arch/mips/kernel/branch.c

   1 /*
   2  * This file is subject to the terms and conditions of the GNU General Public
   3  * License.  See the file "COPYING" in the main directory of this archive
   4  * for more details.
   5  *
   6  * Copyright (C) 1996, 97, 2000, 2001 by Ralf Baechle
   7  * Copyright (C) 2001 MIPS Technologies, Inc.
   8  */
   9 #include <linux/kernel.h>
  10 #include <linux/sched/signal.h>
  11 #include <linux/signal.h>
  12 #include <linux/export.h>
  13 #include <asm/branch.h>
  14 #include <asm/cpu.h>
  15 #include <asm/cpu-features.h>
  16 #include <asm/fpu.h>
  17 #include <asm/fpu_emulator.h>
  18 #include <asm/inst.h>
  19 #include <asm/mips-r2-to-r6-emul.h>
  20 #include <asm/ptrace.h>
  21 #include <linux/uaccess.h>
  22
  23 /*
  24  * Calculate and return exception PC in case of branch delay slot
  25  * for microMIPS and MIPS16e. It does not clear the ISA mode bit.
  26  */
  27 int __isa_exception_epc(struct pt_regs *regs)
  28 {
  29         unsigned short inst;
  30         long epc = regs->cp0_epc;
  31
  32         /* Calculate exception PC in branch delay slot. */
  33         if (__get_user(inst, (u16 __user *) msk_isa16_mode(epc))) {
  34                 /* This should never happen because delay slot was checked. */
  35                 force_sig(SIGSEGV);
  36                 return epc;
  37         }
  38         if (cpu_has_mips16) {
  39                 union mips16e_instruction inst_mips16e;
  40
  41                 inst_mips16e.full = inst;
  42                 if (inst_mips16e.ri.opcode == MIPS16e_jal_op)
  43                         epc += 4;
  44                 else
  45                         epc += 2;
  46         } else if (mm_insn_16bit(inst))
  47                 epc += 2;
  48         else
  49                 epc += 4;
  50
  51         return epc;
  52 }
  53
  54 /* (microMIPS) Convert 16-bit register encoding to 32-bit register encoding. */
  55 static const unsigned int reg16to32map[8] = {16, 17, 2, 3, 4, 5, 6, 7};
  56
  57 int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
  58                        unsigned long *contpc)
  59 {
  60         union mips_instruction insn = (union mips_instruction)dec_insn.insn;
  61         int __maybe_unused bc_false = 0;
  62
  63         if (!cpu_has_mmips)
  64                 return 0;
  65
  66         switch (insn.mm_i_format.opcode) {
  67         case mm_pool32a_op:
  68                 if ((insn.mm_i_format.simmediate & MM_POOL32A_MINOR_MASK) ==
  69                     mm_pool32axf_op) {
  70                         switch (insn.mm_i_format.simmediate >>
  71                                 MM_POOL32A_MINOR_SHIFT) {
  72                         case mm_jalr_op:
  73                         case mm_jalrhb_op:
  74                         case mm_jalrs_op:
  75                         case mm_jalrshb_op:
  76                                 if (insn.mm_i_format.rt != 0)   /* Not mm_jr */
  77                                         regs->regs[insn.mm_i_format.rt] =
  78                                                 regs->cp0_epc +
  79                                                 dec_insn.pc_inc +
  80                                                 dec_insn.next_pc_inc;
  81                                 *contpc = regs->regs[insn.mm_i_format.rs];
  82                                 return 1;
  83                         }
  84                 }
  85                 break;
  86         case mm_pool32i_op:
  87                 switch (insn.mm_i_format.rt) {
  88                 case mm_bltzals_op:
  89                 case mm_bltzal_op:
  90                         regs->regs[31] = regs->cp0_epc +
  91                                 dec_insn.pc_inc +
  92                                 dec_insn.next_pc_inc;
  93                         fallthrough;
  94                 case mm_bltz_op:
  95                         if ((long)regs->regs[insn.mm_i_format.rs] < 0)
  96                                 *contpc = regs->cp0_epc +
  97                                         dec_insn.pc_inc +
  98                                         (insn.mm_i_format.simmediate << 1);
  99                         else
 100                                 *contpc = regs->cp0_epc +
 101                                         dec_insn.pc_inc +
 102                                         dec_insn.next_pc_inc;
 103                         return 1;
 104                 case mm_bgezals_op:
 105                 case mm_bgezal_op:
 106                         regs->regs[31] = regs->cp0_epc +
 107                                         dec_insn.pc_inc +
