xref: /openbmc/linux/arch/s390/net/bpf_jit_comp.c (revision a16be368)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * BPF Jit compiler for s390.
4  *
5  * Minimum build requirements:
6  *
7  *  - HAVE_MARCH_Z196_FEATURES: laal, laalg
8  *  - HAVE_MARCH_Z10_FEATURES: msfi, cgrj, clgrj
9  *  - HAVE_MARCH_Z9_109_FEATURES: alfi, llilf, clfi, oilf, nilf
10  *  - PACK_STACK
11  *  - 64BIT
12  *
13  * Copyright IBM Corp. 2012,2015
14  *
15  * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
16  *	      Michael Holzheu <holzheu@linux.vnet.ibm.com>
17  */
18 
19 #define KMSG_COMPONENT "bpf_jit"
20 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
21 
22 #include <linux/netdevice.h>
23 #include <linux/filter.h>
24 #include <linux/init.h>
25 #include <linux/bpf.h>
26 #include <linux/mm.h>
27 #include <linux/kernel.h>
28 #include <asm/cacheflush.h>
29 #include <asm/dis.h>
30 #include <asm/facility.h>
31 #include <asm/nospec-branch.h>
32 #include <asm/set_memory.h>
33 #include "bpf_jit.h"
34 
35 struct bpf_jit {
36 	u32 seen;		/* Flags to remember seen eBPF instructions */
37 	u32 seen_reg[16];	/* Array to remember which registers are used */
38 	u32 *addrs;		/* Array with relative instruction addresses */
39 	u8 *prg_buf;		/* Start of program */
40 	int size;		/* Size of program and literal pool */
41 	int size_prg;		/* Size of program */
42 	int prg;		/* Current position in program */
43 	int lit32_start;	/* Start of 32-bit literal pool */
44 	int lit32;		/* Current position in 32-bit literal pool */
45 	int lit64_start;	/* Start of 64-bit literal pool */
46 	int lit64;		/* Current position in 64-bit literal pool */
47 	int base_ip;		/* Base address for literal pool */
48 	int exit_ip;		/* Address of exit */
49 	int r1_thunk_ip;	/* Address of expoline thunk for 'br %r1' */
50 	int r14_thunk_ip;	/* Address of expoline thunk for 'br %r14' */
51 	int tail_call_start;	/* Tail call start offset */
52 	int labels[1];		/* Labels for local jumps */
53 };
54 
55 #define SEEN_MEM	BIT(0)		/* use mem[] for temporary storage */
56 #define SEEN_LITERAL	BIT(1)		/* code uses literals */
57 #define SEEN_FUNC	BIT(2)		/* calls C functions */
58 #define SEEN_TAIL_CALL	BIT(3)		/* code uses tail calls */
59 #define SEEN_STACK	(SEEN_FUNC | SEEN_MEM)
60 
61 /*
62  * s390 registers
63  */
64 #define REG_W0		(MAX_BPF_JIT_REG + 0)	/* Work register 1 (even) */
65 #define REG_W1		(MAX_BPF_JIT_REG + 1)	/* Work register 2 (odd) */
66 #define REG_L		(MAX_BPF_JIT_REG + 2)	/* Literal pool register */
67 #define REG_15		(MAX_BPF_JIT_REG + 3)	/* Register 15 */
68 #define REG_0		REG_W0			/* Register 0 */
69 #define REG_1		REG_W1			/* Register 1 */
70 #define REG_2		BPF_REG_1		/* Register 2 */
71 #define REG_14		BPF_REG_0		/* Register 14 */
72 
73 /*
74  * Mapping of BPF registers to s390 registers
75  */
76 static const int reg2hex[] = {
77 	/* Return code */
78 	[BPF_REG_0]	= 14,
79 	/* Function parameters */
80 	[BPF_REG_1]	= 2,
81 	[BPF_REG_2]	= 3,
82 	[BPF_REG_3]	= 4,
83 	[BPF_REG_4]	= 5,
84 	[BPF_REG_5]	= 6,
85 	/* Call saved registers */
86 	[BPF_REG_6]	= 7,
87 	[BPF_REG_7]	= 8,
88 	[BPF_REG_8]	= 9,
89 	[BPF_REG_9]	= 10,
90 	/* BPF stack pointer */
91 	[BPF_REG_FP]	= 13,
92 	/* Register for blinding */
93 	[BPF_REG_AX]	= 12,
94 	/* Work registers for s390x backend */
95 	[REG_W0]	= 0,
96 	[REG_W1]	= 1,
97 	[REG_L]		= 11,
98 	[REG_15]	= 15,
99 };
100 
101 static inline u32 reg(u32 dst_reg, u32 src_reg)
102 {
103 	return reg2hex[dst_reg] << 4 | reg2hex[src_reg];
104 }
105 
106 static inline u32 reg_high(u32 reg)
107 {
108 	return reg2hex[reg] << 4;
109 }
110 
111 static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
112 {
113 	u32 r1 = reg2hex[b1];
114 
115 	if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
116 		jit->seen_reg[r1] = 1;
117 }
118 
119 #define REG_SET_SEEN(b1)					\
120 ({								\
121 	reg_set_seen(jit, b1);					\
122 })
123 
124 #define REG_SEEN(b1) jit->seen_reg[reg2hex[(b1)]]
125 
126 /*
127  * EMIT macros for code generation
128  */
129 
130 #define _EMIT2(op)						\
131 ({								\
132 	if (jit->prg_buf)					\
133 		*(u16 *) (jit->prg_buf + jit->prg) = (op);	\
134 	jit->prg += 2;						\
135 })
136 
137 #define EMIT2(op, b1, b2)					\
138 ({								\
139 	_EMIT2((op) | reg(b1, b2));				\
140 	REG_SET_SEEN(b1);					\
141 	REG_SET_SEEN(b2);					\
142 })
143 
144 #define _EMIT4(op)						\
145 ({								\
146 	if (jit->prg_buf)					\
147 		*(u32 *) (jit->prg_buf + jit->prg) = (op);	\
148 	jit->prg += 4;						\
149 })
150 
151 #define EMIT4(op, b1, b2)					\
152 ({								\
153 	_EMIT4((op) | reg(b1, b2));				\
154 	REG_SET_SEEN(b1);					\
155 	REG_SET_SEEN(b2);					\
156 })
157 
158 #define EMIT4_RRF(op, b1, b2, b3)				\
159 ({								\
160 	_EMIT4((op) | reg_high(b3) << 8 | reg(b1, b2));		\
161 	REG_SET_SEEN(b1);					\
162 	REG_SET_SEEN(b2);					\
163 	REG_SET_SEEN(b3);					\
164 })
165 
166 #define _EMIT4_DISP(op, disp)					\
167 ({								\
168 	unsigned int __disp = (disp) & 0xfff;			\
169 	_EMIT4((op) | __disp);					\
170 })
171 
172 #define EMIT4_DISP(op, b1, b2, disp)				\
173 ({								\
174 	_EMIT4_DISP((op) | reg_high(b1) << 16 |			\
175 		    reg_high(b2) << 8, (disp));			\
176 	REG_SET_SEEN(b1);					\
177 	REG_SET_SEEN(b2);					\
178 })
179 
180 #define EMIT4_IMM(op, b1, imm)					\
181 ({								\
182 	unsigned int __imm = (imm) & 0xffff;			\
183 	_EMIT4((op) | reg_high(b1) << 16 | __imm);		\
184 	REG_SET_SEEN(b1);					\
185 })
186 
187 #define EMIT4_PCREL(op, pcrel)					\
188 ({								\
189 	long __pcrel = ((pcrel) >> 1) & 0xffff;			\
190 	_EMIT4((op) | __pcrel);					\
191 })
192 
193 #define EMIT4_PCREL_RIC(op, mask, target)			\
194 ({								\
195 	int __rel = ((target) - jit->prg) / 2;			\
196 	_EMIT4((op) | (mask) << 20 | (__rel & 0xffff));		\
197 })
198 
199 #define _EMIT6(op1, op2)					\
200 ({								\
201 	if (jit->prg_buf) {					\
202 		*(u32 *) (jit->prg_buf + jit->prg) = (op1);	\
203 		*(u16 *) (jit->prg_buf + jit->prg + 4) = (op2);	\
204 	}							\
205 	jit->prg += 6;						\
206 })
207 
208 #define _EMIT6_DISP(op1, op2, disp)				\
209 ({								\
210 	unsigned int __disp = (disp) & 0xfff;			\
211 	_EMIT6((op1) | __disp, op2);				\
212 })
213 
214 #define _EMIT6_DISP_LH(op1, op2, disp)				\
215 ({								\
216 	u32 _disp = (u32) (disp);				\
217 	unsigned int __disp_h = _disp & 0xff000;		\
218 	unsigned int __disp_l = _disp & 0x00fff;		\
219 	_EMIT6((op1) | __disp_l, (op2) | __disp_h >> 4);	\
220 })
221 
222 #define EMIT6_DISP_LH(op1, op2, b1, b2, b3, disp)		\
223 ({								\
