd == 0xf) {
+			instruction->type = ARM_CMN;
+			mnemonic = "CMN";
+			one = true;
+			suffix = "";
+			rd = rn;
+		} else {
+			instruction->type = ARM_ADD;
+			mnemonic = "ADD";
+			suffix2 = ".W";
+		}
+		break;
+	case 10:
+		instruction->type = ARM_ADC;
+		mnemonic = "ADC";
+		suffix2 = ".W";
+		break;
+	case 11:
+		instruction->type = ARM_SBC;
+		mnemonic = "SBC";
+		break;
+	case 13:
+		if (rd == 0xf) {
+			instruction->type = ARM_CMP;
+			mnemonic = "CMP";
+			one = true;
+			suffix = "";
+			rd = rn;
+		} else {
+			instruction->type = ARM_SUB;
+			mnemonic = "SUB";
+		}
+		suffix2 = ".W";
+		break;
+	case 14:
+		instruction->type = ARM_RSB;
+		mnemonic = "RSB";
+		suffix2 = ".W";
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	if (one)
+		sprintf(cp, "%s%s\tr%d, #%d\t; %#8.8x",
+				mnemonic, suffix2 ,rd, immed, immed);
+	else
+		sprintf(cp, "%s%s%s\tr%d, r%d, #%d\t; %#8.8x",
+				mnemonic, suffix, suffix2,
+				rd, rn, immed, immed);
+
+	return ERROR_OK;
+}
+
+static int t2ev_data_immed(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	char *mnemonic = NULL;
+	int rn = (opcode >> 16) & 0xf;
+	int rd = (opcode >> 8) & 0xf;
+	unsigned immed;
+	bool add = false;
+	bool is_signed = false;
+
+	immed = (opcode & 0x0ff) | ((opcode & 0x7000) >> 4);
+	if (opcode & (1 << 26))
+		immed |= (1 << 11);
+
+	switch ((opcode >> 20) & 0x1f) {
+	case 0:
+		if (rn == 0xf) {
+			add = true;
+			goto do_adr;
+		}
+		mnemonic = "ADDW";
+		break;
+	case 4:
+		immed |= (opcode >> 4) & 0xf000;
+		sprintf(cp, "MOVW\tr%d, #%d\t; %#3.3x", rd, immed, immed);
+		return ERROR_OK;
+	case 0x0a:
+		if (rn == 0xf)
+			goto do_adr;
+		mnemonic = "SUBW";
+		break;
+	case 0x0c:
+		/* move constant to top 16 bits of register */
+		immed |= (opcode >> 4) & 0xf000;
+		sprintf(cp, "MOVT\tr%d, #%d\t; %#4.4x", rn, immed, immed);
+		return ERROR_OK;
+	case 0x10:
+	case 0x12:
+		is_signed = true;
+	case 0x18:
+	case 0x1a:
+		/* signed/unsigned saturated add */
+		immed = (opcode >> 6) & 0x03;
+		immed |= (opcode >> 10) & 0x1c;
+		sprintf(cp, "%sSAT\tr%d, #%d, r%d, %s #%d\t",
+				is_signed ? "S" : "U",
+				rd, (int) (opcode & 0x1f) + is_signed, rn,
+				(opcode & (1 << 21)) ? "ASR" : "LSL",
+				immed ? immed : 32);
+		return ERROR_OK;
+	case 0x14:
+		is_signed = true;
+		/* FALLTHROUGH */
+	case 0x1c:
+		/* signed/unsigned bitfield extract */
+		immed = (opcode >> 6) & 0x03;
+		immed |= (opcode >> 10) & 0x1c;
+		sprintf(cp, "%sBFX\tr%d, r%d, #%d, #%d\t",
+				is_signed ? "S" : "U",
+				rd, rn, immed,
+				(int) (opcode & 0x1f) + 1);
+		return ERROR_OK;
+	case 0x16:
+		immed = (opcode >> 6) & 0x03;
+		immed |= (opcode >> 10) & 0x1c;
+		if (rn == 0xf)		/* bitfield clear */
+			sprintf(cp, "BFC\tr%d, #%d, #%d\t",
+					rd, immed,
+					(int) (opcode & 0x1f) + 1 - immed);
+		else			/* bitfield insert */
+			sprintf(cp, "BFI\tr%d, r%d, #%d, #%d\t",
+					rd, rn, immed,
+					(int) (opcode & 0x1f) + 1 - immed);
+		return ERROR_OK;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	sprintf(cp, "%s\tr%d, r%d, #%d\t; %#3.3x", mnemonic,
+			rd, rn, immed, immed);
+	return ERROR_OK;
+
+do_adr:
+	address = thumb_alignpc4(address);
+	if (add)
+		address += immed;
+	else
+		address -= immed;
+	/* REVISIT "ADD/SUB Rd, PC, #const ; 0x..." might be better;
+	 * not hiding the pc-relative stuff will sometimes be useful.