 108                                         dec_insn.next_pc_inc;
 109                         fallthrough;
 110                 case mm_bgez_op:
 111                         if ((long)regs->regs[insn.mm_i_format.rs] >= 0)
 112                                 *contpc = regs->cp0_epc +
 113                                         dec_insn.pc_inc +
 114                                         (insn.mm_i_format.simmediate << 1);
 115                         else
 116                                 *contpc = regs->cp0_epc +
 117                                         dec_insn.pc_inc +
 118                                         dec_insn.next_pc_inc;
 119                         return 1;
 120                 case mm_blez_op:
 121                         if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
 122                                 *contpc = regs->cp0_epc +
 123                                         dec_insn.pc_inc +
 124                                         (insn.mm_i_format.simmediate << 1);
 125                         else
 126                                 *contpc = regs->cp0_epc +
 127                                         dec_insn.pc_inc +
 128                                         dec_insn.next_pc_inc;
 129                         return 1;
 130                 case mm_bgtz_op:
 131                         if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
 132                                 *contpc = regs->cp0_epc +
 133                                         dec_insn.pc_inc +
 134                                         (insn.mm_i_format.simmediate << 1);
 135                         else
 136                                 *contpc = regs->cp0_epc +
 137                                         dec_insn.pc_inc +
 138                                         dec_insn.next_pc_inc;
 139                         return 1;
 140 #ifdef CONFIG_MIPS_FP_SUPPORT
 141                 case mm_bc2f_op:
 142                 case mm_bc1f_op: {
 143                         unsigned int fcr31;
 144                         unsigned int bit;
 145
 146                         bc_false = 1;
 147                         fallthrough;
 148                 case mm_bc2t_op:
 149                 case mm_bc1t_op:
 150                         preempt_disable();
 151                         if (is_fpu_owner())
 152                                 fcr31 = read_32bit_cp1_register(CP1_STATUS);
 153                         else
 154                                 fcr31 = current->thread.fpu.fcr31;
 155                         preempt_enable();
 156
 157                         if (bc_false)
 158                                 fcr31 = ~fcr31;
 159
 160                         bit = (insn.mm_i_format.rs >> 2);
 161                         bit += (bit != 0);
 162                         bit += 23;
 163                         if (fcr31 & (1 << bit))
 164                                 *contpc = regs->cp0_epc +
 165                                         dec_insn.pc_inc +
 166                                         (insn.mm_i_format.simmediate << 1);
 167                         else
 168                                 *contpc = regs->cp0_epc +
 169                                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 170                         return 1;
 171                 }
 172 #endif /* CONFIG_MIPS_FP_SUPPORT */
 173                 }
 174                 break;
 175         case mm_pool16c_op:
 176                 switch (insn.mm_i_format.rt) {
 177                 case mm_jalr16_op:
 178                 case mm_jalrs16_op:
 179                         regs->regs[31] = regs->cp0_epc +
 180                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 181                         fallthrough;
 182                 case mm_jr16_op:
 183                         *contpc = regs->regs[insn.mm_i_format.rs];
 184                         return 1;
 185                 }
 186                 break;
 187         case mm_beqz16_op:
 188                 if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] == 0)
 189                         *contpc = regs->cp0_epc +
 190                                 dec_insn.pc_inc +
 191                                 (insn.mm_b1_format.simmediate << 1);
 192                 else
 193                         *contpc = regs->cp0_epc +
 194                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 195                 return 1;
 196         case mm_bnez16_op:
 197                 if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] != 0)
 198                         *contpc = regs->cp0_epc +
