1 /* 2 * BPF Jit compiler for s390. 3 * 4 * Copyright IBM Corp. 2012 5 * 6 * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com> 7 */ 8 #include <linux/moduleloader.h> 9 #include <linux/netdevice.h> 10 #include <linux/filter.h> 11 #include <asm/cacheflush.h> 12 #include <asm/processor.h> 13 #include <asm/facility.h> 14 15 /* 16 * Conventions: 17 * %r2 = skb pointer 18 * %r3 = offset parameter 19 * %r4 = scratch register / length parameter 20 * %r5 = BPF A accumulator 21 * %r8 = return address 22 * %r9 = save register for skb pointer 23 * %r10 = skb->data 24 * %r11 = skb->len - skb->data_len (headlen) 25 * %r12 = BPF X accumulator 26 * %r13 = literal pool pointer 27 * 0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS 28 */ 29 int bpf_jit_enable __read_mostly; 30 31 /* 32 * assembly code in arch/x86/net/bpf_jit.S 33 */ 34 extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[]; 35 extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[]; 36 37 struct bpf_jit { 38 unsigned int seen; 39 u8 *start; 40 u8 *prg; 41 u8 *mid; 42 u8 *lit; 43 u8 *end; 44 u8 *base_ip; 45 u8 *ret0_ip; 46 u8 *exit_ip; 47 unsigned int off_load_word; 48 unsigned int off_load_half; 49 unsigned int off_load_byte; 50 unsigned int off_load_bmsh; 51 unsigned int off_load_iword; 52 unsigned int off_load_ihalf; 53 unsigned int off_load_ibyte; 54 }; 55 56 #define BPF_SIZE_MAX 4096 /* Max size for program */ 57 58 #define SEEN_DATAREF 1 /* might call external helpers */ 59 #define SEEN_XREG 2 /* ebx is used */ 60 #define SEEN_MEM 4 /* use mem[] for temporary storage */ 61 #define SEEN_RET0 8 /* pc_ret0 points to a valid return 0 */ 62 #define SEEN_LITERAL 16 /* code uses literals */ 63 #define SEEN_LOAD_WORD 32 /* code uses sk_load_word */ 64 #define SEEN_LOAD_HALF 64 /* code uses sk_load_half */ 65 #define SEEN_LOAD_BYTE 128 /* code uses sk_load_byte */ 66 #define SEEN_LOAD_BMSH 256 /* code uses sk_load_byte_msh */ 67 #define SEEN_LOAD_IWORD 512 /* code uses sk_load_word_ind */ 68 #define SEEN_LOAD_IHALF 1024 /* code uses sk_load_half_ind */ 69 #define SEEN_LOAD_IBYTE 2048 /* code uses sk_load_byte_ind */ 70 71 #define EMIT2(op) \ 72 ({ \ 73 if (jit->prg + 2 <= jit->mid) \ 74 *(u16 *) jit->prg = op; \ 75 jit->prg += 2; \ 76 }) 77 78 #define EMIT4(op) \ 79 ({ \ 80 if (jit->prg + 4 <= jit->mid) \ 81 *(u32 *) jit->prg = op; \ 82 jit->prg += 4; \ 83 }) 84 85 #define EMIT4_DISP(op, disp) \ 86 ({ \ 87 unsigned int __disp = (disp) & 0xfff; \ 88 EMIT4(op | __disp); \ 89 }) 90 91 #define EMIT4_IMM(op, imm) \ 92 ({ \ 93 unsigned int __imm = (imm) & 0xffff; \ 94 EMIT4(op | __imm); \ 95 }) 96 97 #define EMIT4_PCREL(op, pcrel) \ 98 ({ \ 99 long __pcrel = ((pcrel) >> 1) & 0xffff; \ 100 EMIT4(op | __pcrel); \ 101 }) 102 103 #define EMIT6(op1, op2) \ 104 ({ \ 105 if (jit->prg + 6 <= jit->mid) { \ 106 *(u32 *) jit->prg = op1; \ 107 *(u16 *) (jit->prg + 4) = op2; \ 108 } \ 109 jit->prg += 6; \ 110 }) 