1/*
  2 * This file is subject to the terms and conditions of the GNU General Public
  3 * License.  See the file "COPYING" in the main directory of this archive
  4 * for more details.
  5 *
  6 * Copyright (C) 1996, 97, 2000, 2001 by Ralf Baechle
  7 * Copyright (C) 2001 MIPS Technologies, Inc.
  8 */
  9#include <linux/kernel.h>
 10#include <linux/sched/signal.h>
 11#include <linux/signal.h>
 12#include <linux/export.h>
 13#include <asm/branch.h>
 14#include <asm/cpu.h>
 15#include <asm/cpu-features.h>
 16#include <asm/fpu.h>
 17#include <asm/fpu_emulator.h>
 18#include <asm/inst.h>
 19#include <asm/mips-r2-to-r6-emul.h>
 20#include <asm/ptrace.h>
 21#include <linux/uaccess.h>
 22
 23/*
 24 * Calculate and return exception PC in case of branch delay slot
 25 * for microMIPS and MIPS16e. It does not clear the ISA mode bit.
 26 */
 27int __isa_exception_epc(struct pt_regs *regs)
 28{
 29	unsigned short inst;
 30	long epc = regs->cp0_epc;
 31
 32	/* Calculate exception PC in branch delay slot. */
 33	if (__get_user(inst, (u16 __user *) msk_isa16_mode(epc))) {
 34		/* This should never happen because delay slot was checked. */
 35		force_sig(SIGSEGV);
 36		return epc;
 37	}
 38	if (cpu_has_mips16) {
 39		union mips16e_instruction inst_mips16e;
 40
 41		inst_mips16e.full = inst;
 42		if (inst_mips16e.ri.opcode == MIPS16e_jal_op)
 43			epc += 4;
 44		else
 45			epc += 2;
 46	} else if (mm_insn_16bit(inst))
 47		epc += 2;
 48	else
 49		epc += 4;
 50
 51	return epc;
 52}
 53
 54/* (microMIPS) Convert 16-bit register encoding to 32-bit register encoding. */
 55static const unsigned int reg16to32map[8] = {16, 17, 2, 3, 4, 5, 6, 7};
 56
 57int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
 58		       unsigned long *contpc)
 59{
 60	union mips_instruction insn = (union mips_instruction)dec_insn.insn;
 61	int __maybe_unused bc_false = 0;
 62
 63	if (!cpu_has_mmips)
 64		return 0;
 65
 66	switch (insn.mm_i_format.opcode) {
 67	case mm_pool32a_op:
 68		if ((insn.mm_i_format.simmediate & MM_POOL32A_MINOR_MASK) ==
 69		    mm_pool32axf_op) {
 70			switch (insn.mm_i_format.simmediate >>
 71				MM_POOL32A_MINOR_SHIFT) {
 72			case mm_jalr_op:
 73			case mm_jalrhb_op:
 74			case mm_jalrs_op:
 75			case mm_jalrshb_op:
 76				if (insn.mm_i_format.rt != 0)	/* Not mm_jr */
 77					regs->regs[insn.mm_i_format.rt] =
 78						regs->cp0_epc +
 79						dec_insn.pc_inc +
 80						dec_insn.next_pc_inc;
 81				*contpc = regs->regs[insn.mm_i_format.rs];
 82				return 1;
 83			}
 84		}
 85		break;
 86	case mm_pool32i_op:
 87		switch (insn.mm_i_format.rt) {
 88		case mm_bltzals_op:
 89		case mm_bltzal_op:
 90			regs->regs[31] = regs->cp0_epc +
 91				dec_insn.pc_inc +
 92				dec_insn.next_pc_inc;
 93			/* Fall through */
 94		case mm_bltz_op:
 95			if ((long)regs->regs[insn.mm_i_format.rs] < 0)
 96				*contpc = regs->cp0_epc +
 97					dec_insn.pc_inc +
 98					(insn.mm_i_format.simmediate << 1);
 99			else
100				*contpc = regs->cp0_epc +