 199                                 dec_insn.pc_inc +
 200                                 (insn.mm_b1_format.simmediate << 1);
 201                 else
 202                         *contpc = regs->cp0_epc +
 203                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 204                 return 1;
 205         case mm_b16_op:
 206                 *contpc = regs->cp0_epc + dec_insn.pc_inc +
 207                          (insn.mm_b0_format.simmediate << 1);
 208                 return 1;
 209         case mm_beq32_op:
 210                 if (regs->regs[insn.mm_i_format.rs] ==
 211                     regs->regs[insn.mm_i_format.rt])
 212                         *contpc = regs->cp0_epc +
 213                                 dec_insn.pc_inc +
 214                                 (insn.mm_i_format.simmediate << 1);
 215                 else
 216                         *contpc = regs->cp0_epc +
 217                                 dec_insn.pc_inc +
 218                                 dec_insn.next_pc_inc;
 219                 return 1;
 220         case mm_bne32_op:
 221                 if (regs->regs[insn.mm_i_format.rs] !=
 222                     regs->regs[insn.mm_i_format.rt])
 223                         *contpc = regs->cp0_epc +
 224                                 dec_insn.pc_inc +
 225                                 (insn.mm_i_format.simmediate << 1);
 226                 else
 227                         *contpc = regs->cp0_epc +
 228                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 229                 return 1;
 230         case mm_jalx32_op:
 231                 regs->regs[31] = regs->cp0_epc +
 232                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 233                 *contpc = regs->cp0_epc + dec_insn.pc_inc;
 234                 *contpc >>= 28;
 235                 *contpc <<= 28;
 236                 *contpc |= (insn.j_format.target << 2);
 237                 return 1;
 238         case mm_jals32_op:
 239         case mm_jal32_op:
 240                 regs->regs[31] = regs->cp0_epc +
 241                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 242                 fallthrough;
 243         case mm_j32_op:
 244                 *contpc = regs->cp0_epc + dec_insn.pc_inc;
 245                 *contpc >>= 27;
 246                 *contpc <<= 27;
 247                 *contpc |= (insn.j_format.target << 1);
 248                 set_isa16_mode(*contpc);
 249                 return 1;
 250         }
 251         return 0;
 252 }
 253
 254 /*
 255  * Compute return address and emulate branch in microMIPS mode after an
 256  * exception only. It does not handle compact branches/jumps and cannot
 257  * be used in interrupt context. (Compact branches/jumps do not cause
 258  * exceptions.)
 259  */
 260 int __microMIPS_compute_return_epc(struct pt_regs *regs)
 261 {
 262         u16 __user *pc16;
 263         u16 halfword;
 264         unsigned int word;
 265         unsigned long contpc;
 266         struct mm_decoded_insn mminsn = { 0 };
 267
 268         mminsn.micro_mips_mode = 1;
 269
 270         /* This load never faults. */
 271         pc16 = (unsigned short __user *)msk_isa16_mode(regs->cp0_epc);
 272         __get_user(halfword, pc16);
 273         pc16++;
 274         contpc = regs->cp0_epc + 2;
 275         word = ((unsigned int)halfword << 16);
 276         mminsn.pc_inc = 2;
 277
 278         if (!mm_insn_16bit(halfword)) {
 279                 __get_user(halfword, pc16);
 280                 pc16++;
 281                 contpc = regs->cp0_epc + 4;
 282                 mminsn.pc_inc = 4;
 283                 word |= halfword;
 284         }
 285         mminsn.insn = word;
 286
 287         if (get_user(halfword, pc16))
 288                 goto sigsegv;
 289         mminsn.next_pc_inc = 2;
 290         word = ((unsigned int)halfword << 16);
 291
 292         if (!mm_insn_16bit(halfword)) {
 293                 pc16++;
 294                 if (get_user(halfword, pc16))
 295                         goto sigsegv;
 296                 mminsn.next_pc_inc = 4;
 297                 word |= halfword;
 298         }
 299         mminsn.next_insn = word;
 300
 301         mm_isBranchInstr(regs, mminsn, &contpc);
 302
 303         regs->cp0_epc = contpc;
 304
 305         return 0;
 306
 307 sigsegv:
 308         force_sig(SIGSEGV);
 309         return -EFAULT;
 310 }
 311
 312 /*
 313  * Compute return address and emulate branch in MIPS16e mode after an
 314  * exception only. It does not handle compact branches/jumps and cannot
 315  * be used in interrupt context. (Compact branches/jumps do not cause
 316  * exceptions.)