+	 */
+	sprintf(cp, "ADR.W\tr%d, %#8.8" PRIx32, rd, address);
+	return ERROR_OK;
+}
+
+static int t2ev_store_single(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	unsigned op = (opcode >> 20) & 0xf;
+	char *size = "";
+	char *suffix = "";
+	char *p1 = "";
+	char *p2 = "]";
+	unsigned immed;
+	unsigned rn = (opcode >> 16) & 0x0f;
+	unsigned rt = (opcode >> 12) & 0x0f;
+
+	if (rn == 0xf)
+		return ERROR_INVALID_ARGUMENTS;
+
+	if (opcode & 0x0800)
+		op |= 1;
+	switch (op) {
+	/* byte */
+	case 0x8:
+	case 0x9:
+		size = "B";
+		goto imm12;
+	case 0x1:
+		size = "B";
+		goto imm8;
+	case 0x0:
+		size = "B";
+		break;
+	/* halfword */
+	case 0xa:
+	case 0xb:
+		size = "H";
+		goto imm12;
+	case 0x3:
+		size = "H";
+		goto imm8;
+	case 0x2:
+		size = "H";
+		break;
+	/* word */
+	case 0xc:
+	case 0xd:
+		goto imm12;
+	case 0x5:
+		goto imm8;
+	case 0x4:
+		break;
+	/* error */
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	sprintf(cp, "STR%s.W\tr%d, [r%d, r%d, LSL #%d]",
+			size, rt, rn, (int) opcode & 0x0f,
+			(int) (opcode >> 4) & 0x03);
+	return ERROR_OK;
+
+imm12:
+	immed = opcode & 0x0fff;
+	sprintf(cp, "STR%s.W\tr%d, [r%d, #%u]\t; %#3.3x",
+			size, rt, rn, immed, immed);
+	return ERROR_OK;
+
+imm8:
+	immed = opcode & 0x00ff;
+
+	switch (opcode & 0x700) {
+	case 0x600:
+		suffix = "T";
+		break;
+	case 0x000:
+	case 0x200:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	/* two indexed modes will write back rn */
+	if (opcode & 0x100) {
+		if (opcode & 0x400)	/* pre-indexed */
+			p2 = "]!";
+		else {			/* post-indexed */
+			p1 = "]";
+			p2 = "";
+		}
+	}
+
+	sprintf(cp, "STR%s%s\tr%d, [r%d%s, #%s%u%s\t; %#2.2x",
+			size, suffix, rt, rn, p1,
+			(opcode & 0x200) ? "" : "-",
+			immed, p2, immed);
+	return ERROR_OK;
+}
+
+static int t2ev_mul32(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int ra = (opcode >> 12) & 0xf;
+
+	switch (opcode & 0x007000f0) {
+	case 0:
+		if (ra == 0xf)
+			sprintf(cp, "MUL\tr%d, r%d, r%d",
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf);
+		else
+			sprintf(cp, "MLA\tr%d, r%d, r%d, r%d",
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf, ra);
+		break;
+	case 0x10:
+		sprintf(cp, "MLS\tr%d, r%d, r%d, r%d",
+			(int) (opcode >> 8) & 0xf,
+			(int) (opcode >> 16) & 0xf,
+			(int) (opcode >> 0) & 0xf, ra);
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+	return ERROR_OK;
+}
+
+static int t2ev_mul64_div(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int op = (opcode >> 4) & 0xf;
+	char *infix = "MUL";
+
+	op += (opcode >> 16) & 0x70;
+	switch (op) {
+	case 0x40:
+	case 0x60:
+		infix = "MLA";
+		/* FALLTHROUGH */
+	case 0:
+	case 0x20:
+		sprintf(cp, "%c%sL\tr%d, r%d, r%d, r%d",
+				(op & 0x20) ? 'U' : 'S',
+				infix,
+				(int) (opcode >> 12) & 0xf,
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf);
+		break;
+	case 0x1f:
+	case 0x3f:
+		sprintf(cp, "%cDIV\tr%d, r%d, r%d",
+				(op & 0x20) ? 'U' : 'S',
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf);
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	return ERROR_OK;
+}
+
+static int t2ev_ldm_stm(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int rn = (opcode >> 16) & 0xf;
+	int op = (opcode >> 22) & 0x6;
+	int t = (opcode >> 21) & 1;
+	unsigned registers = opcode & 0xffff;
+