224 	_EMIT6_DISP_LH((op1) | reg(b1, b2) << 16 |		\
225 		       reg_high(b3) << 8, op2, disp);		\
226 	REG_SET_SEEN(b1);					\
227 	REG_SET_SEEN(b2);					\
228 	REG_SET_SEEN(b3);					\
229 })
230 
231 #define EMIT6_PCREL_LABEL(op1, op2, b1, b2, label, mask)	\
232 ({								\
233 	int rel = (jit->labels[label] - jit->prg) >> 1;		\
234 	_EMIT6((op1) | reg(b1, b2) << 16 | (rel & 0xffff),	\
235 	       (op2) | (mask) << 12);				\
236 	REG_SET_SEEN(b1);					\
237 	REG_SET_SEEN(b2);					\
238 })
239 
240 #define EMIT6_PCREL_IMM_LABEL(op1, op2, b1, imm, label, mask)	\
241 ({								\
242 	int rel = (jit->labels[label] - jit->prg) >> 1;		\
243 	_EMIT6((op1) | (reg_high(b1) | (mask)) << 16 |		\
244 		(rel & 0xffff), (op2) | ((imm) & 0xff) << 8);	\
245 	REG_SET_SEEN(b1);					\
246 	BUILD_BUG_ON(((unsigned long) (imm)) > 0xff);		\
247 })
248 
249 #define EMIT6_PCREL(op1, op2, b1, b2, i, off, mask)		\
250 ({								\
251 	/* Branch instruction needs 6 bytes */			\
252 	int rel = (addrs[(i) + (off) + 1] - (addrs[(i) + 1] - 6)) / 2;\
253 	_EMIT6((op1) | reg(b1, b2) << 16 | (rel & 0xffff), (op2) | (mask));\
254 	REG_SET_SEEN(b1);					\
255 	REG_SET_SEEN(b2);					\
256 })
257 
258 #define EMIT6_PCREL_RILB(op, b, target)				\
259 ({								\
260 	unsigned int rel = (int)((target) - jit->prg) / 2;	\
261 	_EMIT6((op) | reg_high(b) << 16 | rel >> 16, rel & 0xffff);\
262 	REG_SET_SEEN(b);					\
263 })
264 
265 #define EMIT6_PCREL_RIL(op, target)				\
266 ({								\
267 	unsigned int rel = (int)((target) - jit->prg) / 2;	\
268 	_EMIT6((op) | rel >> 16, rel & 0xffff);			\
269 })
270 
271 #define EMIT6_PCREL_RILC(op, mask, target)			\
272 ({								\
273 	EMIT6_PCREL_RIL((op) | (mask) << 20, (target));		\
274 })
275 
276 #define _EMIT6_IMM(op, imm)					\
277 ({								\
278 	unsigned int __imm = (imm);				\
279 	_EMIT6((op) | (__imm >> 16), __imm & 0xffff);		\
280 })
281 
282 #define EMIT6_IMM(op, b1, imm)					\
283 ({								\
284 	_EMIT6_IMM((op) | reg_high(b1) << 16, imm);		\
285 	REG_SET_SEEN(b1);					\
286 })
287 
288 #define _EMIT_CONST_U32(val)					\
289 ({								\
290 	unsigned int ret;					\
291 	ret = jit->lit32;					\
292 	if (jit->prg_buf)					\
293 		*(u32 *)(jit->prg_buf + jit->lit32) = (u32)(val);\
294 	jit->lit32 += 4;					\
295 	ret;							\
296 })
297 
298 #define EMIT_CONST_U32(val)					\
299 ({								\
300 	jit->seen |= SEEN_LITERAL;				\
301 	_EMIT_CONST_U32(val) - jit->base_ip;			\
302 })
303 
304 #define _EMIT_CONST_U64(val)					\
305 ({								\
306 	unsigned int ret;					\
307 	ret = jit->lit64;					\
308 	if (jit->prg_buf)					\
309 		*(u64 *)(jit->prg_buf + jit->lit64) = (u64)(val);\
310 	jit->lit64 += 8;					\
311 	ret;							\
312 })
313 
314 #define EMIT_CONST_U64(val)					\
315 ({								\
316 	jit->seen |= SEEN_LITERAL;				\
317 	_EMIT_CONST_U64(val) - jit->base_ip;			\
318 })
319 
320 #define EMIT_ZERO(b1)						\
321 ({								\
322 	if (!fp->aux->verifier_zext) {				\
323 		/* llgfr %dst,%dst (zero extend to 64 bit) */	\
324 		EMIT4(0xb9160000, b1, b1);			\
325 		REG_SET_SEEN(b1);				\
326 	}							\
327 })
328 
329 /*
330  * Return whether this is the first pass. The first pass is special, since we
331  * don't know any sizes yet, and thus must be conservative.
332  */
333 static bool is_first_pass(struct bpf_jit *jit)
334 {
335 	return jit->size == 0;
336 }
337 
338 /*
339  * Return whether this is the code generation pass. The code generation pass is
340  * special, since we should change as little as possible.
341  */
342 static bool is_codegen_pass(struct bpf_jit *jit)
343 {
344 	return jit->prg_buf;
345 }
346 
347 /*
348  * Return whether "rel" can be encoded as a short PC-relative offset
349  */
350 static bool is_valid_rel(int rel)
351 {
352 	return rel >= -65536 && rel <= 65534;
353 }
354 
355 /*
356  * Return whether "off" can be reached using a short PC-relative offset
357  */
358 static bool can_use_rel(struct bpf_jit *jit, int off)
359 {
360 	return is_valid_rel(off - jit->prg);
361 }
362 
363 /*
364  * Return whether given displacement can be encoded using
365  * Long-Displacement Facility
366  */
367 static bool is_valid_ldisp(int disp)
368 {
369 	return disp >= -524288 && disp <= 524287;
370 }
371 
372 /*
373  * Return whether the next 32-bit literal pool entry can be referenced using
374  * Long-Displacement Facility
375  */
376 static bool can_use_ldisp_for_lit32(struct bpf_jit *jit)
377 {
378 	return is_valid_ldisp(jit->lit32 - jit->base_ip);
379 }
380 
381 /*
382  * Return whether the next 64-bit literal pool entry can be referenced using
383  * Long-Displacement Facility
384  */
385 static bool can_use_ldisp_for_lit64(struct bpf_jit *jit)
386 {
387 	return is_valid_ldisp(jit->lit64 - jit->base_ip);
388 }
389 
390 /*
391  * Fill whole space with illegal instructions
392  */
393 static void jit_fill_hole(void *area, unsigned int size)
394 {
395 	memset(area, 0, size);
396 }
397 
398 /*
399  * Save registers from "rs" (register start) to "re" (register end) on stack
400  */
401 static void save_regs(struct bpf_jit *jit, u32 rs, u32 re)
402 {
403 	u32 off = STK_OFF_R6 + (rs - 6) * 8;
404 
405 	if (rs == re)
406 		/* stg %rs,off(%r15) */
407 		_EMIT6(0xe300f000 | rs << 20 | off, 0x0024);
408 	else
409 		/* stmg %rs,%re,off(%r15) */
410 		_EMIT6_DISP(0xeb00f000 | rs << 20 | re << 16, 0x0024, off);
411 }
412 
413 /*
414  * Restore registers from "rs" (register start) to "re" (register end) on stack
415  */
416 static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth)
417 {
418 	u32 off = STK_OFF_R6 + (rs - 6) * 8;
419 
420 	if (jit->seen & SEEN_STACK)
421 		off += STK_OFF + stack_depth;
422 
423 	if (rs == re)
424 		/* lg %rs,off(%r15) */
425 		_EMIT6(0xe300f000 | rs << 20 | off, 0x0004);
426 	else
427 		/* lmg %rs,%re,off(%r15) */
428 		_EMIT6_DISP(0xeb00f000 | rs << 20 | re << 16, 0x0004, off);
429 }
430 
431 /*
432  * Return first seen register (from start)
433  */
434 static int get_start(struct bpf_jit *jit, int start)
435 {
436 	int i;
437 
438 	for (i = start; i <= 15; i++) {
439 		if (jit->seen_reg[i])
440 			return i;
441 	}
442 	return 0;
443 }
444 
445 /*
446  * Return last seen register (from start) (gap >= 2)
447  */
448 static int get_end(struct bpf_jit *jit, int start)
449 {
450 	int i;
451 
452 	for (i = start; i < 15; i++) {
453 		if (!jit->seen_reg[i] && !jit->seen_reg[i + 1])
454 			return i - 1;
455 	}
456 	return jit->seen_reg[15] ? 15 : 14;
457 }
458 
459 #define REGS_SAVE	1
460 #define REGS_RESTORE	0
461 /*
462  * Save and restore clobbered registers (6-15) on stack.