 317  */
 318 int __MIPS16e_compute_return_epc(struct pt_regs *regs)
 319 {
 320         u16 __user *addr;
 321         union mips16e_instruction inst;
 322         u16 inst2;
 323         u32 fullinst;
 324         long epc;
 325
 326         epc = regs->cp0_epc;
 327
 328         /* Read the instruction. */
 329         addr = (u16 __user *)msk_isa16_mode(epc);
 330         if (__get_user(inst.full, addr)) {
 331                 force_sig(SIGSEGV);
 332                 return -EFAULT;
 333         }
 334
 335         switch (inst.ri.opcode) {
 336         case MIPS16e_extend_op:
 337                 regs->cp0_epc += 4;
 338                 return 0;
 339
 340                 /*
 341                  *  JAL and JALX in MIPS16e mode
 342                  */
 343         case MIPS16e_jal_op:
 344                 addr += 1;
 345                 if (__get_user(inst2, addr)) {
 346                         force_sig(SIGSEGV);
 347                         return -EFAULT;
 348                 }
 349                 fullinst = ((unsigned)inst.full << 16) | inst2;
 350                 regs->regs[31] = epc + 6;
 351                 epc += 4;
 352                 epc >>= 28;
 353                 epc <<= 28;
 354                 /*
 355                  * JAL:5 X:1 TARGET[20-16]:5 TARGET[25:21]:5 TARGET[15:0]:16
 356                  *
 357                  * ......TARGET[15:0].................TARGET[20:16]...........
 358                  * ......TARGET[25:21]
 359                  */
 360                 epc |=
 361                     ((fullinst & 0xffff) << 2) | ((fullinst & 0x3e00000) >> 3) |
 362                     ((fullinst & 0x1f0000) << 7);
 363                 if (!inst.jal.x)
 364                         set_isa16_mode(epc);    /* Set ISA mode bit. */
 365                 regs->cp0_epc = epc;
 366                 return 0;
 367
 368                 /*
 369                  *  J(AL)R(C)
 370                  */
 371         case MIPS16e_rr_op:
 372                 if (inst.rr.func == MIPS16e_jr_func) {
 373
 374                         if (inst.rr.ra)
 375                                 regs->cp0_epc = regs->regs[31];
 376                         else
 377                                 regs->cp0_epc =
 378                                     regs->regs[reg16to32[inst.rr.rx]];
 379
 380                         if (inst.rr.l) {
 381                                 if (inst.rr.nd)
 382                                         regs->regs[31] = epc + 2;
 383                                 else
 384                                         regs->regs[31] = epc + 4;
 385                         }
 386                         return 0;
 387                 }
 388                 break;
 389         }
 390
 391         /*
 392          * All other cases have no branch delay slot and are 16-bits.
 393          * Branches do not cause an exception.
 394          */
 395         regs->cp0_epc += 2;
 396
 397         return 0;
 398 }
 399
 400 /**
 401  * __compute_return_epc_for_insn - Computes the return address and do emulate
 402  *                                  branch simulation, if required.
 403  *
 404  * @regs:       Pointer to pt_regs
 405  * @insn:       branch instruction to decode
 406  * Return:      -EFAULT on error and forces SIGILL, and on success
 407  *              returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
 408  *              evaluating the branch.
 409  *
 410  * MIPS R6 Compact branches and forbidden slots:
 411  *      Compact branches do not throw exceptions because they do
 412  *      not have delay slots. The forbidden slot instruction ($PC+4)
 413  *      is only executed if the branch was not taken. Otherwise the
 414  *      forbidden slot is skipped entirely. This means that the
 415  *      only possible reason to be here because of a MIPS R6 compact
 416  *      branch instruction is that the forbidden slot has thrown one.
 417  *      In that case the branch was not taken, so the EPC can be safely
 418  *      set to EPC + 8.
 419  */
 420 int __compute_return_epc_for_insn(struct pt_regs *regs,
 421                                    union mips_instruction insn)
 422 {
 423         long epc = regs->cp0_epc;
 424         unsigned int dspcontrol;
 425         int ret = 0;
 426
 427         switch (insn.i_format.opcode) {
 428         /*
 429          * jr and jalr are in r_format format.