+	if (opcode & (1 << 20))
+		op |= 1;
+
+	switch (op) {
+	case 2:
+		sprintf(cp, "STM.W\tr%d%s, ", rn, t ? "!" : "");
+		break;
+	case 3:
+		if (rn == 13 && t)
+			sprintf(cp, "POP.W\t");
+		else
+			sprintf(cp, "LDM.W\tr%d%s, ", rn, t ? "!" : "");
+		break;
+	case 4:
+		if (rn == 13 && t)
+			sprintf(cp, "PUSH.W\t");
+		else
+			sprintf(cp, "STMDB\tr%d%s, ", rn, t ? "!" : "");
+		break;
+	case 5:
+		sprintf(cp, "LDMDB.W\tr%d%s, ", rn, t ? "!" : "");
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	cp = strchr(cp, 0);
+	*cp++ = '{';
+	for (t = 0; registers; t++, registers >>= 1) {
+		if ((registers & 1) == 0)
+			continue;
+		registers &= ~1;
+		sprintf(cp, "r%d%s", t, registers ? ", " : "");
+		cp = strchr(cp, 0);
+	}
+	*cp++ = '}';
+	*cp++ = 0;
+
+	return ERROR_OK;
+}
+
+/* load/store dual or exclusive, table branch */
+static int t2ev_ldrex_strex(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	unsigned op1op2 = (opcode >> 20) & 0x3;
+	unsigned op3 = (opcode >> 4) & 0xf;
+	char *mnemonic;
+	unsigned rn = (opcode >> 16) & 0xf;
+	unsigned rt = (opcode >> 12) & 0xf;
+	unsigned rd = (opcode >> 8) & 0xf;
+	unsigned imm = opcode & 0xff;
+	char *p1 = "";
+	char *p2 = "]";
+
+	op1op2 |= (opcode >> 21) & 0xc;
+	switch (op1op2) {
+	case 0:
+		mnemonic = "STREX";
+		goto strex;
+	case 1:
+		mnemonic = "LDREX";
+		goto ldrex;
+	case 2:
+	case 6:
+	case 8:
+	case 10:
+	case 12:
+	case 14:
+		mnemonic = "STRD";
+		goto immediate;
+	case 3:
+	case 7:
+	case 9:
+	case 11:
+	case 13:
+	case 15:
+		mnemonic = "LDRD";
+		if (rn == 15)
+			goto literal;
+		else
+			goto immediate;
+	case 4:
+		switch (op3) {
+		case 4:
+			mnemonic = "STREXB";
+			break;
+		case 5:
+			mnemonic = "STREXH";
+			break;
+		default:
+			return ERROR_INVALID_ARGUMENTS;
+		}
+		rd = opcode & 0xf;
+		imm = 0;
+		goto strex;
+	case 5:
+		switch (op3) {
+		case 0:
+			sprintf(cp, "TBB\t[r%u, r%u]", rn, imm & 0xf);
+			return ERROR_OK;
+		case 1:
+			sprintf(cp, "TBH\t[r%u, r%u, LSL #1]", rn, imm & 0xf);
+			return ERROR_OK;
+		case 4:
+			mnemonic = "LDREXB";
+			break;
+		case 5:
+			mnemonic = "LDREXH";
+			break;
+		default:
+			return ERROR_INVALID_ARGUMENTS;
+		}
+		imm = 0;
+		goto ldrex;
+	}
+	return ERROR_INVALID_ARGUMENTS;
+
+strex:
+	imm <<= 2;
+	if (imm)
+		sprintf(cp, "%s\tr%u, r%u, [r%u, #%u]\t; %#2.2x",
+				mnemonic, rd, rt, rn, imm, imm);
+	else
+		sprintf(cp, "%s\tr%u, r%u, [r%u]",
+				mnemonic, rd, rt, rn);
+	return ERROR_OK;
+
+ldrex:
+	imm <<= 2;
+	if (imm)
+		sprintf(cp, "%s\tr%u, [r%u, #%u]\t; %#2.2x",
+				mnemonic, rt, rn, imm, imm);
+	else
+		sprintf(cp, "%s\tr%u, [r%u]",
+				mnemonic, rt, rn);
+	return ERROR_OK;
+
+immediate:
+	/* two indexed modes will write back rn */
+	if (opcode & (1 << 21)) {
+		if (opcode & (1 << 24))	/* pre-indexed */
+			p2 = "]!";
+		else {			/* post-indexed */
+			p1 = "]";
+			p2 = "";
+		}
+	}
+
+	imm <<= 2;
+	sprintf(cp, "%s\tr%u, r%u, [r%u%s, #%s%u%s\t; %#2.2x",
+			mnemonic, rt, rd, rn, p1,
+			(opcode & (1 << 23)) ? "" : "-",
+			imm, p2, imm);
+	return ERROR_OK;
+
+literal:
+	address = thumb_alignpc4(address);
+	imm <<= 2;
+	if (opcode & (1 << 23))
+		address += imm;
+	else
+		address -= imm;
+	sprintf(cp, "%s\tr%u, r%u, %#8.8" PRIx32,
+			mnemonic, rt, rd, address);
+	return ERROR_OK;
+}
+