463  * We save/restore registers in chunks with gap >= 2 registers.
464  */
465 static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth)
466 {
467 	const int last = 15, save_restore_size = 6;
468 	int re = 6, rs;
469 
470 	if (is_first_pass(jit)) {
471 		/*
472 		 * We don't know yet which registers are used. Reserve space
473 		 * conservatively.
474 		 */
475 		jit->prg += (last - re + 1) * save_restore_size;
476 		return;
477 	}
478 
479 	do {
480 		rs = get_start(jit, re);
481 		if (!rs)
482 			break;
483 		re = get_end(jit, rs + 1);
484 		if (op == REGS_SAVE)
485 			save_regs(jit, rs, re);
486 		else
487 			restore_regs(jit, rs, re, stack_depth);
488 		re++;
489 	} while (re <= last);
490 }
491 
492 /*
493  * Emit function prologue
494  *
495  * Save registers and create stack frame if necessary.
496  * See stack frame layout desription in "bpf_jit.h"!
497  */
498 static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth)
499 {
500 	if (jit->seen & SEEN_TAIL_CALL) {
501 		/* xc STK_OFF_TCCNT(4,%r15),STK_OFF_TCCNT(%r15) */
502 		_EMIT6(0xd703f000 | STK_OFF_TCCNT, 0xf000 | STK_OFF_TCCNT);
503 	} else {
504 		/* j tail_call_start: NOP if no tail calls are used */
505 		EMIT4_PCREL(0xa7f40000, 6);
506 		/* bcr 0,%0 */
507 		EMIT2(0x0700, 0, REG_0);
508 	}
509 	/* Tail calls have to skip above initialization */
510 	jit->tail_call_start = jit->prg;
511 	/* Save registers */
512 	save_restore_regs(jit, REGS_SAVE, stack_depth);
513 	/* Setup literal pool */
514 	if (is_first_pass(jit) || (jit->seen & SEEN_LITERAL)) {
515 		if (!is_first_pass(jit) &&
516 		    is_valid_ldisp(jit->size - (jit->prg + 2))) {
517 			/* basr %l,0 */
518 			EMIT2(0x0d00, REG_L, REG_0);
519 			jit->base_ip = jit->prg;
520 		} else {
521 			/* larl %l,lit32_start */
522 			EMIT6_PCREL_RILB(0xc0000000, REG_L, jit->lit32_start);
523 			jit->base_ip = jit->lit32_start;
524 		}
525 	}
526 	/* Setup stack and backchain */
527 	if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) {
528 		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
529 			/* lgr %w1,%r15 (backchain) */
530 			EMIT4(0xb9040000, REG_W1, REG_15);
531 		/* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */
532 		EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED);
533 		/* aghi %r15,-STK_OFF */
534 		EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth));
535 		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
536 			/* stg %w1,152(%r15) (backchain) */
537 			EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
538 				      REG_15, 152);
539 	}
540 }
541 
542 /*
543  * Function epilogue
544  */
545 static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth)
546 {
547 	jit->exit_ip = jit->prg;
548 	/* Load exit code: lgr %r2,%b0 */
549 	EMIT4(0xb9040000, REG_2, BPF_REG_0);
550 	/* Restore registers */
551 	save_restore_regs(jit, REGS_RESTORE, stack_depth);
552 	if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable) {
553 		jit->r14_thunk_ip = jit->prg;
554 		/* Generate __s390_indirect_jump_r14 thunk */
555 		if (test_facility(35)) {
556 			/* exrl %r0,.+10 */
557 			EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10);
558 		} else {
559 			/* larl %r1,.+14 */
560 			EMIT6_PCREL_RILB(0xc0000000, REG_1, jit->prg + 14);
561 			/* ex 0,0(%r1) */
562 			EMIT4_DISP(0x44000000, REG_0, REG_1, 0);
563 		}
564 		/* j . */
565 		EMIT4_PCREL(0xa7f40000, 0);
566 	}
567 	/* br %r14 */
568 	_EMIT2(0x07fe);
569 
570 	if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable &&
571 	    (is_first_pass(jit) || (jit->seen & SEEN_FUNC))) {
572 		jit->r1_thunk_ip = jit->prg;
573 		/* Generate __s390_indirect_jump_r1 thunk */
574 		if (test_facility(35)) {
575 			/* exrl %r0,.+10 */
576 			EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10);
577 			/* j . */
578 			EMIT4_PCREL(0xa7f40000, 0);
579 			/* br %r1 */
580 			_EMIT2(0x07f1);
581 		} else {
582 			/* ex 0,S390_lowcore.br_r1_tampoline */
583 			EMIT4_DISP(0x44000000, REG_0, REG_0,
584 				   offsetof(struct lowcore, br_r1_trampoline));
585 			/* j . */
586 			EMIT4_PCREL(0xa7f40000, 0);
587 		}
588 	}
589 }
590 
591 /*
592  * Compile one eBPF instruction into s390x code
593  *
594  * NOTE: Use noinline because for gcov (-fprofile-arcs) gcc allocates a lot of
595  * stack space for the large switch statement.
