2 * This file is subject to the terms and conditions of the GNU General Public
3 * License. See the file "COPYING" in the main directory of this archive
6 * Copyright (C) 1996, 97, 2000, 2001 by Ralf Baechle
7 * Copyright (C) 2001 MIPS Technologies, Inc.
9 #include <linux/kernel.h>
10 #include <linux/sched/signal.h>
11 #include <linux/signal.h>
12 #include <linux/export.h>
13 #include <asm/branch.h>
15 #include <asm/cpu-features.h>
17 #include <asm/fpu_emulator.h>
19 #include <asm/mips-r2-to-r6-emul.h>
20 #include <asm/ptrace.h>
21 #include <linux/uaccess.h>
24 * Calculate and return exception PC in case of branch delay slot
25 * for microMIPS and MIPS16e. It does not clear the ISA mode bit.
27 int __isa_exception_epc(struct pt_regs
*regs
)
30 long epc
= regs
->cp0_epc
;
32 /* Calculate exception PC in branch delay slot. */
33 if (__get_user(inst
, (u16 __user
*) msk_isa16_mode(epc
))) {
34 /* This should never happen because delay slot was checked. */
35 force_sig(SIGSEGV
, current
);
39 union mips16e_instruction inst_mips16e
;
41 inst_mips16e
.full
= inst
;
42 if (inst_mips16e
.ri
.opcode
== MIPS16e_jal_op
)
46 } else if (mm_insn_16bit(inst
))
54 /* (microMIPS) Convert 16-bit register encoding to 32-bit register encoding. */
55 static const unsigned int reg16to32map
[8] = {16, 17, 2, 3, 4, 5, 6, 7};
57 int __mm_isBranchInstr(struct pt_regs
*regs
, struct mm_decoded_insn dec_insn
,
58 unsigned long *contpc
)
60 union mips_instruction insn
= (union mips_instruction
)dec_insn
.insn
;
68 switch (insn
.mm_i_format
.opcode
) {
70 if ((insn
.mm_i_format
.simmediate
& MM_POOL32A_MINOR_MASK
) ==
72 switch (insn
.mm_i_format
.simmediate
>>
73 MM_POOL32A_MINOR_SHIFT
) {
78 if (insn
.mm_i_format
.rt
!= 0) /* Not mm_jr */
79 regs
->regs
[insn
.mm_i_format
.rt
] =
83 *contpc
= regs
->regs
[insn
.mm_i_format
.rs
];
89 switch (insn
.mm_i_format
.rt
) {
92 regs
->regs
[31] = regs
->cp0_epc
+
97 if ((long)regs
->regs
[insn
.mm_i_format
.rs
] < 0)
98 *contpc
= regs
->cp0_epc
+
100 (insn
.mm_i_format
.simmediate
<< 1);
102 *contpc
= regs
->cp0_epc
+
104 dec_insn
.next_pc_inc
;
108 regs
->regs
[31] = regs
->cp0_epc
+
110 dec_insn
.next_pc_inc
;
113 if ((long)regs
->regs
[insn
.mm_i_format
.rs
] >= 0)
114 *contpc
= regs
->cp0_epc
+
116 (insn
.mm_i_format
.simmediate
<< 1);
118 *contpc
= regs
->cp0_epc
+
120 dec_insn
.next_pc_inc
;
123 if ((long)regs
->regs
[insn
.mm_i_format
.rs
] <= 0)
124 *contpc
= regs
->cp0_epc
+
126 (insn
.mm_i_format
.simmediate
<< 1);
128 *contpc
= regs
->cp0_epc
+
130 dec_insn
.next_pc_inc
;
133 if ((long)regs
->regs
[insn
.mm_i_format
.rs
] <= 0)
134 *contpc
= regs
->cp0_epc
+
136 (insn
.mm_i_format
.simmediate
<< 1);
138 *contpc
= regs
->cp0_epc
+
140 dec_insn
.next_pc_inc
;
150 fcr31
= read_32bit_cp1_register(CP1_STATUS
);
152 fcr31
= current
->thread
.fpu
.fcr31
;
158 bit
= (insn
.mm_i_format
.rs
>> 2);
161 if (fcr31
& (1 << bit
))
162 *contpc
= regs
->cp0_epc
+
164 (insn
.mm_i_format
.simmediate
<< 1);
166 *contpc
= regs
->cp0_epc
+
167 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
172 switch (insn
.mm_i_format
.rt
) {
175 regs
->regs
[31] = regs
->cp0_epc
+
176 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
179 *contpc
= regs
->regs
[insn
.mm_i_format
.rs
];
184 if ((long)regs
->regs
[reg16to32map
[insn
.mm_b1_format