111 112 #define EMIT6_DISP(op1, op2, disp) \ 113 ({ \ 114 unsigned int __disp = (disp) & 0xfff; \ 115 EMIT6(op1 | __disp, op2); \ 116 }) 117 118 #define EMIT6_IMM(op, imm) \ 119 ({ \ 120 unsigned int __imm = (imm); \ 121 EMIT6(op | (__imm >> 16), __imm & 0xffff); \ 122 }) 123 124 #define EMIT_CONST(val) \ 125 ({ \ 126 unsigned int ret; \ 127 ret = (unsigned int) (jit->lit - jit->base_ip); \ 128 jit->seen |= SEEN_LITERAL; \ 129 if (jit->lit + 4 <= jit->end) \ 130 *(u32 *) jit->lit = val; \ 131 jit->lit += 4; \ 132 ret; \ 133 }) 134 135 #define EMIT_FN_CONST(bit, fn) \ 136 ({ \ 137 unsigned int ret; \ 138 ret = (unsigned int) (jit->lit - jit->base_ip); \ 139 if (jit->seen & bit) { \ 140 jit->seen |= SEEN_LITERAL; \ 141 if (jit->lit + 8 <= jit->end) \ 142 *(void **) jit->lit = fn; \ 143 jit->lit += 8; \ 144 } \ 145 ret; \ 146 }) 147 148 static void bpf_jit_prologue(struct bpf_jit *jit) 149 { 150 /* Save registers and create stack frame if necessary */ 151 if (jit->seen & SEEN_DATAREF) { 152 /* stmg %r8,%r15,88(%r15) */ 153 EMIT6(0xeb8ff058, 0x0024); 154 /* lgr %r14,%r15 */ 155 EMIT4(0xb90400ef); 156 /* ahi %r15,<offset> */ 157 EMIT4_IMM(0xa7fa0000, (jit->seen & SEEN_MEM) ? -112 : -80); 158 /* stg %r14,152(%r15) */ 159 EMIT6(0xe3e0f098, 0x0024); 160 } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL)) 161 /* stmg %r12,%r13,120(%r15) */ 162 EMIT6(0xebcdf078, 0x0024); 163 else if (jit->seen & SEEN_XREG) 164 /* stg %r12,120(%r15) */ 165 EMIT6(0xe3c0f078, 0x0024); 166 else if (jit->seen & SEEN_LITERAL) 167 /* stg %r13,128(%r15) */ 168 EMIT6(0xe3d0f080, 0x0024); 169 170 /* Setup literal pool */ 171 if (jit->seen & SEEN_LITERAL) { 172 /* basr %r13,0 */ 173 EMIT2(0x0dd0); 174 jit->base_ip = jit->prg; 175 } 176 jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word); 177 jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half); 178 jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte); 179 jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh); 180 jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind); 181 jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind); 182 jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind); 183 184 /* Filter needs to access skb data */ 185 if (jit->seen & SEEN_DATAREF) { 186 /* l %r11,<len>(%r2) */ 187 EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len)); 188 /* s %r11,<data_len>(%r2) */ 189 EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len)); 190 /* lg %r10,<data>(%r2) */ 191 EMIT6_DISP(0xe3a02000, 0x0004, 192 offsetof(struct sk_buff, data)); 193 } 194 } 195 196 static void bpf_jit_epilogue(struct bpf_jit *jit) 197 { 198 /* Return 0 */ 199 if (jit->seen & SEEN_RET0) { 200 jit->ret0_ip = jit->prg; 201 /* lghi %r2,0 */ 202 EMIT4(0xa7290000); 203 } 204 jit->exit_ip = jit->prg; 205 /* Restore registers */ 206 if (jit->seen & SEEN_DATAREF) 207 /* lmg %r8,%r15,<offset>(%r15) */ 208 EMIT6_DISP(0xeb8ff000, 0x0004, 209 (jit->seen & SEEN_MEM) ? 