101					dec_insn.pc_inc +
102					dec_insn.next_pc_inc;
103			return 1;
104		case mm_bgezals_op:
105		case mm_bgezal_op:
106			regs->regs[31] = regs->cp0_epc +
107					dec_insn.pc_inc +
108					dec_insn.next_pc_inc;
109			/* Fall through */
110		case mm_bgez_op:
111			if ((long)regs->regs[insn.mm_i_format.rs] >= 0)
112				*contpc = regs->cp0_epc +
113					dec_insn.pc_inc +
114					(insn.mm_i_format.simmediate << 1);
115			else
116				*contpc = regs->cp0_epc +
117					dec_insn.pc_inc +
118					dec_insn.next_pc_inc;
119			return 1;
120		case mm_blez_op:
121			if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
122				*contpc = regs->cp0_epc +
123					dec_insn.pc_inc +
124					(insn.mm_i_format.simmediate << 1);
125			else
126				*contpc = regs->cp0_epc +
127					dec_insn.pc_inc +
128					dec_insn.next_pc_inc;
129			return 1;
130		case mm_bgtz_op:
131			if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
132				*contpc = regs->cp0_epc +
133					dec_insn.pc_inc +
134					(insn.mm_i_format.simmediate << 1);
135			else
136				*contpc = regs->cp0_epc +
137					dec_insn.pc_inc +
138					dec_insn.next_pc_inc;
139			return 1;
140#ifdef CONFIG_MIPS_FP_SUPPORT
141		case mm_bc2f_op:
142		case mm_bc1f_op: {
143			unsigned int fcr31;
144			unsigned int bit;
145
146			bc_false = 1;
147			/* Fall through */
148		case mm_bc2t_op:
149		case mm_bc1t_op:
150			preempt_disable();
151			if (is_fpu_owner())
152			        fcr31 = read_32bit_cp1_register(CP1_STATUS);
153			else
154				fcr31 = current->thread.fpu.fcr31;
155			preempt_enable();
156
157			if (bc_false)
158				fcr31 = ~fcr31;
159
160			bit = (insn.mm_i_format.rs >> 2);
161			bit += (bit != 0);
162			bit += 23;
163			if (fcr31 & (1 << bit))
164				*contpc = regs->cp0_epc +
165					dec_insn.pc_inc +
166					(insn.mm_i_format.simmediate << 1);
167			else
168				*contpc = regs->cp0_epc +
169					dec_insn.pc_inc + dec_insn.next_pc_inc;
170			return 1;
171		}
172#endif /* CONFIG_MIPS_FP_SUPPORT */
173		}
174		break;
175	case mm_pool16c_op:
176		switch (insn.mm_i_format.rt) {
177		case mm_jalr16_op:
178		case mm_jalrs16_op:
179			regs->regs[31] = regs->cp0_epc +
180				dec_insn.pc_inc + dec_insn.next_pc_inc;
181			/* Fall through */
182		case mm_jr16_op:
183			*contpc = regs->regs[insn.mm_i_format.rs];
184			return 1;
185		}
186		break;
187	case mm_beqz16_op:
188		if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] == 0)
189			*contpc = regs->cp0_epc +
190				dec_insn.pc_inc +
191				(insn.mm_b1_format.simmediate << 1);
192		else
193			*contpc = regs->cp0_epc +
194				dec_insn.pc_inc + dec_insn.next_pc_inc;
195		return 1;
196	case mm_bnez16_op:
197		if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] != 0)
198			*contpc = regs->cp0_epc +
199				dec_insn.pc_inc +
200				(insn.mm_b1_format.simmediate << 1);
201		else
202			*contpc = regs->cp0_epc +
203				dec_insn.pc_inc + dec_insn.next_pc_inc;
204		return 1;
205	case mm_b16_op:
206		*contpc = regs->cp0_epc + dec_insn.pc_inc +
