arch/mips/kernel/branch.c

   1 /*
   2  * This file is subject to the terms and conditions of the GNU General Public
   3  * License.  See the file "COPYING" in the main directory of this archive
   4  * for more details.
   5  *
   6  * Copyright (C) 1996, 97, 2000, 2001 by Ralf Baechle
   7  * Copyright (C) 2001 MIPS Technologies, Inc.
   8  */
   9 #include <linux/kernel.h>
  10 #include <linux/sched.h>
  11 #include <linux/signal.h>
  12 #include <linux/module.h>
  13 #include <asm/branch.h>
  14 #include <asm/cpu.h>
  15 #include <asm/cpu-features.h>
  16 #include <asm/fpu.h>
  17 #include <asm/fpu_emulator.h>
  18 #include <asm/inst.h>
  19 #include <asm/mips-r2-to-r6-emul.h>
  20 #include <asm/ptrace.h>
  21 #include <asm/uaccess.h>
  22
  23 /*
  24  * Calculate and return exception PC in case of branch delay slot
  25  * for microMIPS and MIPS16e. It does not clear the ISA mode bit.
  26  */
  27 int __isa_exception_epc(struct pt_regs *regs)
  28 {
  29         unsigned short inst;
  30         long epc = regs->cp0_epc;
  31
  32         /* Calculate exception PC in branch delay slot. */
  33         if (__get_user(inst, (u16 __user *) msk_isa16_mode(epc))) {
  34                 /* This should never happen because delay slot was checked. */
  35                 force_sig(SIGSEGV, current);
  36                 return epc;
  37         }
  38         if (cpu_has_mips16) {
  39                 if (((union mips16e_instruction)inst).ri.opcode
  40                                 == MIPS16e_jal_op)
  41                         epc += 4;
  42                 else
  43                         epc += 2;
  44         } else if (mm_insn_16bit(inst))
  45                 epc += 2;
  46         else
  47                 epc += 4;
  48
  49         return epc;
  50 }
  51
  52 /* (microMIPS) Convert 16-bit register encoding to 32-bit register encoding. */
  53 static const unsigned int reg16to32map[8] = {16, 17, 2, 3, 4, 5, 6, 7};
  54
  55 int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
  56                        unsigned long *contpc)
  57 {
  58         union mips_instruction insn = (union mips_instruction)dec_insn.insn;
  59         int bc_false = 0;
  60         unsigned int fcr31;
  61         unsigned int bit;
  62
  63         if (!cpu_has_mmips)
  64                 return 0;
  65
  66         switch (insn.mm_i_format.opcode) {
  67         case mm_pool32a_op:
  68                 if ((insn.mm_i_format.simmediate & MM_POOL32A_MINOR_MASK) ==
  69                     mm_pool32axf_op) {
  70                         switch (insn.mm_i_format.simmediate >>
  71                                 MM_POOL32A_MINOR_SHIFT) {
  72                         case mm_jalr_op:
  73                         case mm_jalrhb_op:
  74                         case mm_jalrs_op:
  75                         case mm_jalrshb_op:
  76                                 if (insn.mm_i_format.rt != 0)   /* Not mm_jr */
  77                                         regs->regs[insn.mm_i_format.rt] =
  78                                                 regs->cp0_epc +
  79                                                 dec_insn.pc_inc +
  80                                                 dec_insn.next_pc_inc;
  81                                 *contpc = regs->regs[insn.mm_i_format.rs];
  82                                 return 1;
  83                         }
  84                 }
  85                 break;
  86         case mm_pool32i_op:
  87                 switch (insn.mm_i_format.rt) {
  88                 case mm_bltzals_op:
  89                 case mm_bltzal_op:
  90                         regs->regs[31] = regs->cp0_epc +
  91                                 dec_insn.pc_inc +
  92                                 dec_insn.next_pc_inc;
  93                         /* Fall through */
  94                 case mm_bltz_op:
  95                         if ((long)regs->regs[insn.mm_i_format.rs] < 0)
  96                                 *contpc = regs->cp0_epc +
  97                                         dec_insn.pc_inc +
  98                                         (insn.mm_i_format.simmediate << 1);
  99                         else
 100                                 *contpc = regs->cp0_epc +
 101                                         dec_insn.pc_inc +
 102                                         dec_insn.next_pc_inc;
 103                         return 1;
 104                 case mm_bgezals_op:
 105                 case mm_bgezal_op:
 106                         regs->regs[31] = regs->cp0_epc +