200 : 168); 210 else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL)) 211 /* lmg %r12,%r13,120(%r15) */ 212 EMIT6(0xebcdf078, 0x0004); 213 else if (jit->seen & SEEN_XREG) 214 /* lg %r12,120(%r15) */ 215 EMIT6(0xe3c0f078, 0x0004); 216 else if (jit->seen & SEEN_LITERAL) 217 /* lg %r13,128(%r15) */ 218 EMIT6(0xe3d0f080, 0x0004); 219 /* br %r14 */ 220 EMIT2(0x07fe); 221 } 222 223 /* 224 * make sure we dont leak kernel information to user 225 */ 226 static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter) 227 { 228 /* Clear temporary memory if (seen & SEEN_MEM) */ 229 if (jit->seen & SEEN_MEM) 230 /* xc 0(64,%r15),0(%r15) */ 231 EMIT6(0xd73ff000, 0xf000); 232 /* Clear X if (seen & SEEN_XREG) */ 233 if (jit->seen & SEEN_XREG) 234 /* lhi %r12,0 */ 235 EMIT4(0xa7c80000); 236 /* Clear A if the first register does not set it. */ 237 switch (filter[0].code) { 238 case BPF_S_LD_W_ABS: 239 case BPF_S_LD_H_ABS: 240 case BPF_S_LD_B_ABS: 241 case BPF_S_LD_W_LEN: 242 case BPF_S_LD_W_IND: 243 case BPF_S_LD_H_IND: 244 case BPF_S_LD_B_IND: 245 case BPF_S_LDX_B_MSH: 246 case BPF_S_LD_IMM: 247 case BPF_S_LD_MEM: 248 case BPF_S_MISC_TXA: 249 case BPF_S_ANC_PROTOCOL: 250 case BPF_S_ANC_PKTTYPE: 251 case BPF_S_ANC_IFINDEX: 252 case BPF_S_ANC_MARK: 253 case BPF_S_ANC_QUEUE: 254 case BPF_S_ANC_HATYPE: 255 case BPF_S_ANC_RXHASH: 256 case BPF_S_ANC_CPU: 257 case BPF_S_RET_K: 258 /* first instruction sets A register */ 259 break; 260 default: /* A = 0 */ 261 /* lhi %r5,0 */ 262 EMIT4(0xa7580000); 263 } 264 } 265 266 static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter, 267 unsigned int *addrs, int i, int last) 268 { 269 unsigned int K; 270 int offset; 271 unsigned int mask; 272 273 K = filter->k; 274 switch (filter->code) { 275 case BPF_S_ALU_ADD_X: /* A += X */ 276 jit->seen |= SEEN_XREG; 277 /* ar %r5,%r12 */ 278 EMIT2(0x1a5c); 279 break; 280 case BPF_S_ALU_ADD_K: /* A += K */ 281 if (!K) 282 break; 283 if (K <= 16383) 284 /* ahi %r5,<K> */ 285 EMIT4_IMM(0xa75a0000, K); 286 else if (test_facility(21)) 287 /* alfi %r5,<K> */ 288 EMIT6_IMM(0xc25b0000, K); 289 else 290 /* a %r5,<d(K)>(%r13) */ 291 EMIT4_DISP(0x5a50d000, EMIT_CONST(K)); 292 break; 293 case BPF_S_ALU_SUB_X: /* A -= X */ 294 jit->seen |= SEEN_XREG; 295 /* sr %r5,%r12 */ 296 EMIT2(0x1b5c); 297 break; 298 case BPF_S_ALU_SUB_K: /* A -= K */ 299 if (!K) 300 break; 301 if (K <= 16384) 302 /* ahi %r5,-K */ 303 EMIT4_IMM(0xa75a0000, -K); 304 else if (test_facility(21)) 305 /* alfi %r5,-K */ 306 EMIT6_IMM(0xc25b0000, -K); 307 else 308 /* s %r5,<d(K)>(%r13) */ 309 EMIT4_DISP(0x5b50d000, EMIT_CONST(K)); 310 break; 311 case BPF_S_ALU_MUL_X: /* A *= X */ 312 jit->seen |= SEEN_XREG; 313 /* msr %r5,%r12 */ 314 EMIT4(0xb252005c); 315 break; 316 case BPF_S_ALU_MUL_K: /* A *= K */ 317 if (K <= 16383) 318 /* mhi %r5,K */ 319 EMIT4_IMM(0xa75c0000, K); 320 else if (test_facility(34)) 