596  */
597 static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
598 				 int i, bool extra_pass, u32 stack_depth)
599 {
600 	struct bpf_insn *insn = &fp->insnsi[i];
601 	u32 dst_reg = insn->dst_reg;
602 	u32 src_reg = insn->src_reg;
603 	int last, insn_count = 1;
604 	u32 *addrs = jit->addrs;
605 	s32 imm = insn->imm;
606 	s16 off = insn->off;
607 	unsigned int mask;
608 
609 	switch (insn->code) {
610 	/*
611 	 * BPF_MOV
612 	 */
613 	case BPF_ALU | BPF_MOV | BPF_X: /* dst = (u32) src */
614 		/* llgfr %dst,%src */
615 		EMIT4(0xb9160000, dst_reg, src_reg);
616 		if (insn_is_zext(&insn[1]))
617 			insn_count = 2;
618 		break;
619 	case BPF_ALU64 | BPF_MOV | BPF_X: /* dst = src */
620 		/* lgr %dst,%src */
621 		EMIT4(0xb9040000, dst_reg, src_reg);
622 		break;
623 	case BPF_ALU | BPF_MOV | BPF_K: /* dst = (u32) imm */
624 		/* llilf %dst,imm */
625 		EMIT6_IMM(0xc00f0000, dst_reg, imm);
626 		if (insn_is_zext(&insn[1]))
627 			insn_count = 2;
628 		break;
629 	case BPF_ALU64 | BPF_MOV | BPF_K: /* dst = imm */
630 		/* lgfi %dst,imm */
631 		EMIT6_IMM(0xc0010000, dst_reg, imm);
632 		break;
633 	/*
634 	 * BPF_LD 64
635 	 */
636 	case BPF_LD | BPF_IMM | BPF_DW: /* dst = (u64) imm */
637 	{
638 		/* 16 byte instruction that uses two 'struct bpf_insn' */
639 		u64 imm64;
640 
641 		imm64 = (u64)(u32) insn[0].imm | ((u64)(u32) insn[1].imm) << 32;
642 		/* lgrl %dst,imm */
643 		EMIT6_PCREL_RILB(0xc4080000, dst_reg, _EMIT_CONST_U64(imm64));
644 		insn_count = 2;
645 		break;
646 	}
647 	/*
648 	 * BPF_ADD
649 	 */
650 	case BPF_ALU | BPF_ADD | BPF_X: /* dst = (u32) dst + (u32) src */
651 		/* ar %dst,%src */
652 		EMIT2(0x1a00, dst_reg, src_reg);
653 		EMIT_ZERO(dst_reg);
654 		break;
655 	case BPF_ALU64 | BPF_ADD | BPF_X: /* dst = dst + src */
656 		/* agr %dst,%src */
657 		EMIT4(0xb9080000, dst_reg, src_reg);
658 		break;
659 	case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */
660 		if (!imm)
661 			break;
662 		/* alfi %dst,imm */
663 		EMIT6_IMM(0xc20b0000, dst_reg, imm);
664 		EMIT_ZERO(dst_reg);
665 		break;
666 	case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */
667 		if (!imm)
668 			break;
669 		/* agfi %dst,imm */
670 		EMIT6_IMM(0xc2080000, dst_reg, imm);
671 		break;
672 	/*
673 	 * BPF_SUB
674 	 */
675 	case BPF_ALU | BPF_SUB | BPF_X: /* dst = (u32) dst - (u32) src */
676 		/* sr %dst,%src */
677 		EMIT2(0x1b00, dst_reg, src_reg);
678 		EMIT_ZERO(dst_reg);
679 		break;
680 	case BPF_ALU64 | BPF_SUB | BPF_X: /* dst = dst - src */
681 		/* sgr %dst,%src */
682 		EMIT4(0xb9090000, dst_reg, src_reg);
683 		break;
684 	case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */
685 		if (!imm)
686 			break;
687 		/* alfi %dst,-imm */
688 		EMIT6_IMM(0xc20b0000, dst_reg, -imm);
689 		EMIT_ZERO(dst_reg);
690 		break;
691 	case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
692 		if (!imm)
693 			break;
694 		/* agfi %dst,-imm */
695 		EMIT6_IMM(0xc2080000, dst_reg, -imm);
696 		break;
697 	/*
698 	 * BPF_MUL
699 	 */
700 	case BPF_ALU | BPF_MUL | BPF_X: /* dst = (u32) dst * (u32) src */
701 		/* msr %dst,%src */
702 		EMIT4(0xb2520000, dst_reg, src_reg);
703 		EMIT_ZERO(dst_reg);
704 		break;
705 	case BPF_ALU64 | BPF_MUL | BPF_X: /* dst = dst * src */
706 		/* msgr %dst,%src */
707 		EMIT4(0xb90c0000, dst_reg, src_reg);
708 		break;
709 	case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */
710 		if (imm == 1)
711 			break;
712 		/* msfi %r5,imm */
713 		EMIT6_IMM(0xc2010000, dst_reg, imm);
714 		EMIT_ZERO(dst_reg);
715 		break;
716 	case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */
717 		if (imm == 1)
718 			break;
719 		/* msgfi %dst,imm */
720 		EMIT6_IMM(0xc2000000, dst_reg, imm);
721 		break;
722 	/*
723 	 * BPF_DIV / BPF_MOD
724 	 */
725 	case BPF_ALU | BPF_DIV | BPF_X: /* dst = (u32) dst / (u32) src */
726 	case BPF_ALU | BPF_MOD | BPF_X: /* dst = (u32) dst % (u32) src */
727 	{
728 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
729 
730 		/* lhi %w0,0 */
731 		EMIT4_IMM(0xa7080000, REG_W0, 0);
732 		/* lr %w1,%dst */
733 		EMIT2(0x1800, REG_W1, dst_reg);
734 		/* dlr %w0,%src */
735 		EMIT4(0xb9970000, REG_W0, src_reg);
736 		/* llgfr %dst,%rc */
737 		EMIT4(0xb9160000, dst_reg, rc_reg);
738 		if (insn_is_zext(&insn[1]))
739 			insn_count = 2;
740 		break;
741 	}
742 	case BPF_ALU64 | BPF_DIV | BPF_X: /* dst = dst / src */
743 	case BPF_ALU64 | BPF_MOD | BPF_X: /* dst = dst % src */
744 	{
745 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
746 
747 		/* lghi %w0,0 */
748 		EMIT4_IMM(0xa7090000, REG_W0, 0);
749 		/* lgr %w1,%dst */
750 		EMIT4(0xb9040000, REG_W1, dst_reg);
751 		/* dlgr %w0,%dst */
752 		EMIT4(0xb9870000, REG_W0, src_reg);
753 		/* lgr %dst,%rc */
754 		EMIT4(0xb9040000, dst_reg, rc_reg);
755 		break;
756 	}
757 	case BPF_ALU | BPF_DIV | BPF_K: /* dst = (u32) dst / (u32) imm */
758 	case BPF_ALU | BPF_MOD | BPF_K: /* dst = (u32) dst % (u32) imm */
759 	{
760 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
761 
762 		if (imm == 1) {
763 			if (BPF_OP(insn->code) == BPF_MOD)
764 				/* lhgi %dst,0 */
765 				EMIT4_IMM(0xa7090000, dst_reg, 0);
766 			break;
767 		}
768 		/* lhi %w0,0 */
769 		EMIT4_IMM(0xa7080000, REG_W0, 0);
770 		/* lr %w1,%dst */
771 		EMIT2(0x1800, REG_W1, dst_reg);
772 		if (!is_first_pass(jit) && can_use_ldisp_for_lit32(jit)) {
773 			/* dl %w0,<d(imm)>(%l) */
774 			EMIT6_DISP_LH(0xe3000000, 0x0097, REG_W0, REG_0, REG_L,
775 				      EMIT_CONST_U32(imm));
776 		} else {
777 			/* lgfrl %dst,imm */
778 			EMIT6_PCREL_RILB(0xc40c0000, dst_reg,
779 					 _EMIT_CONST_U32(imm));
780 			jit->seen |= SEEN_LITERAL;
781 			/* dlr %w0,%dst */
782 			EMIT4(0xb9970000, REG_W0, dst_reg);
783 		}
784 		/* llgfr %dst,%rc */
785 		EMIT4(0xb9160000, dst_reg, rc_reg);
786 		if (insn_is_zext(&insn[1]))
787 			insn_count = 2;
788 		break;
789 	}
790 	case BPF_ALU64 | BPF_DIV | BPF_K: /* dst = dst / imm */
791 	case BPF_ALU64 | BPF_MOD | BPF_K: /* dst = dst % imm */
792 	{
793 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
794 
795 		if (imm == 1) {
796 			if (BPF_OP(insn->code) == BPF_MOD)
797 				/* lhgi %dst,0 */
798 				EMIT4_IMM(0xa7090000, dst_reg, 0);