207			 (insn.mm_b0_format.simmediate << 1);
208		return 1;
209	case mm_beq32_op:
210		if (regs->regs[insn.mm_i_format.rs] ==
211		    regs->regs[insn.mm_i_format.rt])
212			*contpc = regs->cp0_epc +
213				dec_insn.pc_inc +
214				(insn.mm_i_format.simmediate << 1);
215		else
216			*contpc = regs->cp0_epc +
217				dec_insn.pc_inc +
218				dec_insn.next_pc_inc;
219		return 1;
220	case mm_bne32_op:
221		if (regs->regs[insn.mm_i_format.rs] !=
222		    regs->regs[insn.mm_i_format.rt])
223			*contpc = regs->cp0_epc +
224				dec_insn.pc_inc +
225				(insn.mm_i_format.simmediate << 1);
226		else
227			*contpc = regs->cp0_epc +
228				dec_insn.pc_inc + dec_insn.next_pc_inc;
229		return 1;
230	case mm_jalx32_op:
231		regs->regs[31] = regs->cp0_epc +
232			dec_insn.pc_inc + dec_insn.next_pc_inc;
233		*contpc = regs->cp0_epc + dec_insn.pc_inc;
234		*contpc >>= 28;
235		*contpc <<= 28;
236		*contpc |= (insn.j_format.target << 2);
237		return 1;
238	case mm_jals32_op:
239	case mm_jal32_op:
240		regs->regs[31] = regs->cp0_epc +
241			dec_insn.pc_inc + dec_insn.next_pc_inc;
242		/* Fall through */
243	case mm_j32_op:
244		*contpc = regs->cp0_epc + dec_insn.pc_inc;
245		*contpc >>= 27;
246		*contpc <<= 27;
247		*contpc |= (insn.j_format.target << 1);
248		set_isa16_mode(*contpc);
249		return 1;
250	}
251	return 0;
252}
253
254/*
255 * Compute return address and emulate branch in microMIPS mode after an
256 * exception only. It does not handle compact branches/jumps and cannot
257 * be used in interrupt context. (Compact branches/jumps do not cause
258 * exceptions.)
259 */
260int __microMIPS_compute_return_epc(struct pt_regs *regs)
261{
262	u16 __user *pc16;
263	u16 halfword;
264	unsigned int word;
265	unsigned long contpc;
266	struct mm_decoded_insn mminsn = { 0 };
267
268	mminsn.micro_mips_mode = 1;
269
270	/* This load never faults. */
271	pc16 = (unsigned short __user *)msk_isa16_mode(regs->cp0_epc);
272	__get_user(halfword, pc16);
273	pc16++;
274	contpc = regs->cp0_epc + 2;
275	word = ((unsigned int)halfword << 16);
276	mminsn.pc_inc = 2;
277
278	if (!mm_insn_16bit(halfword)) {
279		__get_user(halfword, pc16);
280		pc16++;
281		contpc = regs->cp0_epc + 4;
282		mminsn.pc_inc = 4;
283		word |= halfword;
284	}
285	mminsn.insn = word;
286
287	if (get_user(halfword, pc16))
288		goto sigsegv;
289	mminsn.next_pc_inc = 2;
290	word = ((unsigned int)halfword << 16);
291
292	if (!mm_insn_16bit(halfword)) {
293		pc16++;
294		if (get_user(halfword, pc16))
295			goto sigsegv;
296		mminsn.next_pc_inc = 4;
297		word |= halfword;
298	}
299	mminsn.next_insn = word;
300
301	mm_isBranchInstr(regs, mminsn, &contpc);
302
303	regs->cp0_epc = contpc;
304
305	return 0;
306
307sigsegv:
308	force_sig(SIGSEGV);
309	return -EFAULT;
310}
311
312/*
313 * Compute return address and emulate branch in MIPS16e mode after an
314 * exception only. It does not handle compact branches/jumps and cannot
315 * be used in interrupt context. (Compact branches/jumps do not cause
316 * exceptions.)