.rs
]] == 0)
185 *contpc
= regs
->cp0_epc
+
187 (insn
.mm_b1_format
.simmediate
<< 1);
189 *contpc
= regs
->cp0_epc
+
190 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
193 if ((long)regs
->regs
[reg16to32map
[insn
.mm_b1_format
.rs
]] != 0)
194 *contpc
= regs
->cp0_epc
+
196 (insn
.mm_b1_format
.simmediate
<< 1);
198 *contpc
= regs
->cp0_epc
+
199 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
202 *contpc
= regs
->cp0_epc
+ dec_insn
.pc_inc
+
203 (insn
.mm_b0_format
.simmediate
<< 1);
206 if (regs
->regs
[insn
.mm_i_format
.rs
] ==
207 regs
->regs
[insn
.mm_i_format
.rt
])
208 *contpc
= regs
->cp0_epc
+
210 (insn
.mm_i_format
.simmediate
<< 1);
212 *contpc
= regs
->cp0_epc
+
214 dec_insn
.next_pc_inc
;
217 if (regs
->regs
[insn
.mm_i_format
.rs
] !=
218 regs
->regs
[insn
.mm_i_format
.rt
])
219 *contpc
= regs
->cp0_epc
+
221 (insn
.mm_i_format
.simmediate
<< 1);
223 *contpc
= regs
->cp0_epc
+
224 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
227 regs
->regs
[31] = regs
->cp0_epc
+
228 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
229 *contpc
= regs
->cp0_epc
+ dec_insn
.pc_inc
;
232 *contpc
|= (insn
.j_format
.target
<< 2);
236 regs
->regs
[31] = regs
->cp0_epc
+
237 dec_insn
.pc_inc
+ dec_insn
.next_pc_inc
;
240 *contpc
= regs
->cp0_epc
+ dec_insn
.pc_inc
;
243 *contpc
|= (insn
.j_format
.target
<< 1);
244 set_isa16_mode(*contpc
);
251 * Compute return address and emulate branch in microMIPS mode after an
252 * exception only. It does not handle compact branches/jumps and cannot
253 * be used in interrupt context. (Compact branches/jumps do not cause
256 int __microMIPS_compute_return_epc(struct pt_regs
*regs
)
261 unsigned long contpc
;
262 struct mm_decoded_insn mminsn
= { 0 };
264 mminsn
.micro_mips_mode
= 1;
266 /* This load never faults. */
267 pc16
= (unsigned short __user
*)msk_isa16_mode(regs
->cp0_epc
);
268 __get_user(halfword
, pc16
);
270 contpc
= regs
->cp0_epc
+ 2;
271 word
= ((unsigned int)halfword
<< 16);
274 if (!mm_insn_16bit(halfword
)) {
275 __get_user(halfword
, pc16
);
277 contpc
= regs
->cp0_epc
+ 4;
283 if (get_user(halfword
, pc16
))
285 mminsn
.next_pc_inc
= 2;
286 word
= ((unsigned int)halfword
<< 16);
288 if (!mm_insn_16bit(halfword
)) {
290 if (get_user(halfword
, pc16
))
292 mminsn
.next_pc_inc
= 4;
295 mminsn
.next_insn
= word
;
297 mm_isBranchInstr(regs
, mminsn
, &contpc
);
299 regs
->cp0_epc
= contpc
;
304 force_sig(SIGSEGV
, current
);
309 * Compute return address and emulate branch in MIPS16e mode after an
310 * exception only. It does not handle compact branches/jumps and cannot
311 * be used in interrupt context. (Compact branches/jumps do not cause
314 int __MIPS16e_compute_return_epc(struct pt_regs
*regs
)
317 union mips16e_instruction inst
;
324 /* Read the instruction. */
325 addr
= (u16 __user
*)msk_isa16_mode(epc
);
326 if (__get_user(inst
.full
, addr
)) {
327 force_sig(SIGSEGV
, current
);
331 switch (inst
.ri
.opcode
) {
332 case MIPS16e_extend_op
:
337 * JAL and JALX in MIPS16e mode
341 if (__get_user(inst2
, addr
)) {
342 force_sig(SIGSEGV
, current
);
345 fullinst
= ((unsigned)inst
.full
<< 16) | inst2
;
346 regs
->regs
[31] = epc
+ 6;
351 * JAL:5 X:1 TARGET[20-16]:5 TARGET[25:21]:5 TARGET[15:0]:16
353 * ......TARGET[15:0].................TARGET[20:16]...........