799 			break;
800 		}
801 		/* lghi %w0,0 */
802 		EMIT4_IMM(0xa7090000, REG_W0, 0);
803 		/* lgr %w1,%dst */
804 		EMIT4(0xb9040000, REG_W1, dst_reg);
805 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
806 			/* dlg %w0,<d(imm)>(%l) */
807 			EMIT6_DISP_LH(0xe3000000, 0x0087, REG_W0, REG_0, REG_L,
808 				      EMIT_CONST_U64(imm));
809 		} else {
810 			/* lgrl %dst,imm */
811 			EMIT6_PCREL_RILB(0xc4080000, dst_reg,
812 					 _EMIT_CONST_U64(imm));
813 			jit->seen |= SEEN_LITERAL;
814 			/* dlgr %w0,%dst */
815 			EMIT4(0xb9870000, REG_W0, dst_reg);
816 		}
817 		/* lgr %dst,%rc */
818 		EMIT4(0xb9040000, dst_reg, rc_reg);
819 		break;
820 	}
821 	/*
822 	 * BPF_AND
823 	 */
824 	case BPF_ALU | BPF_AND | BPF_X: /* dst = (u32) dst & (u32) src */
825 		/* nr %dst,%src */
826 		EMIT2(0x1400, dst_reg, src_reg);
827 		EMIT_ZERO(dst_reg);
828 		break;
829 	case BPF_ALU64 | BPF_AND | BPF_X: /* dst = dst & src */
830 		/* ngr %dst,%src */
831 		EMIT4(0xb9800000, dst_reg, src_reg);
832 		break;
833 	case BPF_ALU | BPF_AND | BPF_K: /* dst = (u32) dst & (u32) imm */
834 		/* nilf %dst,imm */
835 		EMIT6_IMM(0xc00b0000, dst_reg, imm);
836 		EMIT_ZERO(dst_reg);
837 		break;
838 	case BPF_ALU64 | BPF_AND | BPF_K: /* dst = dst & imm */
839 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
840 			/* ng %dst,<d(imm)>(%l) */
841 			EMIT6_DISP_LH(0xe3000000, 0x0080,
842 				      dst_reg, REG_0, REG_L,
843 				      EMIT_CONST_U64(imm));
844 		} else {
845 			/* lgrl %w0,imm */
846 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
847 					 _EMIT_CONST_U64(imm));
848 			jit->seen |= SEEN_LITERAL;
849 			/* ngr %dst,%w0 */
850 			EMIT4(0xb9800000, dst_reg, REG_W0);
851 		}
852 		break;
853 	/*
854 	 * BPF_OR
855 	 */
856 	case BPF_ALU | BPF_OR | BPF_X: /* dst = (u32) dst | (u32) src */
857 		/* or %dst,%src */
858 		EMIT2(0x1600, dst_reg, src_reg);
859 		EMIT_ZERO(dst_reg);
860 		break;
861 	case BPF_ALU64 | BPF_OR | BPF_X: /* dst = dst | src */
862 		/* ogr %dst,%src */
863 		EMIT4(0xb9810000, dst_reg, src_reg);
864 		break;
865 	case BPF_ALU | BPF_OR | BPF_K: /* dst = (u32) dst | (u32) imm */
866 		/* oilf %dst,imm */
867 		EMIT6_IMM(0xc00d0000, dst_reg, imm);
868 		EMIT_ZERO(dst_reg);
869 		break;
870 	case BPF_ALU64 | BPF_OR | BPF_K: /* dst = dst | imm */
871 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
872 			/* og %dst,<d(imm)>(%l) */
873 			EMIT6_DISP_LH(0xe3000000, 0x0081,
874 				      dst_reg, REG_0, REG_L,
875 				      EMIT_CONST_U64(imm));
876 		} else {
877 			/* lgrl %w0,imm */
878 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
879 					 _EMIT_CONST_U64(imm));
880 			jit->seen |= SEEN_LITERAL;
881 			/* ogr %dst,%w0 */
882 			EMIT4(0xb9810000, dst_reg, REG_W0);
883 		}
884 		break;
885 	/*
886 	 * BPF_XOR
887 	 */
888 	case BPF_ALU | BPF_XOR | BPF_X: /* dst = (u32) dst ^ (u32) src */
889 		/* xr %dst,%src */
890 		EMIT2(0x1700, dst_reg, src_reg);
891 		EMIT_ZERO(dst_reg);
892 		break;
893 	case BPF_ALU64 | BPF_XOR | BPF_X: /* dst = dst ^ src */
894 		/* xgr %dst,%src */
895 		EMIT4(0xb9820000, dst_reg, src_reg);
896 		break;
897 	case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */
898 		if (!imm)
899 			break;
900 		/* xilf %dst,imm */
901 		EMIT6_IMM(0xc0070000, dst_reg, imm);
902 		EMIT_ZERO(dst_reg);
903 		break;
904 	case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */
905 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
906 			/* xg %dst,<d(imm)>(%l) */
907 			EMIT6_DISP_LH(0xe3000000, 0x0082,
908 				      dst_reg, REG_0, REG_L,
909 				      EMIT_CONST_U64(imm));
910 		} else {
911 			/* lgrl %w0,imm */
912 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
913 					 _EMIT_CONST_U64(imm));
914 			jit->seen |= SEEN_LITERAL;
915 			/* xgr %dst,%w0 */
916 			EMIT4(0xb9820000, dst_reg, REG_W0);
917 		}
918 		break;
919 	/*
920 	 * BPF_LSH
921 	 */
922 	case BPF_ALU | BPF_LSH | BPF_X: /* dst = (u32) dst << (u32) src */
923 		/* sll %dst,0(%src) */
924 		EMIT4_DISP(0x89000000, dst_reg, src_reg, 0);
925 		EMIT_ZERO(dst_reg);
926 		break;
927 	case BPF_ALU64 | BPF_LSH | BPF_X: /* dst = dst << src */
928 		/* sllg %dst,%dst,0(%src) */
929 		EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0);
930 		break;
931 	case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */
932 		if (imm == 0)
933 			break;
934 		/* sll %dst,imm(%r0) */
935 		EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
936 		EMIT_ZERO(dst_reg);
937 		break;
938 	case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */
939 		if (imm == 0)
940 			break;
941 		/* sllg %dst,%dst,imm(%r0) */
942 		EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, REG_0, imm);
943 		break;
944 	/*
945 	 * BPF_RSH
946 	 */
947 	case BPF_ALU | BPF_RSH | BPF_X: /* dst = (u32) dst >> (u32) src */
948 		/* srl %dst,0(%src) */
949 		EMIT4_DISP(0x88000000, dst_reg, src_reg, 0);
950 		EMIT_ZERO(dst_reg);
951 		break;
952 	case BPF_ALU64 | BPF_RSH | BPF_X: /* dst = dst >> src */
953 		/* srlg %dst,%dst,0(%src) */
954 		EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0);
955 		break;
956 	case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */
957 		if (imm == 0)
958 			break;
959 		/* srl %dst,imm(%r0) */
960 		EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
961 		EMIT_ZERO(dst_reg);
962 		break;
963 	case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */
964 		if (imm == 0)
965 			break;
966 		/* srlg %dst,%dst,imm(%r0) */
967 		EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, REG_0, imm);
968 		break;
969 	/*
970 	 * BPF_ARSH
971 	 */
972 	case BPF_ALU | BPF_ARSH | BPF_X: /* ((s32) dst) >>= src */
973 		/* sra %dst,%dst,0(%src) */
974 		EMIT4_DISP(0x8a000000, dst_reg, src_reg, 0);
975 		EMIT_ZERO(dst_reg);
976 		break;
977 	case BPF_ALU64 | BPF_ARSH | BPF_X: /* ((s64) dst) >>= src */
978 		/* srag %dst,%dst,0(%src) */
979 		EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, src_reg, 0);
980 		break;
981 	case BPF_ALU | BPF_ARSH | BPF_K: /* ((s32) dst >> imm */
982 		if (imm == 0)
983 			break;
984 		/* sra %dst,imm(%r0) */
985 		EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm);
986 		EMIT_ZERO(dst_reg);