317 */
318int __MIPS16e_compute_return_epc(struct pt_regs *regs)
319{
320	u16 __user *addr;
321	union mips16e_instruction inst;
322	u16 inst2;
323	u32 fullinst;
324	long epc;
325
326	epc = regs->cp0_epc;
327
328	/* Read the instruction. */
329	addr = (u16 __user *)msk_isa16_mode(epc);
330	if (__get_user(inst.full, addr)) {
331		force_sig(SIGSEGV);
332		return -EFAULT;
333	}
334
335	switch (inst.ri.opcode) {
336	case MIPS16e_extend_op:
337		regs->cp0_epc += 4;
338		return 0;
339
340		/*
341		 *  JAL and JALX in MIPS16e mode
342		 */
343	case MIPS16e_jal_op:
344		addr += 1;
345		if (__get_user(inst2, addr)) {
346			force_sig(SIGSEGV);
347			return -EFAULT;
348		}
349		fullinst = ((unsigned)inst.full << 16) | inst2;
350		regs->regs[31] = epc + 6;
351		epc += 4;
352		epc >>= 28;
353		epc <<= 28;
354		/*
355		 * JAL:5 X:1 TARGET[20-16]:5 TARGET[25:21]:5 TARGET[15:0]:16
356		 *
357		 * ......TARGET[15:0].................TARGET[20:16]...........
358		 * ......TARGET[25:21]
359		 */
360		epc |=
361		    ((fullinst & 0xffff) << 2) | ((fullinst & 0x3e00000) >> 3) |
362		    ((fullinst & 0x1f0000) << 7);
363		if (!inst.jal.x)
364			set_isa16_mode(epc);	/* Set ISA mode bit. */
365		regs->cp0_epc = epc;
366		return 0;
367
368		/*
369		 *  J(AL)R(C)
370		 */
371	case MIPS16e_rr_op:
372		if (inst.rr.func == MIPS16e_jr_func) {
373
374			if (inst.rr.ra)
375				regs->cp0_epc = regs->regs[31];
376			else
377				regs->cp0_epc =
378				    regs->regs[reg16to32[inst.rr.rx]];
379
380			if (inst.rr.l) {
381				if (inst.rr.nd)
382					regs->regs[31] = epc + 2;
383				else
384					regs->regs[31] = epc + 4;
385			}
386			return 0;
387		}
388		break;
389	}
390
391	/*
392	 * All other cases have no branch delay slot and are 16-bits.
393	 * Branches do not cause an exception.
394	 */
395	regs->cp0_epc += 2;
396
397	return 0;
398}
399
400/**
401 * __compute_return_epc_for_insn - Computes the return address and do emulate
402 *				    branch simulation, if required.
403 *
404 * @regs:	Pointer to pt_regs
405 * @insn:	branch instruction to decode
406 * Return:	-EFAULT on error and forces SIGILL, and on success
407 *		returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
408 *		evaluating the branch.
409 *
410 * MIPS R6 Compact branches and forbidden slots:
411 *	Compact branches do not throw exceptions because they do
412 *	not have delay slots. The forbidden slot instruction ($PC+4)
413 *	is only executed if the branch was not taken. Otherwise the
414 *	forbidden slot is skipped entirely. This means that the
415 *	only possible reason to be here because of a MIPS R6 compact
416 *	branch instruction is that the forbidden slot has thrown one.
417 *	In that case the branch was not taken, so the EPC can be safely
418 *	set to EPC + 8.
419 */
420int __compute_return_epc_for_insn(struct pt_regs *regs,
421				   union mips_instruction insn)
422{
 
423	long epc = regs->cp0_epc;
424	unsigned int dspcontrol;
425	int ret = 0;
426
427	switch (insn.i_format.opcode) {
428	/*
429	 * jr and jalr are in r_format format.