 107                                         dec_insn.pc_inc +
 108                                         dec_insn.next_pc_inc;
 109                         /* Fall through */
 110                 case mm_bgez_op:
 111                         if ((long)regs->regs[insn.mm_i_format.rs] >= 0)
 112                                 *contpc = regs->cp0_epc +
 113                                         dec_insn.pc_inc +
 114                                         (insn.mm_i_format.simmediate << 1);
 115                         else
 116                                 *contpc = regs->cp0_epc +
 117                                         dec_insn.pc_inc +
 118                                         dec_insn.next_pc_inc;
 119                         return 1;
 120                 case mm_blez_op:
 121                         if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
 122                                 *contpc = regs->cp0_epc +
 123                                         dec_insn.pc_inc +
 124                                         (insn.mm_i_format.simmediate << 1);
 125                         else
 126                                 *contpc = regs->cp0_epc +
 127                                         dec_insn.pc_inc +
 128                                         dec_insn.next_pc_inc;
 129                         return 1;
 130                 case mm_bgtz_op:
 131                         if ((long)regs->regs[insn.mm_i_format.rs] <= 0)
 132                                 *contpc = regs->cp0_epc +
 133                                         dec_insn.pc_inc +
 134                                         (insn.mm_i_format.simmediate << 1);
 135                         else
 136                                 *contpc = regs->cp0_epc +
 137                                         dec_insn.pc_inc +
 138                                         dec_insn.next_pc_inc;
 139                         return 1;
 140                 case mm_bc2f_op:
 141                 case mm_bc1f_op:
 142                         bc_false = 1;
 143                         /* Fall through */
 144                 case mm_bc2t_op:
 145                 case mm_bc1t_op:
 146                         preempt_disable();
 147                         if (is_fpu_owner())
 148                                 fcr31 = read_32bit_cp1_register(CP1_STATUS);
 149                         else
 150                                 fcr31 = current->thread.fpu.fcr31;
 151                         preempt_enable();
 152
 153                         if (bc_false)
 154                                 fcr31 = ~fcr31;
 155
 156                         bit = (insn.mm_i_format.rs >> 2);
 157                         bit += (bit != 0);
 158                         bit += 23;
 159                         if (fcr31 & (1 << bit))
 160                                 *contpc = regs->cp0_epc +
 161                                         dec_insn.pc_inc +
 162                                         (insn.mm_i_format.simmediate << 1);
 163                         else
 164                                 *contpc = regs->cp0_epc +
 165                                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 166                         return 1;
 167                 }
 168                 break;
 169         case mm_pool16c_op:
 170                 switch (insn.mm_i_format.rt) {
 171                 case mm_jalr16_op:
 172                 case mm_jalrs16_op:
 173                         regs->regs[31] = regs->cp0_epc +
 174                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 175                         /* Fall through */
 176                 case mm_jr16_op:
 177                         *contpc = regs->regs[insn.mm_i_format.rs];
 178                         return 1;
 179                 }
 180                 break;
 181         case mm_beqz16_op:
 182                 if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] == 0)
 183                         *contpc = regs->cp0_epc +
 184                                 dec_insn.pc_inc +
 185                                 (insn.mm_b1_format.simmediate << 1);
 186                 else
 187                         *contpc = regs->cp0_epc +
 188                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 189                 return 1;
 190         case mm_bnez16_op:
 191                 if ((long)regs->regs[reg16to32map[insn.mm_b1_format.rs]] != 0)
 192                         *contpc = regs->cp0_epc +
 193                                 dec_insn.pc_inc +
 194                                 (insn.mm_b1_format.simmediate << 1);