321 /* msfi %r5,<K> */ 322 EMIT6_IMM(0xc2510000, K); 323 else 324 /* ms %r5,<d(K)>(%r13) */ 325 EMIT4_DISP(0x7150d000, EMIT_CONST(K)); 326 break; 327 case BPF_S_ALU_DIV_X: /* A /= X */ 328 jit->seen |= SEEN_XREG | SEEN_RET0; 329 /* ltr %r12,%r12 */ 330 EMIT2(0x12cc); 331 /* jz <ret0> */ 332 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg)); 333 /* lhi %r4,0 */ 334 EMIT4(0xa7480000); 335 /* dr %r4,%r12 */ 336 EMIT2(0x1d4c); 337 break; 338 case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */ 339 /* m %r4,<d(K)>(%r13) */ 340 EMIT4_DISP(0x5c40d000, EMIT_CONST(K)); 341 /* lr %r5,%r4 */ 342 EMIT2(0x1854); 343 break; 344 case BPF_S_ALU_MOD_X: /* A %= X */ 345 jit->seen |= SEEN_XREG | SEEN_RET0; 346 /* ltr %r12,%r12 */ 347 EMIT2(0x12cc); 348 /* jz <ret0> */ 349 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg)); 350 /* lhi %r4,0 */ 351 EMIT4(0xa7480000); 352 /* dr %r4,%r12 */ 353 EMIT2(0x1d4c); 354 /* lr %r5,%r4 */ 355 EMIT2(0x1854); 356 break; 357 case BPF_S_ALU_MOD_K: /* A %= K */ 358 /* lhi %r4,0 */ 359 EMIT4(0xa7480000); 360 /* d %r4,<d(K)>(%r13) */ 361 EMIT4_DISP(0x5d40d000, EMIT_CONST(K)); 362 /* lr %r5,%r4 */ 363 EMIT2(0x1854); 364 break; 365 case BPF_S_ALU_AND_X: /* A &= X */ 366 jit->seen |= SEEN_XREG; 367 /* nr %r5,%r12 */ 368 EMIT2(0x145c); 369 break; 370 case BPF_S_ALU_AND_K: /* A &= K */ 371 if (test_facility(21)) 372 /* nilf %r5,<K> */ 373 EMIT6_IMM(0xc05b0000, K); 374 else 375 /* n %r5,<d(K)>(%r13) */ 376 EMIT4_DISP(0x5450d000, EMIT_CONST(K)); 377 break; 378 case BPF_S_ALU_OR_X: /* A |= X */ 379 jit->seen |= SEEN_XREG; 380 /* or %r5,%r12 */ 381 EMIT2(0x165c); 382 break; 383 case BPF_S_ALU_OR_K: /* A |= K */ 384 if (test_facility(21)) 385 /* oilf %r5,<K> */ 386 EMIT6_IMM(0xc05d0000, K); 387 else 388 /* o %r5,<d(K)>(%r13) */ 389 EMIT4_DISP(0x5650d000, EMIT_CONST(K)); 390 break; 391 case BPF_S_ANC_ALU_XOR_X: /* A ^= X; */ 392 case BPF_S_ALU_XOR_X: 393 jit->seen |= SEEN_XREG; 394 /* xr %r5,%r12 */ 395 EMIT2(0x175c); 396 break; 397 case BPF_S_ALU_XOR_K: /* A ^= K */ 398 if (!K) 399 break; 400 /* x %r5,<d(K)>(%r13) */ 401 EMIT4_DISP(0x5750d000, EMIT_CONST(K)); 402 break; 403 case BPF_S_ALU_LSH_X: /* A <<= X; */ 404 jit->seen |= SEEN_XREG; 405 /* sll %r5,0(%r12) */ 406 EMIT4(0x8950c000); 407 break; 408 case BPF_S_ALU_LSH_K: /* A <<= K */ 409 if (K == 0) 410 break; 411 /* sll %r5,K */ 412 EMIT4_DISP(0x89500000, K); 413 break; 414 case BPF_S_ALU_RSH_X: /* A >>= X; */ 415 jit->seen |= SEEN_XREG; 416 /* srl %r5,0(%r12) */ 417 EMIT4(0x8850c000); 418 break; 419 case BPF_S_ALU_RSH_K: /* A >>= K; */ 420 if (K == 0) 421 break; 422 /* srl %r5,K */ 423 EMIT4_DISP(0x88500000, K); 424 break; 425 case BPF_S_ALU_NEG: /* A = -A */ 426 /* lnr %r5,%r5 */ 427 EMIT2(0x1155); 428 break; 429 case BPF_S_JMP_JA: /* ip += K */ 430 offset = addrs[i + K] + jit->start - jit->prg; 431 EMIT4_PCREL(0xa7f40000, offset); 432 break; 433 case BPF_S_JMP_JGT_K: /* ip += (A > K) ? jt : jf */ 434 mask = 0x200000; /* jh */ 435 goto kbranch; 436 case BPF_S_JMP_JGE_K: /* ip += (A >= K) ? jt : jf */ 437 mask = 0xa00000; /* jhe */ 438 goto kbranch; 439 case BPF_S_JMP_JEQ_K: /* ip += (A == K) ? jt : jf */ 440 mask = 0x800000; /* je */ 441 kbranch: /* Emit compare if the branch targets are different */ 442 if (filter->jt != filter->jf) { 443 if (K <= 16383) 444 /* chi %r5,<K> */ 445 EMIT4_IMM(0xa75e0000, K); 446 else if (test_facility(21)) 447 /* clfi %r5,<K> */ 448 EMIT6_IMM(0xc25f0000, K); 449 else 450 /* c %r5,<d(K)>(%r13) */ 451 EMIT4_DISP(0x5950d000, EMIT_CONST(K)); 452 } 453 branch: if (filter->jt == filter->jf) { 454 if (filter->jt == 0) 455 break; 456 /* j <jt> */ 457 offset = addrs[i + filter->jt] + jit->start - jit->prg; 458 EMIT4_PCREL(0xa7f40000, offset); 459 break; 460 } 461 if (filter->jt != 0) { 462 /* brc <mask>,<jt> */ 463 offset = addrs[i + filter->jt] + jit->start - jit->prg; 464 EMIT4_PCREL(0xa7040000 | mask, offset); 465 } 466 if (filter->jf != 0) { 467 /* brc <mask^15>,<jf> */ 468 offset = addrs[i + filter->jf] + jit->start - jit->prg; 469 EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset); 470 } 471 break; 472 case BPF_S_JMP_JSET_K: /* ip += (A & K) ? jt : jf */ 473 mask = 0x700000; /* jnz */ 474 /* Emit test if the branch targets are different */ 475 if (filter->jt != filter->jf) { 476 if (K > 65535) { 477 /* lr %r4,%r5 */ 478 EMIT2(0x1845); 479 /* n %r4,<d(K)>(%r13) */ 480 EMIT4_DISP(0x5440d000, EMIT_CONST(K)); 481 } else 482 /* tmll %r5,K */ 483 EMIT4_IMM(0xa7510000, K); 484 } 485 goto branch; 486 case BPF_S_JMP_JGT_X: /* ip += (A > X) ? jt : jf */ 487 mask = 0x200000; /* jh */ 488 goto xbranch; 489 case BPF_S_JMP_JGE_X: /* ip += (A >= X) ? jt : jf */ 490 mask = 0xa00000; /* jhe */ 491 goto xbranch; 492 case BPF_S_JMP_JEQ_X: /* ip += (A == X) ? jt : jf */ 493 mask = 0x800000; /* je */ 494 xbranch: /* Emit compare if the branch targets are different */ 495 if (filter->jt != filter->jf) { 496 jit->seen |= SEEN_XREG; 497 /* cr %r5,%r12 */ 498 EMIT2(0x195c); 499 } 500 goto branch; 501 case BPF_S_JMP_JSET_X: /* ip += (A & X) ? jt : jf */ 502 mask = 0x700000; /* jnz */ 503 /* Emit test if the branch targets are different */ 504 if (filter->jt != filter->jf) { 505 jit->seen |= SEEN_XREG; 506 /* lr %r4,%r5 */ 507 EMIT2(0x1845); 508 /* nr %r4,%r12 */ 509 EMIT2(0x144c); 510 } 511 goto branch; 512 case BPF_S_LD_W_ABS: /* A = *(u32 *) (skb->data+K) */ 513 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD; 514 offset = jit->off_load_word; 515 goto load_abs; 516 case BPF_S_LD_H_ABS: /* A = *(u16 *) (skb->data+K) */ 517 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF; 518 offset = jit->off_load_half; 519 goto load_abs; 520 case BPF_S_LD_B_ABS: /* A = *(u8 *) (skb->data+K) */ 521 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE; 522 offset = jit->off_load_byte; 523 load_abs: if ((int) K < 0) 524 