430	 */
431	case spec_op:
432		switch (insn.r_format.func) {
433		case jalr_op:
434			regs->regs[insn.r_format.rd] = epc + 8;
435			/* Fall through */
436		case jr_op:
437			if (NO_R6EMU && insn.r_format.func == jr_op)
438				goto sigill_r2r6;
439			regs->cp0_epc = regs->regs[insn.r_format.rs];
440			break;
441		}
442		break;
443
444	/*
445	 * This group contains:
446	 * bltz_op, bgez_op, bltzl_op, bgezl_op,
447	 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
448	 */
449	case bcond_op:
450		switch (insn.i_format.rt) {
451		case bltzl_op:
452			if (NO_R6EMU)
453				goto sigill_r2r6;
454			/* fall through */
455		case bltz_op:
 
456			if ((long)regs->regs[insn.i_format.rs] < 0) {
457				epc = epc + 4 + (insn.i_format.simmediate << 2);
458				if (insn.i_format.rt == bltzl_op)
459					ret = BRANCH_LIKELY_TAKEN;
460			} else
461				epc += 8;
462			regs->cp0_epc = epc;
463			break;
464
465		case bgezl_op:
466			if (NO_R6EMU)
467				goto sigill_r2r6;
468			/* fall through */
469		case bgez_op:
 
470			if ((long)regs->regs[insn.i_format.rs] >= 0) {
471				epc = epc + 4 + (insn.i_format.simmediate << 2);
472				if (insn.i_format.rt == bgezl_op)
473					ret = BRANCH_LIKELY_TAKEN;
474			} else
475				epc += 8;
476			regs->cp0_epc = epc;
477			break;
478
479		case bltzal_op:
480		case bltzall_op:
481			if (NO_R6EMU && (insn.i_format.rs ||
482			    insn.i_format.rt == bltzall_op))
483				goto sigill_r2r6;
484			regs->regs[31] = epc + 8;
485			/*
486			 * OK we are here either because we hit a NAL
487			 * instruction or because we are emulating an
488			 * old bltzal{,l} one. Let's figure out what the
489			 * case really is.
490			 */
491			if (!insn.i_format.rs) {
492				/*
493				 * NAL or BLTZAL with rs == 0
494				 * Doesn't matter if we are R6 or not. The
495				 * result is the same
496				 */
497				regs->cp0_epc += 4 +
498					(insn.i_format.simmediate << 2);
499				break;
500			}
501			/* Now do the real thing for non-R6 BLTZAL{,L} */
502			if ((long)regs->regs[insn.i_format.rs] < 0) {
503				epc = epc + 4 + (insn.i_format.simmediate << 2);
504				if (insn.i_format.rt == bltzall_op)
505					ret = BRANCH_LIKELY_TAKEN;
506			} else
507				epc += 8;
508			regs->cp0_epc = epc;
509			break;
510
511		case bgezal_op:
512		case bgezall_op:
513			if (NO_R6EMU && (insn.i_format.rs ||
514			    insn.i_format.rt == bgezall_op))
515				goto sigill_r2r6;
516			regs->regs[31] = epc + 8;
517			/*
518			 * OK we are here either because we hit a BAL
519			 * instruction or because we are emulating an
520			 * old bgezal{,l} one. Let's figure out what the
521			 * case really is.
522			 */
523			if (!insn.i_format.rs) {
524				/*
525				 * BAL or BGEZAL with rs == 0
526				 * Doesn't matter if we are R6 or not. The
527				 * result is the same
528				 */
529				regs->cp0_epc += 4 +
530					(insn.i_format.simmediate << 2);
531				break;
532			}
533			/* Now do the real thing for non-R6 BGEZAL{,L} */
534			if ((long)regs->regs[insn.i_format.rs] >= 0) {
535				epc = epc + 4 + (insn.i_format.simmediate << 2);
536				if (insn.i_format.rt == bgezall_op)
537					ret = BRANCH_LIKELY_TAKEN;
538			} else
539				epc += 8;
540			regs->cp0_epc = epc;
541			break;
542
543		case bposge32_op:
544			if (!cpu_has_dsp)
545				goto sigill_dsp;
546
547			dspcontrol = rddsp(0x01);
548
549			if (dspcontrol >= 32) {
550				epc = epc + 4 + (insn.i_format.simmediate << 2);
551			} else
552				epc += 8;
553			regs->cp0_epc = epc;
554			break;
555		}
556		break;
557
558	/*
559	 * These are unconditional and in j_format.