987 		break;
988 	case BPF_ALU64 | BPF_ARSH | BPF_K: /* ((s64) dst) >>= imm */
989 		if (imm == 0)
990 			break;
991 		/* srag %dst,%dst,imm(%r0) */
992 		EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, REG_0, imm);
993 		break;
994 	/*
995 	 * BPF_NEG
996 	 */
997 	case BPF_ALU | BPF_NEG: /* dst = (u32) -dst */
998 		/* lcr %dst,%dst */
999 		EMIT2(0x1300, dst_reg, dst_reg);
1000 		EMIT_ZERO(dst_reg);
1001 		break;
1002 	case BPF_ALU64 | BPF_NEG: /* dst = -dst */
1003 		/* lcgr %dst,%dst */
1004 		EMIT4(0xb9030000, dst_reg, dst_reg);
1005 		break;
1006 	/*
1007 	 * BPF_FROM_BE/LE
1008 	 */
1009 	case BPF_ALU | BPF_END | BPF_FROM_BE:
1010 		/* s390 is big endian, therefore only clear high order bytes */
1011 		switch (imm) {
1012 		case 16: /* dst = (u16) cpu_to_be16(dst) */
1013 			/* llghr %dst,%dst */
1014 			EMIT4(0xb9850000, dst_reg, dst_reg);
1015 			if (insn_is_zext(&insn[1]))
1016 				insn_count = 2;
1017 			break;
1018 		case 32: /* dst = (u32) cpu_to_be32(dst) */
1019 			if (!fp->aux->verifier_zext)
1020 				/* llgfr %dst,%dst */
1021 				EMIT4(0xb9160000, dst_reg, dst_reg);
1022 			break;
1023 		case 64: /* dst = (u64) cpu_to_be64(dst) */
1024 			break;
1025 		}
1026 		break;
1027 	case BPF_ALU | BPF_END | BPF_FROM_LE:
1028 		switch (imm) {
1029 		case 16: /* dst = (u16) cpu_to_le16(dst) */
1030 			/* lrvr %dst,%dst */
1031 			EMIT4(0xb91f0000, dst_reg, dst_reg);
1032 			/* srl %dst,16(%r0) */
1033 			EMIT4_DISP(0x88000000, dst_reg, REG_0, 16);
1034 			/* llghr %dst,%dst */
1035 			EMIT4(0xb9850000, dst_reg, dst_reg);
1036 			if (insn_is_zext(&insn[1]))
1037 				insn_count = 2;
1038 			break;
1039 		case 32: /* dst = (u32) cpu_to_le32(dst) */
1040 			/* lrvr %dst,%dst */
1041 			EMIT4(0xb91f0000, dst_reg, dst_reg);
1042 			if (!fp->aux->verifier_zext)
1043 				/* llgfr %dst,%dst */
1044 				EMIT4(0xb9160000, dst_reg, dst_reg);
1045 			break;
1046 		case 64: /* dst = (u64) cpu_to_le64(dst) */
1047 			/* lrvgr %dst,%dst */
1048 			EMIT4(0xb90f0000, dst_reg, dst_reg);
1049 			break;
1050 		}
1051 		break;
1052 	/*
1053 	 * BPF_ST(X)
1054 	 */
1055 	case BPF_STX | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = src_reg */
1056 		/* stcy %src,off(%dst) */
1057 		EMIT6_DISP_LH(0xe3000000, 0x0072, src_reg, dst_reg, REG_0, off);
1058 		jit->seen |= SEEN_MEM;
1059 		break;
1060 	case BPF_STX | BPF_MEM | BPF_H: /* (u16 *)(dst + off) = src */
1061 		/* sthy %src,off(%dst) */
1062 		EMIT6_DISP_LH(0xe3000000, 0x0070, src_reg, dst_reg, REG_0, off);
1063 		jit->seen |= SEEN_MEM;
1064 		break;
1065 	case BPF_STX | BPF_MEM | BPF_W: /* *(u32 *)(dst + off) = src */
1066 		/* sty %src,off(%dst) */
1067 		EMIT6_DISP_LH(0xe3000000, 0x0050, src_reg, dst_reg, REG_0, off);
1068 		jit->seen |= SEEN_MEM;
1069 		break;
1070 	case BPF_STX | BPF_MEM | BPF_DW: /* (u64 *)(dst + off) = src */
1071 		/* stg %src,off(%dst) */
1072 		EMIT6_DISP_LH(0xe3000000, 0x0024, src_reg, dst_reg, REG_0, off);
1073 		jit->seen |= SEEN_MEM;
1074 		break;
1075 	case BPF_ST | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = imm */
1076 		/* lhi %w0,imm */
1077 		EMIT4_IMM(0xa7080000, REG_W0, (u8) imm);
1078 		/* stcy %w0,off(dst) */
1079 		EMIT6_DISP_LH(0xe3000000, 0x0072, REG_W0, dst_reg, REG_0, off);
1080 		jit->seen |= SEEN_MEM;
1081 		break;
1082 	case BPF_ST | BPF_MEM | BPF_H: /* (u16 *)(dst + off) = imm */
1083 		/* lhi %w0,imm */
1084 		EMIT4_IMM(0xa7080000, REG_W0, (u16) imm);
1085 		/* sthy %w0,off(dst) */
1086 		EMIT6_DISP_LH(0xe3000000, 0x0070, REG_W0, dst_reg, REG_0, off);
1087 		jit->seen |= SEEN_MEM;
1088 		break;
1089 	case BPF_ST | BPF_MEM | BPF_W: /* *(u32 *)(dst + off) = imm */
1090 		/* llilf %w0,imm  */
1091 		EMIT6_IMM(0xc00f0000, REG_W0, (u32) imm);
1092 		/* sty %w0,off(%dst) */
1093 		EMIT6_DISP_LH(0xe3000000, 0x0050, REG_W0, dst_reg, REG_0, off);
1094 		jit->seen |= SEEN_MEM;
1095 		break;
1096 	case BPF_ST | BPF_MEM | BPF_DW: /* *(u64 *)(dst + off) = imm */
1097 		/* lgfi %w0,imm */
1098 		EMIT6_IMM(0xc0010000, REG_W0, imm);
1099 		/* stg %w0,off(%dst) */
1100 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W0, dst_reg, REG_0, off);
1101 		jit->seen |= SEEN_MEM;
1102 		break;
1103 	/*
1104 	 * BPF_STX XADD (atomic_add)
1105 	 */
1106 	case BPF_STX | BPF_XADD | BPF_W: /* *(u32 *)(dst + off) += src */
1107 		/* laal %w0,%src,off(%dst) */
1108 		EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W0, src_reg,
1109 			      dst_reg, off);
1110 		jit->seen |= SEEN_MEM;
1111 		break;
1112 	case BPF_STX | BPF_XADD | BPF_DW: /* *(u64 *)(dst + off) += src */
1113 		/* laalg %w0,%src,off(%dst) */
1114 		EMIT6_DISP_LH(0xeb000000, 0x00ea, REG_W0, src_reg,
1115 			      dst_reg, off);
1116 		jit->seen |= SEEN_MEM;
1117 		break;
1118 	/*
1119 	 * BPF_LDX
1120 	 */
1121 	case BPF_LDX | BPF_MEM | BPF_B: /* dst = *(u8 *)(ul) (src + off) */
1122 		/* llgc %dst,0(off,%src) */
1123 		EMIT6_DISP_LH(0xe3000000, 0x0090, dst_reg, src_reg, REG_0, off);
1124 		jit->seen |= SEEN_MEM;
1125 		if (insn_is_zext(&insn[1]))
1126 			insn_count = 2;
1127 		break;
1128 	case BPF_LDX | BPF_MEM | BPF_H: /* dst = *(u16 *)(ul) (src + off) */
1129 		/* llgh %dst,0(off,%src) */
1130 		EMIT6_DISP_LH(0xe3000000, 0x0091, dst_reg, src_reg, REG_0, off);
1131 		jit->seen |= SEEN_MEM;
1132 		if (insn_is_zext(&insn[1]))
1133 			insn_count = 2;
1134 		break;
1135 	case BPF_LDX | BPF_MEM | BPF_W: /* dst = *(u32 *)(ul) (src + off) */
1136 		/* llgf %dst,off(%src) */
1137 		jit->seen |= SEEN_MEM;
1138 		EMIT6_DISP_LH(0xe3000000, 0x0016, dst_reg, src_reg, REG_0, off);
1139 		if (insn_is_zext(&insn[1]))
1140 			insn_count = 2;
1141 		break;
1142 	case BPF_LDX | BPF_MEM | BPF_DW: /* dst = *(u64 *)(ul) (src + off) */
1143 		/* lg %dst,0(off,%src) */
1144 		jit->seen |= SEEN_MEM;
1145 		EMIT6_DISP_LH(0xe3000000, 0x0004, dst_reg, src_reg, REG_0, off);
1146 		break;
1147 	/*
1148 	 * BPF_JMP / CALL
1149 	 */
1150 	case BPF_JMP | BPF_CALL:
1151 	{
1152 		u64 func;
1153 		bool func_addr_fixed;
1154 		int ret;
1155 
1156 		ret = bpf_jit_get_func_addr(fp, insn, extra_pass,
1157 					    &func, &func_addr_fixed);
1158 		if (ret < 0)
1159 			return -1;
1160 
1161 		REG_SET_SEEN(BPF_REG_5);
1162 		jit->seen |= SEEN_FUNC;