354 * ......TARGET[25:21]
357 ((fullinst
& 0xffff) << 2) | ((fullinst
& 0x3e00000) >> 3) |
358 ((fullinst
& 0x1f0000) << 7);
360 set_isa16_mode(epc
); /* Set ISA mode bit. */
368 if (inst
.rr
.func
== MIPS16e_jr_func
) {
371 regs
->cp0_epc
= regs
->regs
[31];
374 regs
->regs
[reg16to32
[inst
.rr
.rx
]];
378 regs
->regs
[31] = epc
+ 2;
380 regs
->regs
[31] = epc
+ 4;
388 * All other cases have no branch delay slot and are 16-bits.
389 * Branches do not cause an exception.
397 * __compute_return_epc_for_insn - Computes the return address and do emulate
398 * branch simulation, if required.
400 * @regs: Pointer to pt_regs
401 * @insn: branch instruction to decode
402 * Return: -EFAULT on error and forces SIGILL, and on success
403 * returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
404 * evaluating the branch.
406 * MIPS R6 Compact branches and forbidden slots:
407 * Compact branches do not throw exceptions because they do
408 * not have delay slots. The forbidden slot instruction ($PC+4)
409 * is only executed if the branch was not taken. Otherwise the
410 * forbidden slot is skipped entirely. This means that the
411 * only possible reason to be here because of a MIPS R6 compact
412 * branch instruction is that the forbidden slot has thrown one.
413 * In that case the branch was not taken, so the EPC can be safely
416 int __compute_return_epc_for_insn(struct pt_regs
*regs
,
417 union mips_instruction insn
)
419 unsigned int bit
, fcr31
, dspcontrol
, reg
;
420 long epc
= regs
->cp0_epc
;
423 switch (insn
.i_format
.opcode
) {
425 * jr and jalr are in r_format format.
428 switch (insn
.r_format
.func
) {
430 regs
->regs
[insn
.r_format
.rd
] = epc
+ 8;
433 if (NO_R6EMU
&& insn
.r_format
.func
== jr_op
)
435 regs
->cp0_epc
= regs
->regs
[insn
.r_format
.rs
];
441 * This group contains:
442 * bltz_op, bgez_op, bltzl_op, bgezl_op,
443 * bltzal_op, bgezal_op, bltzall_op, bgezall_op.
446 switch (insn
.i_format
.rt
) {
451 if ((long)regs
->regs
[insn
.i_format
.rs
] < 0) {
452 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
453 if (insn
.i_format
.rt
== bltzl_op
)
454 ret
= BRANCH_LIKELY_TAKEN
;
464 if ((long)regs
->regs
[insn
.i_format
.rs
] >= 0) {
465 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
466 if (insn
.i_format
.rt
== bgezl_op
)
467 ret
= BRANCH_LIKELY_TAKEN
;
475 if (NO_R6EMU
&& (insn
.i_format
.rs
||
476 insn
.i_format
.rt
== bltzall_op
))
478 regs
->regs
[31] = epc
+ 8;
480 * OK we are here either because we hit a NAL
481 * instruction or because we are emulating an
482 * old bltzal{,l} one. Let's figure out what the
485 if (!insn
.i_format
.rs
) {
487 * NAL or BLTZAL with rs == 0
488 * Doesn't matter if we are R6 or not. The
492 (insn
.i_format
.simmediate
<< 2);
495 /* Now do the real thing for non-R6 BLTZAL{,L} */
496 if ((long)regs
->regs
[insn
.i_format
.rs
] < 0) {
497 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
498 if (insn
.i_format
.rt
== bltzall_op
)
499 ret
= BRANCH_LIKELY_TAKEN
;
507 if (NO_R6EMU
&& (insn
.i_format
.rs
||
508 insn
.i_format
.rt
== bgezall_op
))
510 regs
->regs
[31] = epc
+ 8;
512 * OK we are here either because we hit a BAL
513 * instruction or because we are emulating an
514 * old bgezal{,l} one. Let's figure out what the
517 if (!insn
.i_format
.rs
) {
519 * BAL or BGEZAL with rs == 0
520 * Doesn't matter if we are R6 or not. The
524 (insn
.i_format
.simmediate
<< 2);
527 /* Now do the real thing for non-R6 BGEZAL{,L} */
528 if ((long)regs
->regs
[insn
.i_format
.rs
] >= 0) {
529 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
530 if (insn
.i_format
.rt
== bgezall_op
)
531 ret
= BRANCH_LIKELY_TAKEN
;
541 dspcontrol
= rddsp(0x01);
543 if (dspcontrol
>= 32) {
544 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
553 * These are unconditional and in j_format.