560	 */
561	case jalx_op:
562	case jal_op:
563		regs->regs[31] = regs->cp0_epc + 8;
564		/* fall through */
565	case j_op:
566		epc += 4;
567		epc >>= 28;
568		epc <<= 28;
569		epc |= (insn.j_format.target << 2);
570		regs->cp0_epc = epc;
571		if (insn.i_format.opcode == jalx_op)
572			set_isa16_mode(regs->cp0_epc);
573		break;
574
575	/*
576	 * These are conditional and in i_format.
577	 */
578	case beql_op:
579		if (NO_R6EMU)
580			goto sigill_r2r6;
581		/* fall through */
582	case beq_op:
 
583		if (regs->regs[insn.i_format.rs] ==
584		    regs->regs[insn.i_format.rt]) {
585			epc = epc + 4 + (insn.i_format.simmediate << 2);
586			if (insn.i_format.opcode == beql_op)
587				ret = BRANCH_LIKELY_TAKEN;
588		} else
589			epc += 8;
590		regs->cp0_epc = epc;
591		break;
592
593	case bnel_op:
594		if (NO_R6EMU)
595			goto sigill_r2r6;
596		/* fall through */
597	case bne_op:
 
598		if (regs->regs[insn.i_format.rs] !=
599		    regs->regs[insn.i_format.rt]) {
600			epc = epc + 4 + (insn.i_format.simmediate << 2);
601			if (insn.i_format.opcode == bnel_op)
602				ret = BRANCH_LIKELY_TAKEN;
603		} else
604			epc += 8;
605		regs->cp0_epc = epc;
606		break;
607
608	case blezl_op: /* not really i_format */
609		if (!insn.i_format.rt && NO_R6EMU)
610			goto sigill_r2r6;
611		/* fall through */
612	case blez_op:
613		/*
614		 * Compact branches for R6 for the
615		 * blez and blezl opcodes.
616		 * BLEZ  | rs = 0 | rt != 0  == BLEZALC
617		 * BLEZ  | rs = rt != 0      == BGEZALC
618		 * BLEZ  | rs != 0 | rt != 0 == BGEUC
619		 * BLEZL | rs = 0 | rt != 0  == BLEZC
620		 * BLEZL | rs = rt != 0      == BGEZC
621		 * BLEZL | rs != 0 | rt != 0 == BGEC
622		 *
623		 * For real BLEZ{,L}, rt is always 0.
624		 */
625
626		if (cpu_has_mips_r6 && insn.i_format.rt) {
627			if ((insn.i_format.opcode == blez_op) &&
628			    ((!insn.i_format.rs && insn.i_format.rt) ||
629			     (insn.i_format.rs == insn.i_format.rt)))
630				regs->regs[31] = epc + 4;
631			regs->cp0_epc += 8;
632			break;
633		}
634		/* rt field assumed to be zero */
635		if ((long)regs->regs[insn.i_format.rs] <= 0) {
636			epc = epc + 4 + (insn.i_format.simmediate << 2);
637			if (insn.i_format.opcode == blezl_op)
638				ret = BRANCH_LIKELY_TAKEN;
639		} else
640			epc += 8;
641		regs->cp0_epc = epc;
642		break;
643
644	case bgtzl_op:
645		if (!insn.i_format.rt && NO_R6EMU)
646			goto sigill_r2r6;
647		/* fall through */
648	case bgtz_op:
649		/*
650		 * Compact branches for R6 for the
651		 * bgtz and bgtzl opcodes.
652		 * BGTZ  | rs = 0 | rt != 0  == BGTZALC
653		 * BGTZ  | rs = rt != 0      == BLTZALC
654		 * BGTZ  | rs != 0 | rt != 0 == BLTUC
655		 * BGTZL | rs = 0 | rt != 0  == BGTZC
656		 * BGTZL | rs = rt != 0      == BLTZC
657		 * BGTZL | rs != 0 | rt != 0 == BLTC
658		 *
659		 * *ZALC varint for BGTZ &&& rt != 0
660		 * For real GTZ{,L}, rt is always 0.