+static int t2ev_data_shift(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int op = (opcode >> 21) & 0xf;
+	int rd = (opcode >> 8) & 0xf;
+	int rn = (opcode >> 16) & 0xf;
+	int type = (opcode >> 4) & 0x3;
+	int immed = (opcode >> 6) & 0x3;
+	char *mnemonic;
+	char *suffix = "";
+
+	immed |= (opcode >> 10) & 0x1c;
+	if (opcode & (1 << 20))
+		suffix = "S";
+
+	switch (op) {
+	case 0:
+		if (rd == 0xf) {
+			if (!(opcode & (1 << 20)))
+				return ERROR_INVALID_ARGUMENTS;
+			instruction->type = ARM_TST;
+			mnemonic = "TST";
+			suffix = "";
+			goto two;
+		}
+		instruction->type = ARM_AND;
+		mnemonic = "AND";
+		break;
+	case 1:
+		instruction->type = ARM_BIC;
+		mnemonic = "BIC";
+		break;
+	case 2:
+		if (rn == 0xf) {
+			instruction->type = ARM_MOV;
+			switch (type) {
+			case 0:
+				if (immed == 0) {
+					sprintf(cp, "MOV%s.W\tr%d, r%d",
+						suffix, rd,
+						(int) (opcode & 0xf));
+					return ERROR_OK;
+				}
+				mnemonic = "LSL";
+				break;
+			case 1:
+				mnemonic = "LSR";
+				break;
+			case 2:
+				mnemonic = "ASR";
+				break;
+			default:
+				if (immed == 0) {
+					sprintf(cp, "RRX%s\tr%d, r%d",
+						suffix, rd,
+						(int) (opcode & 0xf));
+					return ERROR_OK;
+				}
+				mnemonic = "ROR";
+				break;
+			}
+			goto immediate;
+		} else {
+			instruction->type = ARM_ORR;
+			mnemonic = "ORR";
+		}
+		break;
+	case 3:
+		if (rn == 0xf) {
+			instruction->type = ARM_MVN;
+			mnemonic = "MVN";
+			rn = rd;
+			goto two;
+		} else {
+			// instruction->type = ARM_ORN;
+			mnemonic = "ORN";
+		}
+		break;
+	case 4:
+		if (rd == 0xf) {
+			if (!(opcode & (1 << 20)))
+				return ERROR_INVALID_ARGUMENTS;
+			instruction->type = ARM_TEQ;
+			mnemonic = "TEQ";
+			suffix = "";
+			goto two;
+		}
+		instruction->type = ARM_EOR;
+		mnemonic = "EOR";
+		break;
+	case 8:
+		if (rd == 0xf) {
+			if (!(opcode & (1 << 20)))
+				return ERROR_INVALID_ARGUMENTS;
+			instruction->type = ARM_CMN;
+			mnemonic = "CMN";
+			suffix = "";
+			goto two;
+		}
+		instruction->type = ARM_ADD;
+		mnemonic = "ADD";
+		break;
+	case 0xa:
+		instruction->type = ARM_ADC;
+		mnemonic = "ADC";
+		break;
+	case 0xb:
+		instruction->type = ARM_SBC;
+		mnemonic = "SBC";
+		break;
+	case 0xd:
+		if (rd == 0xf) {
+			if (!(opcode & (1 << 21)))
+				return ERROR_INVALID_ARGUMENTS;
+			instruction->type = ARM_CMP;
+			mnemonic = "CMP";
+			suffix = "";
+			goto two;
+		}
+		instruction->type = ARM_SUB;
+		mnemonic = "SUB";
+		break;
+	case 0xe:
+		instruction->type = ARM_RSB;
+		mnemonic = "RSB";
+		break;
+	default:
+		return ERROR_INVALID_ARGUMENTS;
+	}
+
+	sprintf(cp, "%s%s.W\tr%d, r%d, r%d",
+		mnemonic, suffix, rd, rn, (int) (opcode & 0xf));
+
+shift:
+	cp = strchr(cp, 0);
+
+	switch (type) {
+	case 0:
+		if (immed == 0)
+			return ERROR_OK;
+		suffix = "LSL";
+		break;
+	case 1:
+		suffix = "LSR";
+		if (immed == 32)
+			immed = 0;
+		break;
+	case 2:
+		suffix = "ASR";
+		if (immed == 32)
+			immed = 0;
+		break;
+	case 3:
+		if (immed == 0) {
+			strcpy(cp, ", RRX");
+			return ERROR_OK;
+		}
+		suffix = "ROR";
+		break;
+	}
+	sprintf(cp, ", %s #%d", suffix, immed ? immed : 32);
+	return ERROR_OK;
+
+two:
+	sprintf(cp, "%s%s.W\tr%d, r%d",
+		mnemonic, suffix, rn, (int) (opcode & 0xf));
+	goto shift;
+
+immediate:
+	sprintf(cp, "%s%s.W\tr%d, r%d, #%d",