1163 		/* lgrl %w1,func */
1164 		EMIT6_PCREL_RILB(0xc4080000, REG_W1, _EMIT_CONST_U64(func));
1165 		if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable) {
1166 			/* brasl %r14,__s390_indirect_jump_r1 */
1167 			EMIT6_PCREL_RILB(0xc0050000, REG_14, jit->r1_thunk_ip);
1168 		} else {
1169 			/* basr %r14,%w1 */
1170 			EMIT2(0x0d00, REG_14, REG_W1);
1171 		}
1172 		/* lgr %b0,%r2: load return value into %b0 */
1173 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
1174 		break;
1175 	}
1176 	case BPF_JMP | BPF_TAIL_CALL:
1177 		/*
1178 		 * Implicit input:
1179 		 *  B1: pointer to ctx
1180 		 *  B2: pointer to bpf_array
1181 		 *  B3: index in bpf_array
1182 		 */
1183 		jit->seen |= SEEN_TAIL_CALL;
1184 
1185 		/*
1186 		 * if (index >= array->map.max_entries)
1187 		 *         goto out;
1188 		 */
1189 
1190 		/* llgf %w1,map.max_entries(%b2) */
1191 		EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,
1192 			      offsetof(struct bpf_array, map.max_entries));
1193 		/* if ((u32)%b3 >= (u32)%w1) goto out; */
1194 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1195 			/* clrj %b3,%w1,0xa,label0 */
1196 			EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,
1197 					  REG_W1, 0, 0xa);
1198 		} else {
1199 			/* clr %b3,%w1 */
1200 			EMIT2(0x1500, BPF_REG_3, REG_W1);
1201 			/* brcl 0xa,label0 */
1202 			EMIT6_PCREL_RILC(0xc0040000, 0xa, jit->labels[0]);
1203 		}
1204 
1205 		/*
1206 		 * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
1207 		 *         goto out;
1208 		 */
1209 
1210 		if (jit->seen & SEEN_STACK)
1211 			off = STK_OFF_TCCNT + STK_OFF + stack_depth;
1212 		else
1213 			off = STK_OFF_TCCNT;
1214 		/* lhi %w0,1 */
1215 		EMIT4_IMM(0xa7080000, REG_W0, 1);
1216 		/* laal %w1,%w0,off(%r15) */
1217 		EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0, REG_15, off);
1218 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1219 			/* clij %w1,MAX_TAIL_CALL_CNT,0x2,label0 */
1220 			EMIT6_PCREL_IMM_LABEL(0xec000000, 0x007f, REG_W1,
1221 					      MAX_TAIL_CALL_CNT, 0, 0x2);
1222 		} else {
1223 			/* clfi %w1,MAX_TAIL_CALL_CNT */
1224 			EMIT6_IMM(0xc20f0000, REG_W1, MAX_TAIL_CALL_CNT);
1225 			/* brcl 0x2,label0 */
1226 			EMIT6_PCREL_RILC(0xc0040000, 0x2, jit->labels[0]);
1227 		}
1228 
1229 		/*
1230 		 * prog = array->ptrs[index];
1231 		 * if (prog == NULL)
1232 		 *         goto out;
1233 		 */
1234 
1235 		/* llgfr %r1,%b3: %r1 = (u32) index */
1236 		EMIT4(0xb9160000, REG_1, BPF_REG_3);
1237 		/* sllg %r1,%r1,3: %r1 *= 8 */
1238 		EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);
1239 		/* ltg %r1,prog(%b2,%r1) */
1240 		EMIT6_DISP_LH(0xe3000000, 0x0002, REG_1, BPF_REG_2,
1241 			      REG_1, offsetof(struct bpf_array, ptrs));
1242 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1243 			/* brc 0x8,label0 */
1244 			EMIT4_PCREL_RIC(0xa7040000, 0x8, jit->labels[0]);
1245 		} else {
1246 			/* brcl 0x8,label0 */
1247 			EMIT6_PCREL_RILC(0xc0040000, 0x8, jit->labels[0]);
1248 		}
1249 
1250 		/*
1251 		 * Restore registers before calling function
1252 		 */
1253 		save_restore_regs(jit, REGS_RESTORE, stack_depth);
1254 
1255 		/*
1256 		 * goto *(prog->bpf_func + tail_call_start);
1257 		 */
1258 
1259 		/* lg %r1,bpf_func(%r1) */
1260 		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, REG_1, REG_0,
1261 			      offsetof(struct bpf_prog, bpf_func));
1262 		/* bc 0xf,tail_call_start(%r1) */
1263 		_EMIT4(0x47f01000 + jit->tail_call_start);
1264 		/* out: */
1265 		jit->labels[0] = jit->prg;
1266 		break;
1267 	case BPF_JMP | BPF_EXIT: /* return b0 */
1268 		last = (i == fp->len - 1) ? 1 : 0;
1269 		if (last)
1270 			break;
1271 		/* j <exit> */
1272 		EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
1273 		break;
1274 	/*
1275 	 * Branch relative (number of skipped instructions) to offset on
1276 	 * condition.
1277 	 *
1278 	 * Condition code to mask mapping:
1279 	 *
1280 	 * CC | Description	   | Mask
1281 	 * ------------------------------
1282 	 * 0  | Operands equal	   |	8
1283 	 * 1  | First operand low  |	4
1284 	 * 2  | First operand high |	2
1285 	 * 3  | Unused		   |	1
1286 	 *
1287 	 * For s390x relative branches: ip = ip + off_bytes
1288 	 * For BPF relative branches:	insn = insn + off_insns + 1
1289 	 *
1290 	 * For example for s390x with offset 0 we jump to the branch
1291 	 * instruction itself (loop) and for BPF with offset 0 we
1292 	 * branch to the instruction behind the branch.
1293 	 */
1294 	case BPF_JMP | BPF_JA: /* if (true) */
1295 		mask = 0xf000; /* j */
1296 		goto branch_oc;
1297 	case BPF_JMP | BPF_JSGT | BPF_K: /* ((s64) dst > (s64) imm) */
1298 	case BPF_JMP32 | BPF_JSGT | BPF_K: /* ((s32) dst > (s32) imm) */
1299 		mask = 0x2000; /* jh */
1300 		goto branch_ks;
1301 	case BPF_JMP | BPF_JSLT | BPF_K: /* ((s64) dst < (s64) imm) */
1302 	case BPF_JMP32 | BPF_JSLT | BPF_K: /* ((s32) dst < (s32) imm) */
1303 		mask = 0x4000; /* jl */
1304 		goto branch_ks;
1305 	case BPF_JMP | BPF_JSGE | BPF_K: /* ((s64) dst >= (s64) imm) */
1306 	case BPF_JMP32 | BPF_JSGE | BPF_K: /* ((s32) dst >= (s32) imm) */
1307 		mask = 0xa000; /* jhe */
1308 		goto branch_ks;
1309 	case BPF_JMP | BPF_JSLE | BPF_K: /* ((s64) dst <= (s64) imm) */
1310 	case BPF_JMP32 | BPF_JSLE | BPF_K: /* ((s32) dst <= (s32) imm) */
1311 		mask = 0xc000; /* jle */
1312 		goto branch_ks;
1313 	case BPF_JMP | BPF_JGT | BPF_K: /* (dst_reg > imm) */
1314 	case BPF_JMP32 | BPF_JGT | BPF_K: /* ((u32) dst_reg > (u32) imm) */
1315 		mask = 0x2000; /* jh */
1316 		goto branch_ku;
1317 	case BPF_JMP | BPF_JLT | BPF_K: /* (dst_reg < imm) */
1318 	case BPF_JMP32 | BPF_JLT | BPF_K: /* ((u32) dst_reg < (u32) imm) */
1319 		mask = 0x4000; /* jl */
1320 		goto branch_ku;
1321 	case BPF_JMP | BPF_JGE | BPF_K: /* (dst_reg >= imm) */
1322 	case BPF_JMP32 | BPF_JGE | BPF_K: /* ((u32) dst_reg >= (u32) imm) */
1323 		mask = 0xa000; /* jhe */
1324 		goto branch_ku;
1325 	case BPF_JMP | BPF_JLE | BPF_K: /* (dst_reg <= imm) */
1326 	case BPF_JMP32 | BPF_JLE | BPF_K: /* ((u32) dst_reg <= (u32) imm) */
1327 		mask = 0xc000; /* jle */
1328 		goto branch_ku;
1329 	case BPF_JMP | BPF_JNE | BPF_K: /* (dst_reg != imm) */