661		 */
662		if (cpu_has_mips_r6 && insn.i_format.rt) {
663			if ((insn.i_format.opcode == blez_op) &&
664			    ((!insn.i_format.rs && insn.i_format.rt) ||
665			    (insn.i_format.rs == insn.i_format.rt)))
666				regs->regs[31] = epc + 4;
667			regs->cp0_epc += 8;
668			break;
669		}
670
671		/* rt field assumed to be zero */
672		if ((long)regs->regs[insn.i_format.rs] > 0) {
673			epc = epc + 4 + (insn.i_format.simmediate << 2);
674			if (insn.i_format.opcode == bgtzl_op)
675				ret = BRANCH_LIKELY_TAKEN;
676		} else
677			epc += 8;
678		regs->cp0_epc = epc;
679		break;
680
681#ifdef CONFIG_MIPS_FP_SUPPORT
682	/*
683	 * And now the FPA/cp1 branch instructions.
684	 */
685	case cop1_op: {
686		unsigned int bit, fcr31, reg;
 
 
 
 
 
687
688		if (cpu_has_mips_r6 &&
689		    ((insn.i_format.rs == bc1eqz_op) ||
690		     (insn.i_format.rs == bc1nez_op))) {
691			if (!init_fp_ctx(current))
692				lose_fpu(1);
693			reg = insn.i_format.rt;
694			bit = get_fpr32(&current->thread.fpu.fpr[reg], 0) & 0x1;
695			if (insn.i_format.rs == bc1eqz_op)
696				bit = !bit;
697			own_fpu(1);
698			if (bit)
699				epc = epc + 4 +
700					(insn.i_format.simmediate << 2);
701			else
702				epc += 8;
703			regs->cp0_epc = epc;
704
705			break;
706		} else {
707
708			preempt_disable();
709			if (is_fpu_owner())
710			        fcr31 = read_32bit_cp1_register(CP1_STATUS);
711			else
712				fcr31 = current->thread.fpu.fcr31;
713			preempt_enable();
714
715			bit = (insn.i_format.rt >> 2);
716			bit += (bit != 0);
717			bit += 23;
718			switch (insn.i_format.rt & 3) {
719			case 0: /* bc1f */
720			case 2: /* bc1fl */
721				if (~fcr31 & (1 << bit)) {
722					epc = epc + 4 +
723						(insn.i_format.simmediate << 2);
724					if (insn.i_format.rt == 2)
725						ret = BRANCH_LIKELY_TAKEN;
726				} else
727					epc += 8;
728				regs->cp0_epc = epc;
729				break;
730
731			case 1: /* bc1t */
732			case 3: /* bc1tl */
733				if (fcr31 & (1 << bit)) {
734					epc = epc + 4 +
735						(insn.i_format.simmediate << 2);
736					if (insn.i_format.rt == 3)
737						ret = BRANCH_LIKELY_TAKEN;
738				} else
739					epc += 8;
740				regs->cp0_epc = epc;
741				break;
742			}
743			break;
744		}
745	}
746#endif /* CONFIG_MIPS_FP_SUPPORT */
747
748#ifdef CONFIG_CPU_CAVIUM_OCTEON
749	case lwc2_op: /* This is bbit0 on Octeon */
750		if ((regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
751		     == 0)
752			epc = epc + 4 + (insn.i_format.simmediate << 2);
753		else
754			epc += 8;
755		regs->cp0_epc = epc;
756		break;
757	case ldc2_op: /* This is bbit032 on Octeon */
758		if ((regs->regs[insn.i_format.rs] &
759		    (1ull<<(insn.i_format.rt+32))) == 0)
760			epc = epc + 4 + (insn.i_format.simmediate << 2);
761		else
762			epc += 8;
763		regs->cp0_epc = epc;
764		break;
765	case swc2_op: /* This is bbit1 on Octeon */
766		if (regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
767			epc = epc + 4 + (insn.i_format.simmediate << 2);
768		else
769			epc += 8;
770		regs->cp0_epc = epc;
771		break;
772	case sdc2_op: /* This is bbit132 on Octeon */
773		if (regs->regs[insn.i_format.rs] &