557 regs
->regs
[31] = regs
->cp0_epc
+ 8;
562 epc
|= (insn
.j_format
.target
<< 2);
564 if (insn
.i_format
.opcode
== jalx_op
)
565 set_isa16_mode(regs
->cp0_epc
);
569 * These are conditional and in i_format.
575 if (regs
->regs
[insn
.i_format
.rs
] ==
576 regs
->regs
[insn
.i_format
.rt
]) {
577 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
578 if (insn
.i_format
.opcode
== beql_op
)
579 ret
= BRANCH_LIKELY_TAKEN
;
589 if (regs
->regs
[insn
.i_format
.rs
] !=
590 regs
->regs
[insn
.i_format
.rt
]) {
591 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
592 if (insn
.i_format
.opcode
== bnel_op
)
593 ret
= BRANCH_LIKELY_TAKEN
;
599 case blezl_op
: /* not really i_format */
600 if (!insn
.i_format
.rt
&& NO_R6EMU
)
604 * Compact branches for R6 for the
605 * blez and blezl opcodes.
606 * BLEZ | rs = 0 | rt != 0 == BLEZALC
607 * BLEZ | rs = rt != 0 == BGEZALC
608 * BLEZ | rs != 0 | rt != 0 == BGEUC
609 * BLEZL | rs = 0 | rt != 0 == BLEZC
610 * BLEZL | rs = rt != 0 == BGEZC
611 * BLEZL | rs != 0 | rt != 0 == BGEC
613 * For real BLEZ{,L}, rt is always 0.
616 if (cpu_has_mips_r6
&& insn
.i_format
.rt
) {
617 if ((insn
.i_format
.opcode
== blez_op
) &&
618 ((!insn
.i_format
.rs
&& insn
.i_format
.rt
) ||
619 (insn
.i_format
.rs
== insn
.i_format
.rt
)))
620 regs
->regs
[31] = epc
+ 4;
624 /* rt field assumed to be zero */
625 if ((long)regs
->regs
[insn
.i_format
.rs
] <= 0) {
626 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
627 if (insn
.i_format
.opcode
== blezl_op
)
628 ret
= BRANCH_LIKELY_TAKEN
;
635 if (!insn
.i_format
.rt
&& NO_R6EMU
)
639 * Compact branches for R6 for the
640 * bgtz and bgtzl opcodes.
641 * BGTZ | rs = 0 | rt != 0 == BGTZALC
642 * BGTZ | rs = rt != 0 == BLTZALC
643 * BGTZ | rs != 0 | rt != 0 == BLTUC
644 * BGTZL | rs = 0 | rt != 0 == BGTZC
645 * BGTZL | rs = rt != 0 == BLTZC
646 * BGTZL | rs != 0 | rt != 0 == BLTC
648 * *ZALC varint for BGTZ &&& rt != 0
649 * For real GTZ{,L}, rt is always 0.
651 if (cpu_has_mips_r6
&& insn
.i_format
.rt
) {
652 if ((insn
.i_format
.opcode
== blez_op
) &&
653 ((!insn
.i_format
.rs
&& insn
.i_format
.rt
) ||
654 (insn
.i_format
.rs
== insn
.i_format
.rt
)))
655 regs
->regs
[31] = epc
+ 4;
660 /* rt field assumed to be zero */
661 if ((long)regs
->regs
[insn
.i_format
.rs
] > 0) {
662 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
663 if (insn
.i_format
.opcode
== bgtzl_op
)
664 ret
= BRANCH_LIKELY_TAKEN
;
671 * And now the FPA/cp1 branch instructions.