+		mnemonic, suffix, rd,
+		(int) (opcode & 0xf), immed ? immed : 32);
+	return ERROR_OK;
+}
+
+static int t2ev_data_reg(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	char *mnemonic;
+	char * suffix = "";
+
+	if (((opcode >> 4) & 0xf) == 0) {
+		switch ((opcode >> 21) & 0x7) {
+		case 0:
+			mnemonic = "LSL";
+			break;
+		case 1:
+			mnemonic = "LSR";
+			break;
+		case 2:
+			mnemonic = "ASR";
+			break;
+		case 3:
+			mnemonic = "ROR";
+			break;
+		default:
+			return ERROR_INVALID_ARGUMENTS;
+		}
+
+		instruction->type = ARM_MOV;
+		if (opcode & (1 << 20))
+			suffix = "S";
+		sprintf(cp, "%s%s.W\tr%d, r%d, r%d",
+				mnemonic, suffix,
+				(int) (opcode >> 8) & 0xf,
+				(int) (opcode >> 16) & 0xf,
+				(int) (opcode >> 0) & 0xf);
+
+	} else if (opcode & (1 << 7)) {
+		switch ((opcode >> 20) & 0xf) {
+		case 0:
+		case 1:
+		case 4:
+		case 5:
+			switch ((opcode >> 4) & 0x3) {
+			case 1:
+				suffix = ", ROR #8";
+				break;
+			case 2:
+				suffix = ", ROR #16";
+				break;
+			case 3:
+				suffix = ", ROR #24";
+				break;
+			}
+			sprintf(cp, "%cXT%c.W\tr%d, r%d%s",
+					(opcode & (1 << 24)) ? 'U' : 'S',
+					(opcode & (1 << 26)) ? 'B' : 'H',
+					(int) (opcode >> 8) & 0xf,
+					(int) (opcode >> 0) & 0xf,
+					suffix);
+			break;
+		case 8:
+		case 9:
+		case 0xa:
+		case 0xb:
+			if (opcode & (1 << 6))
+				return ERROR_INVALID_ARGUMENTS;
+			if (((opcode >> 12) & 0xf) != 0xf)
+				return ERROR_INVALID_ARGUMENTS;
+			if (!(opcode & (1 << 20)))
+				return ERROR_INVALID_ARGUMENTS;
+
+			switch (((opcode >> 19) & 0x04)
+				| ((opcode >> 4) & 0x3)) {
+			case 0:
+				mnemonic = "REV.W";
+				break;
+			case 1:
+				mnemonic = "REV16.W";
+				break;
+			case 2:
+				mnemonic = "RBIT";
+				break;
+			case 3:
+				mnemonic = "REVSH.W";
+				break;
+			case 4:
+				mnemonic = "CLZ";
+				break;
+			default:
+				return ERROR_INVALID_ARGUMENTS;
+			}
+			sprintf(cp, "%s\tr%d, r%d",
+					mnemonic,
+					(int) (opcode >> 8) & 0xf,
+					(int) (opcode >> 0) & 0xf);
+			break;
+		default:
+			return ERROR_INVALID_ARGUMENTS;
+		}
+	}
+
+	return ERROR_OK;
+}
+
+static int t2ev_load_word(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int rn = (opcode >> 16) & 0xf;
+	int immed;
+
+	instruction->type = ARM_LDR;
+
+	if (rn == 0xf) {
+		immed = opcode & 0x0fff;
+		if ((opcode & (1 << 23)) == 0)
+			immed = -immed;
+		sprintf(cp, "LDR\tr%d, %#8.8" PRIx32,
+				(int) (opcode >> 12) & 0xf,
+				thumb_alignpc4(address) + immed);
+		return ERROR_OK;
+	}
+
+	if (opcode & (1 << 23)) {
+		immed = opcode & 0x0fff;
+		sprintf(cp, "LDR.W\tr%d, [r%d, #%d]\t; %#3.3x",
+				(int) (opcode >> 12) & 0xf,
+				rn, immed, immed);
+		return ERROR_OK;
+	}
+
+	if (!(opcode & (0x3f << 6))) {
+		sprintf(cp, "LDR.W\tr%d, [r%d, r%d, LSL #%d]",
+				(int) (opcode >> 12) & 0xf,
+				rn,
+				(int) (opcode >> 0) & 0xf,
+				(int) (opcode >> 4) & 0x3);
+		return ERROR_OK;
+	}
+
+
+	if (((opcode >> 8) & 0xf) == 0xe) {
+		immed = opcode & 0x00ff;
+
+		sprintf(cp, "LDRT\tr%d, [r%d, #%d]\t; %#2.2x",
+				(int) (opcode >> 12) & 0xf,
+				rn, immed, immed);
+		return ERROR_OK;
+	}
+
+	if (((opcode >> 8) & 0xf) == 0xc || (opcode & 0x0900) == 0x0900) {
+		char *p1 = "]", *p2 = "";
+
+		if (!(opcode & 0x0500))
+			return ERROR_INVALID_ARGUMENTS;
+
+		immed = opcode & 0x00ff;