 430          */
 431         case spec_op:
 432                 switch (insn.r_format.func) {
 433                 case jalr_op:
 434                         regs->regs[insn.r_format.rd] = epc + 8;
 435                         fallthrough;
 436                 case jr_op:
 437                         if (NO_R6EMU && insn.r_format.func == jr_op)
 438                                 goto sigill_r2r6;
 439                         regs->cp0_epc = regs->regs[insn.r_format.rs];
 440                         break;
 441                 }
 442                 break;
 443
 444         /*
 445          * This group contains:
 446          * bltz_op, bgez_op, bltzl_op, bgezl_op,
 447          * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
 448          */
 449         case bcond_op:
 450                 switch (insn.i_format.rt) {
 451                 case bltzl_op:
 452                         if (NO_R6EMU)
 453                                 goto sigill_r2r6;
 454                         fallthrough;
 455                 case bltz_op:
 456                         if ((long)regs->regs[insn.i_format.rs] < 0) {
 457                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 458                                 if (insn.i_format.rt == bltzl_op)
 459                                         ret = BRANCH_LIKELY_TAKEN;
 460                         } else
 461                                 epc += 8;
 462                         regs->cp0_epc = epc;
 463                         break;
 464
 465                 case bgezl_op:
 466                         if (NO_R6EMU)
 467                                 goto sigill_r2r6;
 468                         fallthrough;
 469                 case bgez_op:
 470                         if ((long)regs->regs[insn.i_format.rs] >= 0) {
 471                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 472                                 if (insn.i_format.rt == bgezl_op)
 473                                         ret = BRANCH_LIKELY_TAKEN;
 474                         } else
 475                                 epc += 8;
 476                         regs->cp0_epc = epc;
 477                         break;
 478
 479                 case bltzal_op:
 480                 case bltzall_op:
 481                         if (NO_R6EMU && (insn.i_format.rs ||
 482                             insn.i_format.rt == bltzall_op))
 483                                 goto sigill_r2r6;
 484                         regs->regs[31] = epc + 8;
 485                         /*
 486                          * OK we are here either because we hit a NAL
 487                          * instruction or because we are emulating an
 488                          * old bltzal{,l} one. Let's figure out what the
 489                          * case really is.
 490                          */
 491                         if (!insn.i_format.rs) {
 492                                 /*
 493                                  * NAL or BLTZAL with rs == 0
 494                                  * Doesn't matter if we are R6 or not. The
 495                                  * result is the same
 496                                  */
 497                                 regs->cp0_epc += 4 +
 498                                         (insn.i_format.simmediate << 2);
 499                                 break;
 500                         }
 501                         /* Now do the real thing for non-R6 BLTZAL{,L} */
 502                         if ((long)regs->regs[insn.i_format.rs] < 0) {
 503                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 504                                 if (insn.i_format.rt == bltzall_op)
 505                                         ret = BRANCH_LIKELY_TAKEN;
 506                         } else
 507                                 epc += 8;
 508                         regs->cp0_epc = epc;
 509                         break;
 510
 511                 case bgezal_op:
 512                 case bgezall_op:
 513                         if (NO_R6EMU && (insn.i_format.rs ||
 514                             insn.i_format.rt == bgezall_op))
 515                                 goto sigill_r2r6;
 516                         regs->regs[31] = epc + 8;
 517                         /*
 518                          * OK we are here either because we hit a BAL
 519                          * instruction or because we are emulating an
 520                          * old bgezal{,l} one. Let's figure out what the
 521                          * case really is.
 522                          */
 523                         if (!insn.i_format.rs) {
 524                                 /*
 525                                  * BAL or BGEZAL with rs == 0
 526                                  * Doesn't matter if we are R6 or not. The
 527                                  * result is the same
 528                                  */
 529                                 regs->cp0_epc += 4 +
 530                                         (insn.i_format.simmediate << 2);
 531                                 break;
 532                         }
 533                         /* Now do the real thing for non-R6 BGEZAL{,L} */
 534                         if ((long)regs->regs[insn.i_format.rs] >= 0) {
 535                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 536                                 if (insn.i_format.rt == bgezall_op)
 537                                         ret = BRANCH_LIKELY_TAKEN;
 538                         } else
 539                                 epc += 8;
 540                         regs->cp0_epc = epc;
 541                         break;
 542
 543                 case bposge32_op:
 544                         if (!cpu_has_dsp)
 545                                 goto sigill_dsp;
 546
 547                         dspcontrol = rddsp(0x01);
 548
 549                         if (dspcontrol >= 32) {
 550                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 551                         } else
 552                                 epc += 8;
 553                         regs->cp0_epc = epc;
 554                         break;
 555                 }
 556                 break;
 557
 558         /*
 559          * These are unconditional and in j_format.