 195                 else
 196                         *contpc = regs->cp0_epc +
 197                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 198                 return 1;
 199         case mm_b16_op:
 200                 *contpc = regs->cp0_epc + dec_insn.pc_inc +
 201                          (insn.mm_b0_format.simmediate << 1);
 202                 return 1;
 203         case mm_beq32_op:
 204                 if (regs->regs[insn.mm_i_format.rs] ==
 205                     regs->regs[insn.mm_i_format.rt])
 206                         *contpc = regs->cp0_epc +
 207                                 dec_insn.pc_inc +
 208                                 (insn.mm_i_format.simmediate << 1);
 209                 else
 210                         *contpc = regs->cp0_epc +
 211                                 dec_insn.pc_inc +
 212                                 dec_insn.next_pc_inc;
 213                 return 1;
 214         case mm_bne32_op:
 215                 if (regs->regs[insn.mm_i_format.rs] !=
 216                     regs->regs[insn.mm_i_format.rt])
 217                         *contpc = regs->cp0_epc +
 218                                 dec_insn.pc_inc +
 219                                 (insn.mm_i_format.simmediate << 1);
 220                 else
 221                         *contpc = regs->cp0_epc +
 222                                 dec_insn.pc_inc + dec_insn.next_pc_inc;
 223                 return 1;
 224         case mm_jalx32_op:
 225                 regs->regs[31] = regs->cp0_epc +
 226                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 227                 *contpc = regs->cp0_epc + dec_insn.pc_inc;
 228                 *contpc >>= 28;
 229                 *contpc <<= 28;
 230                 *contpc |= (insn.j_format.target << 2);
 231                 return 1;
 232         case mm_jals32_op:
 233         case mm_jal32_op:
 234                 regs->regs[31] = regs->cp0_epc +
 235                         dec_insn.pc_inc + dec_insn.next_pc_inc;
 236                 /* Fall through */
 237         case mm_j32_op:
 238                 *contpc = regs->cp0_epc + dec_insn.pc_inc;
 239                 *contpc >>= 27;
 240                 *contpc <<= 27;
 241                 *contpc |= (insn.j_format.target << 1);
 242                 set_isa16_mode(*contpc);
 243                 return 1;
 244         }
 245         return 0;
 246 }
 247
 248 /*
 249  * Compute return address and emulate branch in microMIPS mode after an
 250  * exception only. It does not handle compact branches/jumps and cannot
 251  * be used in interrupt context. (Compact branches/jumps do not cause
 252  * exceptions.)
 253  */
 254 int __microMIPS_compute_return_epc(struct pt_regs *regs)
 255 {
 256         u16 __user *pc16;
 257         u16 halfword;
 258         unsigned int word;
 259         unsigned long contpc;
 260         struct mm_decoded_insn mminsn = { 0 };
 261
 262         mminsn.micro_mips_mode = 1;
 263
 264         /* This load never faults. */
 265         pc16 = (unsigned short __user *)msk_isa16_mode(regs->cp0_epc);
 266         __get_user(halfword, pc16);
 267         pc16++;
 268         contpc = regs->cp0_epc + 2;
 269         word = ((unsigned int)halfword << 16);
 270         mminsn.pc_inc = 2;
 271
 272         if (!mm_insn_16bit(halfword)) {
 273                 __get_user(halfword, pc16);
 274                 pc16++;
 275                 contpc = regs->cp0_epc + 4;
 276                 mminsn.pc_inc = 4;
 277                 word |= halfword;
 278         }
 279         mminsn.insn = word;
 280
 281         if (get_user(halfword, pc16))
 282                 goto sigsegv;
 283         mminsn.next_pc_inc = 2;
 284         word = ((unsigned int)halfword << 16);
 285
 286         if (!mm_insn_16bit(halfword)) {
 287                 pc16++;
 288                 if (get_user(halfword, pc16))
 289                         goto sigsegv;
 290                 mminsn.next_pc_inc = 4;
 291                 word |= halfword;
 292         }
 293         mminsn.next_insn = word;
 294
 295         mm_isBranchInstr(regs, mminsn, &contpc);
 296
 297         regs->cp0_epc = contpc;
 298
 299         return 0;
 300
 301 sigsegv:
 302         force_sig(SIGSEGV, current);
 303         return -EFAULT;
 304 }
 305
 306 /*
 307  * Compute return address and emulate branch in MIPS16e mode after an
 308  * exception only. It does not handle compact branches/jumps and cannot
 309  * be used in interrupt context. (Compact branches/jumps do not cause
 310  * exceptions.)