+
+		/* two indexed modes will write back rn */
+		if (opcode & 0x100) {
+			if (opcode & 0x400)	/* pre-indexed */
+				p2 = "]!";
+			else {			/* post-indexed */
+				p1 = "]";
+				p2 = "";
+			}
+		}
+
+		sprintf(cp, "LDR\tr%d, [r%d%s, #%s%u%s\t; %#2.2x",
+				(int) (opcode >> 12) & 0xf,
+				rn, p1,
+				(opcode & 0x200) ? "" : "-",
+				immed, p2, immed);
+		return ERROR_OK;
+	}
+
+	return ERROR_INVALID_ARGUMENTS;
+}
+
+static int t2ev_load_byte_hints(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int rn = (opcode >> 16) & 0xf;
+	int rt = (opcode >> 12) & 0xf;
+	int op2 = (opcode >> 6) & 0x3f;
+	unsigned immed;
+	char *p1 = "", *p2 = "]";
+	char *mnemonic;
+
+	switch ((opcode >> 23) & 0x3) {
+	case 0:
+		if ((rn & rt) == 0xf) {
+pld_literal:
+			immed = opcode & 0xfff;
+			address = thumb_alignpc4(address);
+			if (opcode & (1 << 23))
+				address += immed;
+			else
+				address -= immed;
+			sprintf(cp, "PLD\tr%d, %#8.8" PRIx32,
+					rt, address);
+			return ERROR_OK;
+		}
+		if (rn == 0x0f && rt != 0x0f) {
+ldrb_literal:
+			immed = opcode & 0xfff;
+			address = thumb_alignpc4(address);
+			if (opcode & (1 << 23))
+				address += immed;
+			else
+				address -= immed;
+			sprintf(cp, "LDRB\tr%d, %#8.8" PRIx32,
+					rt, address);
+			return ERROR_OK;
+		}
+		if (rn == 0x0f)
+			break;
+		if ((op2 & 0x3c) == 0x38) {
+			immed = opcode & 0xff;
+			sprintf(cp, "LDRBT\tr%d, [r%d, #%d]\t; %#2.2x",
+					rt, rn, immed, immed);
+			return ERROR_OK;
+		}
+		if ((op2 & 0x3c) == 0x30) {
+			if (rt == 0x0f) {
+				immed = opcode & 0xff;
+				immed = -immed;
+preload_immediate:
+				p1 = (opcode & (1 << 21)) ? "W" : "";
+				sprintf(cp, "PLD%s\t[r%d, #%d]\t; %#6.6x",
+						p1, rn, immed, immed);
+				return ERROR_OK;
+			}
+			mnemonic = "LDRB";
+ldrxb_immediate_t3:
+			immed = opcode & 0xff;
+			if (!(opcode & 0x200))
+				immed = -immed;
+
+			/* two indexed modes will write back rn */
+			if (opcode & 0x100) {
+				if (opcode & 0x400)	/* pre-indexed */
+					p2 = "]!";
+				else {			/* post-indexed */
+					p1 = "]";
+					p2 = "";
+				}
+			}
+ldrxb_immediate_t2:
+			sprintf(cp, "%s\tr%d, [r%d%s, #%d%s\t; %#8.8x",
+					mnemonic, rt, rn, p1,
+					immed, p2, immed);
+			return ERROR_OK;
+		}
+		if ((op2 & 0x24) == 0x24) {
+			mnemonic = "LDRB";
+			goto ldrxb_immediate_t3;
+		}
+		if (op2 == 0) {
+			int rm = opcode & 0xf;
+
+			if (rt == 0x0f)
+				sprintf(cp, "PLD\t");
+			else
+				sprintf(cp, "LDRB.W\tr%d, ", rt);
+			immed = (opcode >> 4) & 0x3;
+			cp = strchr(cp, 0);
+			sprintf(cp, "[r%d, r%d, LSL #%d]", rn, rm, immed);
+			return ERROR_OK;
+		}
+		break;
+	case 1:
+		if ((rn & rt) == 0xf)
+			goto pld_literal;
+		if (rt == 0xf) {
+			immed = opcode & 0xfff;
+			goto preload_immediate;
+		}
+		if (rn == 0x0f)
+			goto ldrb_literal;
+		mnemonic = "LDRB.W";
+		immed = opcode & 0xfff;
+		goto ldrxb_immediate_t2;
+	case 2:
+		if ((rn & rt) == 0xf) {
+			immed = opcode & 0xfff;
+			address = thumb_alignpc4(address);
+			if (opcode & (1 << 23))
+				address += immed;
+			else
+				address -= immed;
+			sprintf(cp, "PLI\t%#8.8" PRIx32, address);
+			return ERROR_OK;
+		}
+		if (rn == 0xf && rt != 0xf) {
+ldrsb_literal:
+			immed = opcode & 0xfff;
+			address = thumb_alignpc4(address);
+			if (opcode & (1 << 23))