 560          */
 561         case jalx_op:
 562         case jal_op:
 563                 regs->regs[31] = regs->cp0_epc + 8;
 564                 fallthrough;
 565         case j_op:
 566                 epc += 4;
 567                 epc >>= 28;
 568                 epc <<= 28;
 569                 epc |= (insn.j_format.target << 2);
 570                 regs->cp0_epc = epc;
 571                 if (insn.i_format.opcode == jalx_op)
 572                         set_isa16_mode(regs->cp0_epc);
 573                 break;
 574
 575         /*
 576          * These are conditional and in i_format.
 577          */
 578         case beql_op:
 579                 if (NO_R6EMU)
 580                         goto sigill_r2r6;
 581                 fallthrough;
 582         case beq_op:
 583                 if (regs->regs[insn.i_format.rs] ==
 584                     regs->regs[insn.i_format.rt]) {
 585                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 586                         if (insn.i_format.opcode == beql_op)
 587                                 ret = BRANCH_LIKELY_TAKEN;
 588                 } else
 589                         epc += 8;
 590                 regs->cp0_epc = epc;
 591                 break;
 592
 593         case bnel_op:
 594                 if (NO_R6EMU)
 595                         goto sigill_r2r6;
 596                 fallthrough;
 597         case bne_op:
 598                 if (regs->regs[insn.i_format.rs] !=
 599                     regs->regs[insn.i_format.rt]) {
 600                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 601                         if (insn.i_format.opcode == bnel_op)
 602                                 ret = BRANCH_LIKELY_TAKEN;
 603                 } else
 604                         epc += 8;
 605                 regs->cp0_epc = epc;
 606                 break;
 607
 608         case blezl_op: /* not really i_format */
 609                 if (!insn.i_format.rt && NO_R6EMU)
 610                         goto sigill_r2r6;
 611                 fallthrough;
 612         case blez_op:
 613                 /*
 614                  * Compact branches for R6 for the
 615                  * blez and blezl opcodes.
 616                  * BLEZ  | rs = 0 | rt != 0  == BLEZALC
 617                  * BLEZ  | rs = rt != 0      == BGEZALC
 618                  * BLEZ  | rs != 0 | rt != 0 == BGEUC
 619                  * BLEZL | rs = 0 | rt != 0  == BLEZC
 620                  * BLEZL | rs = rt != 0      == BGEZC
 621                  * BLEZL | rs != 0 | rt != 0 == BGEC
 622                  *
 623                  * For real BLEZ{,L}, rt is always 0.
 624                  */
 625
 626                 if (cpu_has_mips_r6 && insn.i_format.rt) {
 627                         if ((insn.i_format.opcode == blez_op) &&
 628                             ((!insn.i_format.rs && insn.i_format.rt) ||
 629                              (insn.i_format.rs == insn.i_format.rt)))
 630                                 regs->regs[31] = epc + 4;
 631                         regs->cp0_epc += 8;
 632                         break;
 633                 }
 634                 /* rt field assumed to be zero */
 635                 if ((long)regs->regs[insn.i_format.rs] <= 0) {
 636                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 637                         if (insn.i_format.opcode == blezl_op)
 638                                 ret = BRANCH_LIKELY_TAKEN;
 639                 } else
 640                         epc += 8;
 641                 regs->cp0_epc = epc;
 642                 break;
 643
 644         case bgtzl_op:
 645                 if (!insn.i_format.rt && NO_R6EMU)
 646                         goto sigill_r2r6;
 647                 fallthrough;
 648         case bgtz_op:
 649                 /*
 650                  * Compact branches for R6 for the
 651                  * bgtz and bgtzl opcodes.
 652                  * BGTZ  | rs = 0 | rt != 0  == BGTZALC
 653                  * BGTZ  | rs = rt != 0      == BLTZALC
 654                  * BGTZ  | rs != 0 | rt != 0 == BLTUC
 655                  * BGTZL | rs = 0 | rt != 0  == BGTZC
 656                  * BGTZL | rs = rt != 0      == BLTZC
 657                  * BGTZL | rs != 0 | rt != 0 == BLTC
 658                  *
 659                  * *ZALC varint for BGTZ &&& rt != 0
 660                  * For real GTZ{,L}, rt is always 0.