goto out; 525 call_fn: /* lg %r1,<d(function)>(%r13) */ 526 EMIT6_DISP(0xe310d000, 0x0004, offset); 527 /* l %r3,<d(K)>(%r13) */ 528 EMIT4_DISP(0x5830d000, EMIT_CONST(K)); 529 /* basr %r8,%r1 */ 530 EMIT2(0x0d81); 531 /* jnz <ret0> */ 532 EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg)); 533 break; 534 case BPF_S_LD_W_IND: /* A = *(u32 *) (skb->data+K+X) */ 535 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD; 536 offset = jit->off_load_iword; 537 goto call_fn; 538 case BPF_S_LD_H_IND: /* A = *(u16 *) (skb->data+K+X) */ 539 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF; 540 offset = jit->off_load_ihalf; 541 goto call_fn; 542 case BPF_S_LD_B_IND: /* A = *(u8 *) (skb->data+K+X) */ 543 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE; 544 offset = jit->off_load_ibyte; 545 goto call_fn; 546 case BPF_S_LDX_B_MSH: 547 /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */ 548 jit->seen |= SEEN_RET0; 549 if ((int) K < 0) { 550 /* j <ret0> */ 551 EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg)); 552 break; 553 } 554 jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH; 555 offset = jit->off_load_bmsh; 556 goto call_fn; 557 case BPF_S_LD_W_LEN: /* A = skb->len; */ 558 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4); 559 /* l %r5,<d(len)>(%r2) */ 560 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len)); 561 break; 562 case BPF_S_LDX_W_LEN: /* X = skb->len; */ 563 jit->seen |= SEEN_XREG; 564 /* l %r12,<d(len)>(%r2) */ 565 EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len)); 566 break; 567 case BPF_S_LD_IMM: /* A = K */ 568 if (K <= 16383) 569 /* lhi %r5,K */ 570 EMIT4_IMM(0xa7580000, K); 571 else if (test_facility(21)) 572 /* llilf %r5,<K> */ 573 EMIT6_IMM(0xc05f0000, K); 574 else 575 /* l %r5,<d(K)>(%r13) */ 576 EMIT4_DISP(0x5850d000, EMIT_CONST(K)); 577 break; 578 case BPF_S_LDX_IMM: /* X = K */ 579 jit->seen |= SEEN_XREG; 580 if (K <= 16383) 581 /* lhi %r12,<K> */ 582 EMIT4_IMM(0xa7c80000, K); 583 else if (test_facility(21)) 584 /* llilf %r12,<K> */ 585 EMIT6_IMM(0xc0cf0000, K); 586 else 587 /* l %r12,<d(K)>(%r13) */ 588 EMIT4_DISP(0x58c0d000, EMIT_CONST(K)); 589 break; 590 case BPF_S_LD_MEM: /* A = mem[K] */ 591 jit->seen |= SEEN_MEM; 592 /* l %r5,<K>(%r15) */ 593 EMIT4_DISP(0x5850f000, 594 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 595 break; 596 case BPF_S_LDX_MEM: /* X = mem[K] */ 597 jit->seen |= SEEN_XREG | SEEN_MEM; 598 /* l %r12,<K>(%r15) */ 599 EMIT4_DISP(0x58c0f000, 600 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 601 break; 602 case BPF_S_MISC_TAX: /* X = A */ 603 jit->seen |= SEEN_XREG; 604 /* lr %r12,%r5 */ 605 EMIT2(0x18c5); 606 break; 607 case BPF_S_MISC_TXA: /* A = X */ 608 jit->seen |= SEEN_XREG; 609 /* lr %r5,%r12 */ 610 EMIT2(0x185c); 611 break; 612 case BPF_S_RET_K: 613 if (K == 0) { 614 jit->seen |= SEEN_RET0; 615 if (last) 616 break; 617 /* j <ret0> */ 618 EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg); 619 } else { 620 if (K <= 16383) 621 /* lghi %r2,K */ 622 EMIT4_IMM(0xa7290000, K); 623 else 624 /* llgf %r2,<K>(%r13) */ 625 EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K)); 626 /* j <exit> */ 627 if (last && !