674 if (cpu_has_mips_r6
&&
675 ((insn
.i_format
.rs
== bc1eqz_op
) ||
676 (insn
.i_format
.rs
== bc1nez_op
))) {
677 if (!used_math()) { /* First time FPU user */
679 if (ret
&& NO_R6EMU
) {
686 lose_fpu(1); /* Save FPU state for the emulator. */
687 reg
= insn
.i_format
.rt
;
688 bit
= get_fpr32(¤t
->thread
.fpu
.fpr
[reg
], 0) & 0x1;
689 if (insn
.i_format
.rs
== bc1eqz_op
)
694 (insn
.i_format
.simmediate
<< 2);
704 fcr31
= read_32bit_cp1_register(CP1_STATUS
);
706 fcr31
= current
->thread
.fpu
.fcr31
;
709 bit
= (insn
.i_format
.rt
>> 2);
712 switch (insn
.i_format
.rt
& 3) {
715 if (~fcr31
& (1 << bit
)) {
717 (insn
.i_format
.simmediate
<< 2);
718 if (insn
.i_format
.rt
== 2)
719 ret
= BRANCH_LIKELY_TAKEN
;
727 if (fcr31
& (1 << bit
)) {
729 (insn
.i_format
.simmediate
<< 2);
730 if (insn
.i_format
.rt
== 3)
731 ret
= BRANCH_LIKELY_TAKEN
;
739 #ifdef CONFIG_CPU_CAVIUM_OCTEON
740 case lwc2_op
: /* This is bbit0 on Octeon */
741 if ((regs
->regs
[insn
.i_format
.rs
] & (1ull<<insn
.i_format
.rt
))
743 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
748 case ldc2_op
: /* This is bbit032 on Octeon */
749 if ((regs
->regs
[insn
.i_format
.rs
] &
750 (1ull<<(insn
.i_format
.rt
+32))) == 0)
751 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
756 case swc2_op
: /* This is bbit1 on Octeon */
757 if (regs
->regs
[insn
.i_format
.rs
] & (1ull<<insn
.i_format
.rt
))
758 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
763 case sdc2_op
: /* This is bbit132 on Octeon */
764 if (regs
->regs
[insn
.i_format
.rs
] &
765 (1ull<<(insn
.i_format
.rt
+32)))
766 epc
= epc
+ 4 + (insn
.i_format
.simmediate
<< 2);
773 /* Only valid for MIPS R6 */
774 if (!cpu_has_mips_r6
)
779 if (!cpu_has_mips_r6
)
781 /* Compact branch: BALC */
782 regs
->regs
[31] = epc
+ 4;
783 epc
+= 4 + (insn
.i_format
.simmediate
<< 2);
787 if (!cpu_has_mips_r6
)
789 /* Compact branch: BEQZC || JIC */
793 if (!cpu_has_mips_r6
)
795 /* Compact branch: BNEZC || JIALC */
796 if (!insn
.i_format
.rs
) {
797 /* JIALC: set $31/ra */
798 regs
->regs
[31] = epc
+ 4;
805 /* Only valid for MIPS R6 */
806 if (!cpu_has_mips_r6
)
810 * bovc, beqc, beqzalc, bnvc, bnec, bnezlac
812 if (insn
.i_format
.rt
&& !insn
.i_format
.rs
)
813 regs
->regs
[31] = epc
+ 4;
821 pr_debug("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
823 force_sig(SIGILL
, current
);
826 pr_debug("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n",
828 force_sig(SIGILL
, current
);
831 pr_debug("%s: R6 branch but no MIPSr6 ISA support - sending SIGILL.\n",
833 force_sig(SIGILL
, current
);
836 EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn
);
838 int __compute_return_epc(struct pt_regs
*regs
)
840 unsigned int __user
*addr
;
842 union mips_instruction insn
;
849 * Read the instruction
851 addr
= (unsigned int __user
*) epc
;
852 if (__get_user(insn
.word
, addr
)) {
853 force_sig(SIGSEGV
, current
);
857 return __compute_return_epc_for_insn(regs
, insn
);
860 printk("%s: unaligned epc - sending SIGBUS.\n", current
->comm
);
861 force_sig(SIGBUS
, current
);
865 #if (defined CONFIG_KPROBES) || (defined CONFIG_UPROBES)
867 int __insn_is_compact_branch(union mips_instruction insn
)
869 if (!cpu_has_mips_r6
)
872 switch (insn
.i_format
.opcode
) {
878 * blez[l] and bgtz[l] opcodes with non-zero rt
879 * are MIPS R6 compact branches
881 if (insn
.i_format
.rt
)
895 EXPORT_SYMBOL_GPL(__insn_is_compact_branch
);
897 #endif /* CONFIG_KPROBES || CONFIG_UPROBES */