 311  */
 312 int __MIPS16e_compute_return_epc(struct pt_regs *regs)
 313 {
 314         u16 __user *addr;
 315         union mips16e_instruction inst;
 316         u16 inst2;
 317         u32 fullinst;
 318         long epc;
 319
 320         epc = regs->cp0_epc;
 321
 322         /* Read the instruction. */
 323         addr = (u16 __user *)msk_isa16_mode(epc);
 324         if (__get_user(inst.full, addr)) {
 325                 force_sig(SIGSEGV, current);
 326                 return -EFAULT;
 327         }
 328
 329         switch (inst.ri.opcode) {
 330         case MIPS16e_extend_op:
 331                 regs->cp0_epc += 4;
 332                 return 0;
 333
 334                 /*
 335                  *  JAL and JALX in MIPS16e mode
 336                  */
 337         case MIPS16e_jal_op:
 338                 addr += 1;
 339                 if (__get_user(inst2, addr)) {
 340                         force_sig(SIGSEGV, current);
 341                         return -EFAULT;
 342                 }
 343                 fullinst = ((unsigned)inst.full << 16) | inst2;
 344                 regs->regs[31] = epc + 6;
 345                 epc += 4;
 346                 epc >>= 28;
 347                 epc <<= 28;
 348                 /*
 349                  * JAL:5 X:1 TARGET[20-16]:5 TARGET[25:21]:5 TARGET[15:0]:16
 350                  *
 351                  * ......TARGET[15:0].................TARGET[20:16]...........
 352                  * ......TARGET[25:21]
 353                  */
 354                 epc |=
 355                     ((fullinst & 0xffff) << 2) | ((fullinst & 0x3e00000) >> 3) |
 356                     ((fullinst & 0x1f0000) << 7);
 357                 if (!inst.jal.x)
 358                         set_isa16_mode(epc);    /* Set ISA mode bit. */
 359                 regs->cp0_epc = epc;
 360                 return 0;
 361
 362                 /*
 363                  *  J(AL)R(C)
 364                  */
 365         case MIPS16e_rr_op:
 366                 if (inst.rr.func == MIPS16e_jr_func) {
 367
 368                         if (inst.rr.ra)
 369                                 regs->cp0_epc = regs->regs[31];
 370                         else
 371                                 regs->cp0_epc =
 372                                     regs->regs[reg16to32[inst.rr.rx]];
 373
 374                         if (inst.rr.l) {
 375                                 if (inst.rr.nd)
 376                                         regs->regs[31] = epc + 2;
 377                                 else
 378                                         regs->regs[31] = epc + 4;
 379                         }
 380                         return 0;
 381                 }
 382                 break;
 383         }
 384
 385         /*
 386          * All other cases have no branch delay slot and are 16-bits.
 387          * Branches do not cause an exception.
 388          */
 389         regs->cp0_epc += 2;
 390
 391         return 0;
 392 }
 393
 394 /**
 395  * __compute_return_epc_for_insn - Computes the return address and do emulate
 396  *                                  branch simulation, if required.
 397  *
 398  * @regs:       Pointer to pt_regs
 399  * @insn:       branch instruction to decode
 400  * @returns:    -EFAULT on error and forces SIGBUS, and on success
 401  *              returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
 402  *              evaluating the branch.
 403  *
 404  * MIPS R6 Compact branches and forbidden slots:
 405  *      Compact branches do not throw exceptions because they do
 406  *      not have delay slots. The forbidden slot instruction ($PC+4)
 407  *      is only executed if the branch was not taken. Otherwise the
 408  *      forbidden slot is skipped entirely. This means that the
 409  *      only possible reason to be here because of a MIPS R6 compact
 410  *      branch instruction is that the forbidden slot has thrown one.
 411  *      In that case the branch was not taken, so the EPC can be safely
 412  *      set to EPC + 8.
 413  */
 414 int __compute_return_epc_for_insn(struct pt_regs *regs,
 415                                    union mips_instruction insn)
 416 {
 417         unsigned int bit, fcr31, dspcontrol, reg;
 418         long epc = regs->cp0_epc;
 419         int ret = 0;
 420
 421         switch (insn.i_format.opcode) {
 422         /*
 423          * jr and jalr are in r_format format.