(jit->seen & SEEN_RET0)) 628 break; 629 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg); 630 } 631 break; 632 case BPF_S_RET_A: 633 /* llgfr %r2,%r5 */ 634 EMIT4(0xb9160025); 635 /* j <exit> */ 636 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg); 637 break; 638 case BPF_S_ST: /* mem[K] = A */ 639 jit->seen |= SEEN_MEM; 640 /* st %r5,<K>(%r15) */ 641 EMIT4_DISP(0x5050f000, 642 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 643 break; 644 case BPF_S_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */ 645 jit->seen |= SEEN_XREG | SEEN_MEM; 646 /* st %r12,<K>(%r15) */ 647 EMIT4_DISP(0x50c0f000, 648 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 649 break; 650 case BPF_S_ANC_PROTOCOL: /* A = ntohs(skb->protocol); */ 651 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2); 652 /* lhi %r5,0 */ 653 EMIT4(0xa7580000); 654 /* icm %r5,3,<d(protocol)>(%r2) */ 655 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol)); 656 break; 657 case BPF_S_ANC_IFINDEX: /* if (!skb->dev) return 0; 658 * A = skb->dev->ifindex */ 659 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4); 660 jit->seen |= SEEN_RET0; 661 /* lg %r1,<d(dev)>(%r2) */ 662 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev)); 663 /* ltgr %r1,%r1 */ 664 EMIT4(0xb9020011); 665 /* jz <ret0> */ 666 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg); 667 /* l %r5,<d(ifindex)>(%r1) */ 668 EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex)); 669 break; 670 case BPF_S_ANC_MARK: /* A = skb->mark */ 671 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4); 672 /* l %r5,<d(mark)>(%r2) */ 673 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark)); 674 break; 675 case BPF_S_ANC_QUEUE: /* A = skb->queue_mapping */ 676 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2); 677 /* lhi %r5,0 */ 678 EMIT4(0xa7580000); 679 /* icm %r5,3,<d(queue_mapping)>(%r2) */ 680 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping)); 681 break; 682 case BPF_S_ANC_HATYPE: /* if (!skb->dev) return 0; 683 * A = skb->dev->type */ 684 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2); 685 jit->seen |= SEEN_RET0; 686 /* lg %r1,<d(dev)>(%r2) */ 687 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev)); 688 /* ltgr %r1,%r1 */ 689 EMIT4(0xb9020011); 690 /* jz <ret0> */ 691 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg); 692 /* lhi %r5,0 */ 693 EMIT4(0xa7580000); 694 /* icm %r5,3,<d(type)>(%r1) */ 695 EMIT4_DISP(0xbf531000, offsetof(struct net_device, type)); 696 break; 697 case BPF_S_ANC_RXHASH: /* A = skb->rxhash */ 698 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, rxhash) != 