 661                  */
 662                 if (cpu_has_mips_r6 && insn.i_format.rt) {
 663                         if ((insn.i_format.opcode == blez_op) &&
 664                             ((!insn.i_format.rs && insn.i_format.rt) ||
 665                             (insn.i_format.rs == insn.i_format.rt)))
 666                                 regs->regs[31] = epc + 4;
 667                         regs->cp0_epc += 8;
 668                         break;
 669                 }
 670
 671                 /* rt field assumed to be zero */
 672                 if ((long)regs->regs[insn.i_format.rs] > 0) {
 673                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 674                         if (insn.i_format.opcode == bgtzl_op)
 675                                 ret = BRANCH_LIKELY_TAKEN;
 676                 } else
 677                         epc += 8;
 678                 regs->cp0_epc = epc;
 679                 break;
 680
 681 #ifdef CONFIG_MIPS_FP_SUPPORT
 682         /*
 683          * And now the FPA/cp1 branch instructions.
 684          */
 685         case cop1_op: {
 686                 unsigned int bit, fcr31, reg;
 687
 688                 if (cpu_has_mips_r6 &&
 689                     ((insn.i_format.rs == bc1eqz_op) ||
 690                      (insn.i_format.rs == bc1nez_op))) {
 691                         if (!init_fp_ctx(current))
 692                                 lose_fpu(1);
 693                         reg = insn.i_format.rt;
 694                         bit = get_fpr32(&current->thread.fpu.fpr[reg], 0) & 0x1;
 695                         if (insn.i_format.rs == bc1eqz_op)
 696                                 bit = !bit;
 697                         own_fpu(1);
 698                         if (bit)
 699                                 epc = epc + 4 +
 700                                         (insn.i_format.simmediate << 2);
 701                         else
 702                                 epc += 8;
 703                         regs->cp0_epc = epc;
 704
 705                         break;
 706                 } else {
 707
 708                         preempt_disable();
 709                         if (is_fpu_owner())
 710                                 fcr31 = read_32bit_cp1_register(CP1_STATUS);
 711                         else
 712                                 fcr31 = current->thread.fpu.fcr31;
 713                         preempt_enable();
 714
 715                         bit = (insn.i_format.rt >> 2);
 716                         bit += (bit != 0);
 717                         bit += 23;
 718                         switch (insn.i_format.rt & 3) {
 719                         case 0: /* bc1f */
 720                         case 2: /* bc1fl */
 721                                 if (~fcr31 & (1 << bit)) {
 722                                         epc = epc + 4 +
 723                                                 (insn.i_format.simmediate << 2);
 724                                         if (insn.i_format.rt == 2)
 725                                                 ret = BRANCH_LIKELY_TAKEN;
 726                                 } else
 727                                         epc += 8;
 728                                 regs->cp0_epc = epc;
 729                                 break;
 730
 731                         case 1: /* bc1t */
 732                         case 3: /* bc1tl */
 733                                 if (fcr31 & (1 << bit)) {
 734                                         epc = epc + 4 +
 735                                                 (insn.i_format.simmediate << 2);
 736                                         if (insn.i_format.rt == 3)
 737                                                 ret = BRANCH_LIKELY_TAKEN;
 738                                 } else
 739                                         epc += 8;
 740                                 regs->cp0_epc = epc;
 741                                 break;
 742                         }
 743                         break;
 744                 }
 745         }
 746 #endif /* CONFIG_MIPS_FP_SUPPORT */
 747
 748 #ifdef CONFIG_CPU_CAVIUM_OCTEON
 749         case lwc2_op: /* This is bbit0 on Octeon */
 750                 if ((regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
 751                      == 0)
 752                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 753                 else
 754                         epc += 8;
 755                 regs->cp0_epc = epc;
 756                 break;
 757         case ldc2_op: /* This is bbit032 on Octeon */
 758                 if ((regs->regs[insn.i_format.rs] &
 759                     (1ull<<(insn.i_format.rt+32))) == 0)
 760                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 761                 else
 762                         epc += 8;
 763                 regs->cp0_epc = epc;
 764                 break;
 765         case swc2_op: /* This is bbit1 on Octeon */