 424          */
 425         case spec_op:
 426                 switch (insn.r_format.func) {
 427                 case jalr_op:
 428                         regs->regs[insn.r_format.rd] = epc + 8;
 429                         /* Fall through */
 430                 case jr_op:
 431                         if (NO_R6EMU && insn.r_format.func == jr_op)
 432                                 goto sigill_r6;
 433                         regs->cp0_epc = regs->regs[insn.r_format.rs];
 434                         break;
 435                 }
 436                 break;
 437
 438         /*
 439          * This group contains:
 440          * bltz_op, bgez_op, bltzl_op, bgezl_op,
 441          * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
 442          */
 443         case bcond_op:
 444                 switch (insn.i_format.rt) {
 445                 case bltzl_op:
 446                         if (NO_R6EMU)
 447                                 goto sigill_r6;
 448                 case bltz_op:
 449                         if ((long)regs->regs[insn.i_format.rs] < 0) {
 450                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 451                                 if (insn.i_format.rt == bltzl_op)
 452                                         ret = BRANCH_LIKELY_TAKEN;
 453                         } else
 454                                 epc += 8;
 455                         regs->cp0_epc = epc;
 456                         break;
 457
 458                 case bgezl_op:
 459                         if (NO_R6EMU)
 460                                 goto sigill_r6;
 461                 case bgez_op:
 462                         if ((long)regs->regs[insn.i_format.rs] >= 0) {
 463                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 464                                 if (insn.i_format.rt == bgezl_op)
 465                                         ret = BRANCH_LIKELY_TAKEN;
 466                         } else
 467                                 epc += 8;
 468                         regs->cp0_epc = epc;
 469                         break;
 470
 471                 case bltzal_op:
 472                 case bltzall_op:
 473                         if (NO_R6EMU && (insn.i_format.rs ||
 474                             insn.i_format.rt == bltzall_op)) {
 475                                 ret = -SIGILL;
 476                                 break;
 477                         }
 478                         regs->regs[31] = epc + 8;
 479                         /*
 480                          * OK we are here either because we hit a NAL
 481                          * instruction or because we are emulating an
 482                          * old bltzal{,l} one. Lets figure out what the
 483                          * case really is.
 484                          */
 485                         if (!insn.i_format.rs) {
 486                                 /*
 487                                  * NAL or BLTZAL with rs == 0
 488                                  * Doesn't matter if we are R6 or not. The
 489                                  * result is the same
 490                                  */
 491                                 regs->cp0_epc += 4 +
 492                                         (insn.i_format.simmediate << 2);
 493                                 break;
 494                         }
 495                         /* Now do the real thing for non-R6 BLTZAL{,L} */
 496                         if ((long)regs->regs[insn.i_format.rs] < 0) {
 497                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 498                                 if (insn.i_format.rt == bltzall_op)
 499                                         ret = BRANCH_LIKELY_TAKEN;
 500                         } else
 501                                 epc += 8;
 502                         regs->cp0_epc = epc;
 503                         break;
 504
 505                 case bgezal_op:
 506                 case bgezall_op:
 507                         if (NO_R6EMU && (insn.i_format.rs ||
 508                             insn.i_format.rt == bgezall_op)) {
 509                                 ret = -SIGILL;
 510                                 break;
 511                         }
 512                         regs->regs[31] = epc + 8;
 513                         /*
 514                          * OK we are here either because we hit a BAL
 515                          * instruction or because we are emulating an
 516                          * old bgezal{,l} one. Lets figure out what the
 517                          * case really is.
 518                          */
 519                         if (!insn.i_format.rs) {
 520                                 /*
 521                                  * BAL or BGEZAL with rs == 0
 522                                  * Doesn't matter if we are R6 or not. The
 523                                  * result is the same
 524                                  */
 525                                 regs->cp0_epc += 4 +
 526                                         (insn.i_format.simmediate << 2);
 527                                 break;
 528                         }
 529                         /* Now do the real thing for non-R6 BGEZAL{,L} */
 530                         if ((long)regs->regs[insn.i_format.rs] >= 0) {
 531                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 532                                 if (insn.i_format.rt == bgezall_op)
 533                                         ret = BRANCH_LIKELY_TAKEN;
 534                         } else
 535                                 epc += 8;
 536                         regs->cp0_epc = epc;
 537                         break;
 538
 539                 case bposge32_op:
 540                         if (!cpu_has_dsp)
 541                                 goto sigill_dsp;
 542
 543                         dspcontrol = rddsp(0x01);
 544
 545                         if (dspcontrol >= 32) {
 546                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
 547                         } else
 548                                 epc += 8;
 549                         regs->cp0_epc = epc;
 550                         break;
 551                 }
 552                 break;
 553
 554         /*
 555          * These are unconditional and in j_format.