4); 699 /* l %r5,<d(rxhash)>(%r2) */ 700 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, rxhash)); 701 break; 702 case BPF_S_ANC_CPU: /* A = smp_processor_id() */ 703 #ifdef CONFIG_SMP 704 /* l %r5,<d(cpu_nr)> */ 705 EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr)); 706 #else 707 /* lhi %r5,0 */ 708 EMIT4(0xa7580000); 709 #endif 710 break; 711 default: /* too complex, give up */ 712 goto out; 713 } 714 addrs[i] = jit->prg - jit->start; 715 return 0; 716 out: 717 return -1; 718 } 719 720 void bpf_jit_compile(struct sk_filter *fp) 721 { 722 unsigned long size, prg_len, lit_len; 723 struct bpf_jit jit, cjit; 724 unsigned int *addrs; 725 int pass, i; 726 727 if (!bpf_jit_enable) 728 return; 729 addrs = kmalloc(fp->len * sizeof(*addrs), GFP_KERNEL); 730 if (addrs == NULL) 731 return; 732 memset(addrs, 0, fp->len * sizeof(*addrs)); 733 memset(&jit, 0, sizeof(cjit)); 734 memset(&cjit, 0, sizeof(cjit)); 735 736 for (pass = 0; pass < 10; pass++) { 737 jit.prg = jit.start; 738 jit.lit = jit.mid; 739 740 bpf_jit_prologue(&jit); 741 bpf_jit_noleaks(&jit, fp->insns); 742 for (i = 0; i < fp->len; i++) { 743 if (bpf_jit_insn(&jit, fp->insns + i, addrs, i, 744 i == fp->len - 1)) 745 goto out; 746 } 747 bpf_jit_epilogue(&jit); 748 if (jit.start) { 749 WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit); 750 if (memcmp(&jit, &cjit, sizeof(jit)) == 0) 751 break; 752 } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) { 753 prg_len = jit.prg - jit.start; 754 lit_len = jit.lit - jit.mid; 755 size = max_t(unsigned long, prg_len + lit_len, 756 sizeof(struct work_struct)); 757 if (size >= BPF_SIZE_MAX) 758 goto out; 759 jit.start = module_alloc(size); 760 if (!jit.start) 761 goto out; 762 jit.prg = jit.mid = jit.start + prg_len; 763 jit.lit = jit.end = jit.start + prg_len + lit_len; 764 jit.base_ip += (unsigned long) jit.start; 765 jit.exit_ip += (unsigned long) jit.start; 766 jit.ret0_ip += (unsigned long) jit.start; 767 } 768 cjit = jit; 769 } 770 if (bpf_jit_enable > 1) { 771 pr_err("flen=%d proglen=%lu pass=%d image=%p\n", 772 fp->len, jit.end - jit.start, pass, jit.start); 773 if (jit.start) { 774 printk(KERN_ERR "JIT code:\n"); 775 print_fn_code(jit.start, jit.mid - jit.start); 776 print_hex_dump(KERN_ERR, "JIT literals:\n", 777 DUMP_PREFIX_ADDRESS, 16, 1, 778 jit.mid, jit.end - jit.mid, false); 779 } 780 } 781 if (jit.start) 782 fp->bpf_func = (void *) jit.start; 783 out: 784 kfree(addrs); 785 } 786 787 static void jit_free_defer(struct work_struct *arg) 788 { 789 module_free(NULL, arg); 790 } 791 792 /* run from softirq, we must use a work_struct to call 793 * module_free() from process context 794 */ 795 void bpf_jit_free(struct sk_filter *fp) 796 { 797 struct work_struct *work; 798 799 if (fp->bpf_func == sk_run_filter) 800 return; 801 work = (struct work_struct *)fp->bpf_func; 802 INIT_WORK(work, jit_free_defer); 803 schedule_work(work); 804 } 805