+				address += immed;
+			else
+				address -= immed;
+			sprintf(cp, "LDRSB\t%#8.8" PRIx32, address);
+			return ERROR_OK;
+		}
+		if (rn == 0xf)
+			break;
+		if ((op2 & 0x3c) == 0x38) {
+			immed = opcode & 0xff;
+			sprintf(cp, "LDRSBT\tr%d, [r%d, #%d]\t; %#2.2x",
+					rt, rn, immed, immed);
+			return ERROR_OK;
+		}
+		if ((op2 & 0x3c) == 0x30) {
+			if (rt == 0xf) {
+				immed = opcode & 0xff;
+				immed = -immed;	// pli
+				sprintf(cp, "PLI\t[r%d, #%d]\t; -%#2.2x",
+						rn, immed, -immed);
+				return ERROR_OK;
+			}
+			mnemonic = "LDRSB";
+			goto ldrxb_immediate_t3;
+		}
+		if ((op2 & 0x24) == 0x24) {
+			mnemonic = "LDRSB";
+			goto ldrxb_immediate_t3;
+		}
+		if (op2 == 0) {
+			int rm = opcode & 0xf;
+
+			if (rt == 0x0f)
+				sprintf(cp, "PLI\t");
+			else
+				sprintf(cp, "LDRSB.W\tr%d, ", rt);
+			immed = (opcode >> 4) & 0x3;
+			cp = strchr(cp, 0);
+			sprintf(cp, "[r%d, r%d, LSL #%d]", rn, rm, immed);
+			return ERROR_OK;
+		}
+		break;
+	case 3:
+		if (rt == 0xf) {
+			immed = opcode & 0xfff;
+			sprintf(cp, "PLI\t[r%d, #%d]\t; %#3.3x",
+					rn, immed, immed);
+			return ERROR_OK;
+		}
+		if (rn == 0xf)
+			goto ldrsb_literal;
+		immed = opcode & 0xfff;
+		mnemonic = "LDRSB";
+		goto ldrxb_immediate_t2;
+	}
+
+	return ERROR_INVALID_ARGUMENTS;
+}
+
+static int t2ev_load_halfword(uint32_t opcode, uint32_t address,
+		struct arm_instruction *instruction, char *cp)
+{
+	int rn = (opcode >> 16) & 0xf;
+	int rt = (opcode >> 12) & 0xf;
+	int op2 = (opcode >> 6) & 0x3f;
+	char *sign = "";
+	unsigned immed;
+
+	if (rt == 0xf) {
+		sprintf(cp, "HINT (UNALLOCATED)");
+		return ERROR_OK;
+	}
+
+	if (opcode & (1 << 24))
+		sign = "S";
+
+	if ((opcode & (1 << 23)) == 0) {
+		if (rn == 0xf) {
+ldrh_literal:
+			immed = opcode & 0xfff;
+			address = thumb_alignpc4(address);
+			if (opcode & (1 << 23))
+				address += immed;
+			else
+				address -= immed;
+			sprintf(cp, "LDR%sH\tr%d, %#8.8" PRIx32,
+					sign, rt, address);
+			return ERROR_OK;
+		}
+		if (op2 == 0) {
+			int rm = opcode & 0xf;
+
+			immed = (opcode >> 4) & 0x3;
+			sprintf(cp, "LDR%sH.W\tr%d, [r%d, r%d, LSL #%d]",
+					sign, rt, rn, rm, immed);
+			return ERROR_OK;
+		}
+		if ((op2 & 0x3c) == 0x38) {
+			immed = opcode & 0xff;
+			sprintf(cp, "LDR%sHT\tr%d, [r%d, #%d]\t; %#2.2x",
+					sign, rt, rn, immed, immed);
+			return ERROR_OK;
+		}
+		if ((op2 & 0x3c) == 0x30 || (op2 & 0x24) == 0x24) {
+			char *p1 = "", *p2 = "]";
+
+			immed = opcode & 0xff;
+			if (!(opcode & 0x200))
+				immed = -immed;
+
+			/* two indexed modes will write back rn */
+			if (opcode & 0x100) {
+				if (opcode & 0x400)	/* pre-indexed */
+					p2 = "]!";
+				else {			/* post-indexed */
+					p1 = "]";
+					p2 = "";
+				}
+			}
+			sprintf(cp, "LDR%sH\tr%d, [r%d%s, #%d%s\t; %#8.8x",
+					sign, rt, rn, p1, immed, p2, immed);
+			return ERROR_OK;
+		}
+	} else {
+		if (rn == 0xf)
+			goto ldrh_literal;
+
+		immed = opcode & 0xfff;
+		sprintf(cp, "LDR%sH%s\tr%d, [r%d, #%d]\t; %#6.6x",
+				sign, *sign ? "" : ".W",
+				rt, rn, immed, immed);
+		return ERROR_OK;
+	}
+
+	return ERROR_INVALID_ARGUMENTS;
+}
+
+/*
+ * REVISIT for Thumb2 instructions, instruction->type and friends aren't
+ * always set.  That means eventual arm_simulate_step() support for Thumb2
+ * will need work in this area.