 556          */
 557         case jal_op:
 558                 regs->regs[31] = regs->cp0_epc + 8;
 559         case j_op:
 560                 epc += 4;
 561                 epc >>= 28;
 562                 epc <<= 28;
 563                 epc |= (insn.j_format.target << 2);
 564                 regs->cp0_epc = epc;
 565                 if (insn.i_format.opcode == jalx_op)
 566                         set_isa16_mode(regs->cp0_epc);
 567                 break;
 568
 569         /*
 570          * These are conditional and in i_format.
 571          */
 572         case beql_op:
 573                 if (NO_R6EMU)
 574                         goto sigill_r6;
 575         case beq_op:
 576                 if (regs->regs[insn.i_format.rs] ==
 577                     regs->regs[insn.i_format.rt]) {
 578                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 579                         if (insn.i_format.opcode == beql_op)
 580                                 ret = BRANCH_LIKELY_TAKEN;
 581                 } else
 582                         epc += 8;
 583                 regs->cp0_epc = epc;
 584                 break;
 585
 586         case bnel_op:
 587                 if (NO_R6EMU)
 588                         goto sigill_r6;
 589         case bne_op:
 590                 if (regs->regs[insn.i_format.rs] !=
 591                     regs->regs[insn.i_format.rt]) {
 592                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 593                         if (insn.i_format.opcode == bnel_op)
 594                                 ret = BRANCH_LIKELY_TAKEN;
 595                 } else
 596                         epc += 8;
 597                 regs->cp0_epc = epc;
 598                 break;
 599
 600         case blezl_op: /* not really i_format */
 601                 if (NO_R6EMU)
 602                         goto sigill_r6;
 603         case blez_op:
 604                 /*
 605                  * Compact branches for R6 for the
 606                  * blez and blezl opcodes.
 607                  * BLEZ  | rs = 0 | rt != 0  == BLEZALC
 608                  * BLEZ  | rs = rt != 0      == BGEZALC
 609                  * BLEZ  | rs != 0 | rt != 0 == BGEUC
 610                  * BLEZL | rs = 0 | rt != 0  == BLEZC
 611                  * BLEZL | rs = rt != 0      == BGEZC
 612                  * BLEZL | rs != 0 | rt != 0 == BGEC
 613                  *
 614                  * For real BLEZ{,L}, rt is always 0.
 615                  */
 616
 617                 if (cpu_has_mips_r6 && insn.i_format.rt) {
 618                         if ((insn.i_format.opcode == blez_op) &&
 619                             ((!insn.i_format.rs && insn.i_format.rt) ||
 620                              (insn.i_format.rs == insn.i_format.rt)))
 621                                 regs->regs[31] = epc + 4;
 622                         regs->cp0_epc += 8;
 623                         break;
 624                 }
 625                 /* rt field assumed to be zero */
 626                 if ((long)regs->regs[insn.i_format.rs] <= 0) {
 627                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 628                         if (insn.i_format.opcode == blezl_op)
 629                                 ret = BRANCH_LIKELY_TAKEN;
 630                 } else
 631                         epc += 8;
 632                 regs->cp0_epc = epc;
 633                 break;
 634
 635         case bgtzl_op:
 636                 if (NO_R6EMU)
 637                         goto sigill_r6;
 638         case bgtz_op:
 639                 /*
 640                  * Compact branches for R6 for the
 641                  * bgtz and bgtzl opcodes.
 642                  * BGTZ  | rs = 0 | rt != 0  == BGTZALC
 643                  * BGTZ  | rs = rt != 0      == BLTZALC
 644                  * BGTZ  | rs != 0 | rt != 0 == BLTUC
 645                  * BGTZL | rs = 0 | rt != 0  == BGTZC
 646                  * BGTZL | rs = rt != 0      == BLTZC
 647                  * BGTZL | rs != 0 | rt != 0 == BLTC
 648                  *
 649                  * *ZALC varint for BGTZ &&& rt != 0
 650                  * For real GTZ{,L}, rt is always 0.