 766                 if (regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
 767                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 768                 else
 769                         epc += 8;
 770                 regs->cp0_epc = epc;
 771                 break;
 772         case sdc2_op: /* This is bbit132 on Octeon */
 773                 if (regs->regs[insn.i_format.rs] &
 774                     (1ull<<(insn.i_format.rt+32)))
 775                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 776                 else
 777                         epc += 8;
 778                 regs->cp0_epc = epc;
 779                 break;
 780 #else
 781         case bc6_op:
 782                 /* Only valid for MIPS R6 */
 783                 if (!cpu_has_mips_r6)
 784                         goto sigill_r6;
 785                 regs->cp0_epc += 8;
 786                 break;
 787         case balc6_op:
 788                 if (!cpu_has_mips_r6)
 789                         goto sigill_r6;
 790                 /* Compact branch: BALC */
 791                 regs->regs[31] = epc + 4;
 792                 epc += 4 + (insn.i_format.simmediate << 2);
 793                 regs->cp0_epc = epc;
 794                 break;
 795         case pop66_op:
 796                 if (!cpu_has_mips_r6)
 797                         goto sigill_r6;
 798                 /* Compact branch: BEQZC || JIC */
 799                 regs->cp0_epc += 8;
 800                 break;
 801         case pop76_op:
 802                 if (!cpu_has_mips_r6)
 803                         goto sigill_r6;
 804                 /* Compact branch: BNEZC || JIALC */
 805                 if (!insn.i_format.rs) {
 806                         /* JIALC: set $31/ra */
 807                         regs->regs[31] = epc + 4;
 808                 }
 809                 regs->cp0_epc += 8;
 810                 break;
 811 #endif
 812         case pop10_op:
 813         case pop30_op:
 814                 /* Only valid for MIPS R6 */
 815                 if (!cpu_has_mips_r6)
 816                         goto sigill_r6;
 817                 /*
 818                  * Compact branches:
 819                  * bovc, beqc, beqzalc, bnvc, bnec, bnezlac
 820                  */
 821                 if (insn.i_format.rt && !insn.i_format.rs)
 822                         regs->regs[31] = epc + 4;
 823                 regs->cp0_epc += 8;
 824                 break;
 825         }
 826
 827         return ret;
 828
 829 sigill_dsp:
 830         pr_debug("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
 831                  current->comm);
 832         force_sig(SIGILL);
 833         return -EFAULT;
 834 sigill_r2r6:
 835         pr_debug("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n",
 836                  current->comm);
 837         force_sig(SIGILL);
 838         return -EFAULT;
 839 sigill_r6:
 840         pr_debug("%s: R6 branch but no MIPSr6 ISA support - sending SIGILL.\n",
 841                  current->comm);
 842         force_sig(SIGILL);
 843         return -EFAULT;
 844 }
 845 EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn);
 846
 847 int __compute_return_epc(struct pt_regs *regs)
 848 {
 849         unsigned int __user *addr;
 850         long epc;
 851         union mips_instruction insn;
 852
 853         epc = regs->cp0_epc;
 854         if (epc & 3)
 855                 goto unaligned;
 856
 857         /*
 858          * Read the instruction
 859          */
 860         addr = (unsigned int __user *) epc;
 861         if (__get_user(insn.word, addr)) {
 862                 force_sig(SIGSEGV);
 863                 return -EFAULT;
 864         }
 865
 866         return __compute_return_epc_for_insn(regs, insn);
 867
 868 unaligned:
 869         printk("%s: unaligned epc - sending SIGBUS.\n", current->comm);
 870         force_sig(SIGBUS);
 871         return -EFAULT;
 872 }
 873
 874 #if (defined CONFIG_KPROBES) || (defined CONFIG_UPROBES)
 875
 876 int __insn_is_compact_branch(union mips_instruction insn)
 877 {
 878         if (!cpu_has_mips_r6)
 879                 return 0;
 880
 881         switch (insn.i_format.opcode) {
 882         case blezl_op:
 883         case bgtzl_op:
 884         case blez_op:
 885         case bgtz_op:
 886                 /*
 887                  * blez[l] and bgtz[l] opcodes with non-zero rt
 888                  * are MIPS R6 compact branches
 889                  */
 890                 if (insn.i_format.rt)
 891                         return 1;
 892                 break;
 893         case bc6_op:
 894         case balc6_op:
 895         case pop10_op:
 896         case pop30_op:
 897         case pop66_op:
 898         case pop76_op:
 899                 return 1;
 900         }
 901
 902         return 0;
 903 }
 904 EXPORT_SYMBOL_GPL(__insn_is_compact_branch);
 905
 906 #endif  /* CONFIG_KPROBES || CONFIG_UPROBES */