+ */
+int thumb2_opcode(struct target *target, uint32_t address, struct arm_instruction *instruction)
+{
+	int retval;
+	uint16_t op;
+	uint32_t opcode;
+	char *cp;
+
+	/* clear low bit ... it's set on function pointers */
+	address &= ~1;
+
+	/* clear fields, to avoid confusion */
+	memset(instruction, 0, sizeof(struct arm_instruction));
+
+	/* read first halfword, see if this is the only one */
+	retval = target_read_u16(target, address, &op);
+	if (retval != ERROR_OK)
+		return retval;
+
+	switch (op & 0xf800) {
+	case 0xf800:
+	case 0xf000:
+	case 0xe800:
+		/* 32-bit instructions */
+		instruction->instruction_size = 4;
+		opcode = op << 16;
+		retval = target_read_u16(target, address + 2, &op);
+		if (retval != ERROR_OK)
+			return retval;
+		opcode |= op;
+		instruction->opcode = opcode;
+		break;
+	default:
+		/* 16-bit:  Thumb1 + IT + CBZ/CBNZ + ... */
+		return thumb_evaluate_opcode(op, address, instruction);
+	}
+
+	snprintf(instruction->text, 128,
+			"0x%8.8" PRIx32 "  0x%8.8" PRIx32 "\t",
+			address, opcode);
+	cp = strchr(instruction->text, 0);
+	retval = ERROR_FAIL;
+
+	/* ARMv7-M: A5.3.1 Data processing (modified immediate) */
+	if ((opcode & 0x1a008000) == 0x10000000)
+		retval = t2ev_data_mod_immed(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.3 Data processing (plain binary immediate) */
+	else if ((opcode & 0x1a008000) == 0x12000000)
+		retval = t2ev_data_immed(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.4 Branches and miscellaneous control */
+	else if ((opcode & 0x18008000) == 0x10008000)
+		retval = t2ev_b_misc(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.5 Load/store multiple */
+	else if ((opcode & 0x1e400000) == 0x08000000)
+		retval = t2ev_ldm_stm(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.6 Load/store dual or exclusive, table branch */
+	else if ((opcode & 0x1e400000) == 0x08400000)
+		retval = t2ev_ldrex_strex(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.7 Load word */
+	else if ((opcode & 0x1f700000) == 0x18500000)
+		retval = t2ev_load_word(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.8 Load halfword, unallocated memory hints */
+	else if ((opcode & 0x1e700000) == 0x18300000)
+		retval = t2ev_load_halfword(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.9 Load byte, memory hints */
+	else if ((opcode & 0x1e700000) == 0x18100000)
+		retval = t2ev_load_byte_hints(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.10 Store single data item */
+	else if ((opcode & 0x1f100000) == 0x18000000)
+		retval = t2ev_store_single(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.11 Data processing (shifted register) */
+	else if ((opcode & 0x1e000000) == 0x0a000000)
+		retval = t2ev_data_shift(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.12 Data processing (register)
+	 * and      A5.3.13 Miscellaneous operations
+	 */
+	else if ((opcode & 0x1f000000) == 0x1a000000)
+		retval = t2ev_data_reg(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.14 Multiply, and multiply accumulate */
+	else if ((opcode & 0x1f800000) == 0x1b000000)
+		retval = t2ev_mul32(opcode, address, instruction, cp);
+
+	/* ARMv7-M: A5.3.15 Long multiply, long multiply accumulate, divide */
+	else if ((opcode & 0x1f800000) == 0x1b800000)
+		retval = t2ev_mul64_div(opcode, address, instruction, cp);
+
+	if (retval == ERROR_OK)
+		return retval;
+
+	/*
+	 * Thumb2 also supports coprocessor, ThumbEE, and DSP/Media (SIMD)
+	 * instructions; not yet handled here.
+	 */
+
+	if (retval == ERROR_INVALID_ARGUMENTS) {
+		instruction->type = ARM_UNDEFINED_INSTRUCTION;
+		strcpy(cp, "UNDEFINED OPCODE");
+		return ERROR_OK;
+	}
+
+	LOG_DEBUG("Can't decode 32-bit Thumb2 yet (opcode=%08" PRIx32 ")",
+			opcode);
+
+	strcpy(cp, "(32-bit Thumb2 ...)");
 	return ERROR_OK;
 }
 
-int arm_access_size(arm_instruction_t *instruction)
+int arm_access_size(struct arm_instruction *instruction)
 {
 	if ((instruction->type == ARM_LDRB)
 		|| (instruction->type == ARM_LDRBT)