 651                  */
 652                 if (cpu_has_mips_r6 && insn.i_format.rt) {
 653                         if ((insn.i_format.opcode == blez_op) &&
 654                             ((!insn.i_format.rs && insn.i_format.rt) ||
 655                             (insn.i_format.rs == insn.i_format.rt)))
 656                                 regs->regs[31] = epc + 4;
 657                         regs->cp0_epc += 8;
 658                         break;
 659                 }
 660
 661                 /* rt field assumed to be zero */
 662                 if ((long)regs->regs[insn.i_format.rs] > 0) {
 663                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 664                         if (insn.i_format.opcode == bgtzl_op)
 665                                 ret = BRANCH_LIKELY_TAKEN;
 666                 } else
 667                         epc += 8;
 668                 regs->cp0_epc = epc;
 669                 break;
 670
 671         /*
 672          * And now the FPA/cp1 branch instructions.
 673          */
 674         case cop1_op:
 675                 if (cpu_has_mips_r6 &&
 676                     ((insn.i_format.rs == bc1eqz_op) ||
 677                      (insn.i_format.rs == bc1nez_op))) {
 678                         if (!used_math()) { /* First time FPU user */
 679                                 ret = init_fpu();
 680                                 if (ret && NO_R6EMU) {
 681                                         ret = -ret;
 682                                         break;
 683                                 }
 684                                 ret = 0;
 685                                 set_used_math();
 686                         }
 687                         lose_fpu(1);    /* Save FPU state for the emulator. */
 688                         reg = insn.i_format.rt;
 689                         bit = 0;
 690                         switch (insn.i_format.rs) {
 691                         case bc1eqz_op:
 692                                 /* Test bit 0 */
 693                                 if (get_fpr32(&current->thread.fpu.fpr[reg], 0)
 694                                     & 0x1)
 695                                         bit = 1;
 696                                 break;
 697                         case bc1nez_op:
 698                                 /* Test bit 0 */
 699                                 if (!(get_fpr32(&current->thread.fpu.fpr[reg], 0)
 700                                       & 0x1))
 701                                         bit = 1;
 702                                 break;
 703                         }
 704                         own_fpu(1);
 705                         if (bit)
 706                                 epc = epc + 4 +
 707                                         (insn.i_format.simmediate << 2);
 708                         else
 709                                 epc += 8;
 710                         regs->cp0_epc = epc;
 711
 712                         break;
 713                 } else {
 714
 715                         preempt_disable();
 716                         if (is_fpu_owner())
 717                                 fcr31 = read_32bit_cp1_register(CP1_STATUS);
 718                         else
 719                                 fcr31 = current->thread.fpu.fcr31;
 720                         preempt_enable();
 721
 722                         bit = (insn.i_format.rt >> 2);
 723                         bit += (bit != 0);
 724                         bit += 23;
 725                         switch (insn.i_format.rt & 3) {
 726                         case 0: /* bc1f */
 727                         case 2: /* bc1fl */
 728                                 if (~fcr31 & (1 << bit)) {
 729                                         epc = epc + 4 +
 730                                                 (insn.i_format.simmediate << 2);
 731                                         if (insn.i_format.rt == 2)
 732                                                 ret = BRANCH_LIKELY_TAKEN;
 733                                 } else
 734                                         epc += 8;
 735                                 regs->cp0_epc = epc;
 736                                 break;
 737
 738                         case 1: /* bc1t */
 739                         case 3: /* bc1tl */
 740                                 if (fcr31 & (1 << bit)) {
 741                                         epc = epc + 4 +
 742                                                 (insn.i_format.simmediate << 2);
 743                                         if (insn.i_format.rt == 3)
 744                                                 ret = BRANCH_LIKELY_TAKEN;
 745                                 } else
 746                                         epc += 8;
 747                                 regs->cp0_epc = epc;
 748                                 break;