774		    (1ull<<(insn.i_format.rt+32)))
775			epc = epc + 4 + (insn.i_format.simmediate << 2);
776		else
777			epc += 8;
778		regs->cp0_epc = epc;
779		break;
780#else
781	case bc6_op:
782		/* Only valid for MIPS R6 */
783		if (!cpu_has_mips_r6)
784			goto sigill_r6;
785		regs->cp0_epc += 8;
786		break;
787	case balc6_op:
788		if (!cpu_has_mips_r6)
789			goto sigill_r6;
790		/* Compact branch: BALC */
791		regs->regs[31] = epc + 4;
792		epc += 4 + (insn.i_format.simmediate << 2);
793		regs->cp0_epc = epc;
794		break;
795	case pop66_op:
796		if (!cpu_has_mips_r6)
797			goto sigill_r6;
798		/* Compact branch: BEQZC || JIC */
799		regs->cp0_epc += 8;
800		break;
801	case pop76_op:
802		if (!cpu_has_mips_r6)
803			goto sigill_r6;
804		/* Compact branch: BNEZC || JIALC */
805		if (!insn.i_format.rs) {
806			/* JIALC: set $31/ra */
807			regs->regs[31] = epc + 4;
808		}
809		regs->cp0_epc += 8;
810		break;
811#endif
812	case pop10_op:
813	case pop30_op:
814		/* Only valid for MIPS R6 */
815		if (!cpu_has_mips_r6)
816			goto sigill_r6;
817		/*
818		 * Compact branches:
819		 * bovc, beqc, beqzalc, bnvc, bnec, bnezlac
820		 */
821		if (insn.i_format.rt && !insn.i_format.rs)
822			regs->regs[31] = epc + 4;
823		regs->cp0_epc += 8;
824		break;
825	}
826
827	return ret;
828
829sigill_dsp:
830	pr_debug("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
831		 current->comm);
832	force_sig(SIGILL);
833	return -EFAULT;
834sigill_r2r6:
835	pr_debug("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n",
836		 current->comm);
837	force_sig(SIGILL);
838	return -EFAULT;
839sigill_r6:
840	pr_debug("%s: R6 branch but no MIPSr6 ISA support - sending SIGILL.\n",
841		 current->comm);
842	force_sig(SIGILL);
843	return -EFAULT;
844}
845EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn);
846
847int __compute_return_epc(struct pt_regs *regs)
848{
849	unsigned int __user *addr;
850	long epc;
851	union mips_instruction insn;
852
853	epc = regs->cp0_epc;
854	if (epc & 3)
855		goto unaligned;
856
857	/*
858	 * Read the instruction
859	 */
860	addr = (unsigned int __user *) epc;
861	if (__get_user(insn.word, addr)) {
862		force_sig(SIGSEGV);
863		return -EFAULT;
864	}
865
866	return __compute_return_epc_for_insn(regs, insn);
867
868unaligned:
869	printk("%s: unaligned epc - sending SIGBUS.\n", current->comm);
870	force_sig(SIGBUS);
871	return -EFAULT;
872}
873
874#if (defined CONFIG_KPROBES) || (defined CONFIG_UPROBES)
875
876int __insn_is_compact_branch(union mips_instruction insn)
877{
878	if (!cpu_has_mips_r6)
879		return 0;
880
881	switch (insn.i_format.opcode) {
882	case blezl_op:
883	case bgtzl_op:
884	case blez_op:
885	case bgtz_op:
886		/*
887		 * blez[l] and bgtz[l] opcodes with non-zero rt
888		 * are MIPS R6 compact branches
889		 */
890		if (insn.i_format.rt)
891			return 1;
892		break;
893	case bc6_op:
894	case balc6_op:
895	case pop10_op:
896	case pop30_op:
897	case pop66_op:
898	case pop76_op:
899		return 1;
900	}
901
902	return 0;
903}
904EXPORT_SYMBOL_GPL(__insn_is_compact_branch);
905
906#endif  /* CONFIG_KPROBES || CONFIG_UPROBES */