 749                         }
 750                         break;
 751                 }
 752 #ifdef CONFIG_CPU_CAVIUM_OCTEON
 753         case lwc2_op: /* This is bbit0 on Octeon */
 754                 if ((regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
 755                      == 0)
 756                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 757                 else
 758                         epc += 8;
 759                 regs->cp0_epc = epc;
 760                 break;
 761         case ldc2_op: /* This is bbit032 on Octeon */
 762                 if ((regs->regs[insn.i_format.rs] &
 763                     (1ull<<(insn.i_format.rt+32))) == 0)
 764                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 765                 else
 766                         epc += 8;
 767                 regs->cp0_epc = epc;
 768                 break;
 769         case swc2_op: /* This is bbit1 on Octeon */
 770                 if (regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
 771                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 772                 else
 773                         epc += 8;
 774                 regs->cp0_epc = epc;
 775                 break;
 776         case sdc2_op: /* This is bbit132 on Octeon */
 777                 if (regs->regs[insn.i_format.rs] &
 778                     (1ull<<(insn.i_format.rt+32)))
 779                         epc = epc + 4 + (insn.i_format.simmediate << 2);
 780                 else
 781                         epc += 8;
 782                 regs->cp0_epc = epc;
 783                 break;
 784 #else
 785         case bc6_op:
 786                 /* Only valid for MIPS R6 */
 787                 if (!cpu_has_mips_r6) {
 788                         ret = -SIGILL;
 789                         break;
 790                 }
 791                 regs->cp0_epc += 8;
 792                 break;
 793         case balc6_op:
 794                 if (!cpu_has_mips_r6) {
 795                         ret = -SIGILL;
 796                         break;
 797                 }
 798                 /* Compact branch: BALC */
 799                 regs->regs[31] = epc + 4;
 800                 epc += 4 + (insn.i_format.simmediate << 2);
 801                 regs->cp0_epc = epc;
 802                 break;
 803         case beqzcjic_op:
 804                 if (!cpu_has_mips_r6) {
 805                         ret = -SIGILL;
 806                         break;
 807                 }
 808                 /* Compact branch: BEQZC || JIC */
 809                 regs->cp0_epc += 8;
 810                 break;
 811         case bnezcjialc_op:
 812                 if (!cpu_has_mips_r6) {
 813                         ret = -SIGILL;
 814                         break;
 815                 }
 816                 /* Compact branch: BNEZC || JIALC */
 817                 if (insn.i_format.rs)
 818                         regs->regs[31] = epc + 4;
 819                 regs->cp0_epc += 8;
 820                 break;
 821 #endif
 822         case cbcond0_op:
 823         case cbcond1_op:
 824                 /* Only valid for MIPS R6 */
 825                 if (!cpu_has_mips_r6) {
 826                         ret = -SIGILL;
 827                         break;
 828                 }
 829                 /*
 830                  * Compact branches:
 831                  * bovc, beqc, beqzalc, bnvc, bnec, bnezlac
 832                  */
 833                 if (insn.i_format.rt && !insn.i_format.rs)
 834                         regs->regs[31] = epc + 4;
 835                 regs->cp0_epc += 8;
 836                 break;
 837         }
 838
 839         return ret;
 840
 841 sigill_dsp:
 842         printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm);
 843         force_sig(SIGBUS, current);
 844         return -EFAULT;
 845 sigill_r6:
 846         pr_info("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n",
 847                 current->comm);
 848         force_sig(SIGILL, current);
 849         return -EFAULT;
 850 }
 851 EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn);
 852
 853 int __compute_return_epc(struct pt_regs *regs)
 854 {
 855         unsigned int __user *addr;
 856         long epc;
 857         union mips_instruction insn;
 858
 859         epc = regs->cp0_epc;
 860         if (epc & 3)
 861                 goto unaligned;
 862
 863         /*
 864          * Read the instruction
 865          */
 866         addr = (unsigned int __user *) epc;
 867         if (__get_user(insn.word, addr)) {
 868                 force_sig(SIGSEGV, current);
 869                 return -EFAULT;
 870         }
 871
 872         return __compute_return_epc_for_insn(regs, insn);
 873
 874 unaligned:
 875         printk("%s: unaligned epc - sending SIGBUS.\n", current->comm);
 876         force_sig(SIGBUS, current);
 877         return -EFAULT;
 878 }