1330 	case BPF_JMP32 | BPF_JNE | BPF_K: /* ((u32) dst_reg != (u32) imm) */
1331 		mask = 0x7000; /* jne */
1332 		goto branch_ku;
1333 	case BPF_JMP | BPF_JEQ | BPF_K: /* (dst_reg == imm) */
1334 	case BPF_JMP32 | BPF_JEQ | BPF_K: /* ((u32) dst_reg == (u32) imm) */
1335 		mask = 0x8000; /* je */
1336 		goto branch_ku;
1337 	case BPF_JMP | BPF_JSET | BPF_K: /* (dst_reg & imm) */
1338 	case BPF_JMP32 | BPF_JSET | BPF_K: /* ((u32) dst_reg & (u32) imm) */
1339 		mask = 0x7000; /* jnz */
1340 		if (BPF_CLASS(insn->code) == BPF_JMP32) {
1341 			/* llilf %w1,imm (load zero extend imm) */
1342 			EMIT6_IMM(0xc00f0000, REG_W1, imm);
1343 			/* nr %w1,%dst */
1344 			EMIT2(0x1400, REG_W1, dst_reg);
1345 		} else {
1346 			/* lgfi %w1,imm (load sign extend imm) */
1347 			EMIT6_IMM(0xc0010000, REG_W1, imm);
1348 			/* ngr %w1,%dst */
1349 			EMIT4(0xb9800000, REG_W1, dst_reg);
1350 		}
1351 		goto branch_oc;
1352 
1353 	case BPF_JMP | BPF_JSGT | BPF_X: /* ((s64) dst > (s64) src) */
1354 	case BPF_JMP32 | BPF_JSGT | BPF_X: /* ((s32) dst > (s32) src) */
1355 		mask = 0x2000; /* jh */
1356 		goto branch_xs;
1357 	case BPF_JMP | BPF_JSLT | BPF_X: /* ((s64) dst < (s64) src) */
1358 	case BPF_JMP32 | BPF_JSLT | BPF_X: /* ((s32) dst < (s32) src) */
1359 		mask = 0x4000; /* jl */
1360 		goto branch_xs;
1361 	case BPF_JMP | BPF_JSGE | BPF_X: /* ((s64) dst >= (s64) src) */
1362 	case BPF_JMP32 | BPF_JSGE | BPF_X: /* ((s32) dst >= (s32) src) */
1363 		mask = 0xa000; /* jhe */
1364 		goto branch_xs;
1365 	case BPF_JMP | BPF_JSLE | BPF_X: /* ((s64) dst <= (s64) src) */
1366 	case BPF_JMP32 | BPF_JSLE | BPF_X: /* ((s32) dst <= (s32) src) */
1367 		mask = 0xc000; /* jle */
1368 		goto branch_xs;
1369 	case BPF_JMP | BPF_JGT | BPF_X: /* (dst > src) */
1370 	case BPF_JMP32 | BPF_JGT | BPF_X: /* ((u32) dst > (u32) src) */
1371 		mask = 0x2000; /* jh */
1372 		goto branch_xu;
1373 	case BPF_JMP | BPF_JLT | BPF_X: /* (dst < src) */
1374 	case BPF_JMP32 | BPF_JLT | BPF_X: /* ((u32) dst < (u32) src) */
1375 		mask = 0x4000; /* jl */
1376 		goto branch_xu;
1377 	case BPF_JMP | BPF_JGE | BPF_X: /* (dst >= src) */
1378 	case BPF_JMP32 | BPF_JGE | BPF_X: /* ((u32) dst >= (u32) src) */
1379 		mask = 0xa000; /* jhe */
1380 		goto branch_xu;
1381 	case BPF_JMP | BPF_JLE | BPF_X: /* (dst <= src) */
1382 	case BPF_JMP32 | BPF_JLE | BPF_X: /* ((u32) dst <= (u32) src) */
1383 		mask = 0xc000; /* jle */
1384 		goto branch_xu;
1385 	case BPF_JMP | BPF_JNE | BPF_X: /* (dst != src) */
1386 	case BPF_JMP32 | BPF_JNE | BPF_X: /* ((u32) dst != (u32) src) */
1387 		mask = 0x7000; /* jne */
1388 		goto branch_xu;
1389 	case BPF_JMP | BPF_JEQ | BPF_X: /* (dst == src) */
1390 	case BPF_JMP32 | BPF_JEQ | BPF_X: /* ((u32) dst == (u32) src) */
1391 		mask = 0x8000; /* je */
1392 		goto branch_xu;
1393 	case BPF_JMP | BPF_JSET | BPF_X: /* (dst & src) */
1394 	case BPF_JMP32 | BPF_JSET | BPF_X: /* ((u32) dst & (u32) src) */
1395 	{
1396 		bool is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1397 
1398 		mask = 0x7000; /* jnz */
1399 		/* nrk or ngrk %w1,%dst,%src */
1400 		EMIT4_RRF((is_jmp32 ? 0xb9f40000 : 0xb9e40000),
1401 			  REG_W1, dst_reg, src_reg);
1402 		goto branch_oc;
1403 branch_ks:
1404 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1405 		/* cfi or cgfi %dst,imm */
1406 		EMIT6_IMM(is_jmp32 ? 0xc20d0000 : 0xc20c0000,
1407 			  dst_reg, imm);
1408 		if (!is_first_pass(jit) &&
1409 		    can_use_rel(jit, addrs[i + off + 1])) {
1410 			/* brc mask,off */
1411 			EMIT4_PCREL_RIC(0xa7040000,
1412 					mask >> 12, addrs[i + off + 1]);
1413 		} else {
1414 			/* brcl mask,off */
1415 			EMIT6_PCREL_RILC(0xc0040000,
1416 					 mask >> 12, addrs[i + off + 1]);
1417 		}
1418 		break;
1419 branch_ku:
1420 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1421 		/* clfi or clgfi %dst,imm */
1422 		EMIT6_IMM(is_jmp32 ? 0xc20f0000 : 0xc20e0000,
1423 			  dst_reg, imm);
1424 		if (!is_first_pass(jit) &&
1425 		    can_use_rel(jit, addrs[i + off + 1])) {
1426 			/* brc mask,off */
1427 			EMIT4_PCREL_RIC(0xa7040000,
1428 					mask >> 12, addrs[i + off + 1]);
1429 		} else {
1430 			/* brcl mask,off */
1431 			EMIT6_PCREL_RILC(0xc0040000,
1432 					 mask >> 12, addrs[i + off + 1]);
1433 		}
1434 		break;
1435 branch_xs:
1436 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1437 		if (!is_first_pass(jit) &&
1438 		    can_use_rel(jit, addrs[i + off + 1])) {
1439 			/* crj or cgrj %dst,%src,mask,off */
1440 			EMIT6_PCREL(0xec000000, (is_jmp32 ? 0x0076 : 0x0064),
1441 				    dst_reg, src_reg, i, off, mask);
1442 		} else {
1443 			/* cr or cgr %dst,%src */
1444 			if (is_jmp32)
1445 				EMIT2(0x1900, dst_reg, src_reg);
1446 			else
1447 				EMIT4(0xb9200000, dst_reg, src_reg);
1448 			/* brcl mask,off */
1449 			EMIT6_PCREL_RILC(0xc0040000,
1450 					 mask >> 12, addrs[i + off + 1]);
1451 		}
1452 		break;
1453 branch_xu:
1454 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1455 		if (!is_first_pass(jit) &&
1456 		    can_use_rel(jit, addrs[i + off + 1])) {
1457 			/* clrj or clgrj %dst,%src,mask,off */
1458 			EMIT6_PCREL(0xec000000, (is_jmp32 ? 0x0077 : 0x0065),
1459 				    dst_reg, src_reg, i, off, mask);
1460 		} else {
1461 			/* clr or clgr %dst,%src */
1462 			if (is_jmp32)
1463 				EMIT2(0x1500, dst_reg, src_reg);
1464 			else
1465 				EMIT4(0xb9210000, dst_reg, src_reg);
1466 			/* brcl mask,off */
1467 			EMIT6_PCREL_RILC(0xc0040000,
1468 					 mask >> 12, addrs[i + off + 1]);
1469 		}
1470 		break;
1471 branch_oc:
1472 		if (!is_first_pass(jit) &&
1473 		    can_use_rel(jit, addrs[i + off + 1])) {
1474 			/* brc mask,off */
1475 			EMIT4_PCREL_RIC(0xa7040000,
1476 					mask >> 12, addrs[i + off + 1]);
1477 		} else {
1478 			/* brcl mask,off */
1479 			EMIT6_PCREL_RILC(0xc0040000,
1480 					 mask >> 12, addrs[i + off + 1]);
1481 		}
1482 		break;
1483 	}
1484 	default: /* too complex, give up */
1485 		pr_err("Unknown opcode %02x\n", insn->code);
1486 		return -1;
1487 	}
1488 	return insn_count;
1489 }
1490 
1491 /*
1492  * Return whether new i-th instruction address does not violate any invariant
1493  */
1494 static bool bpf_is_new_addr_sane(struct bpf_jit *jit, int i)
1495 {
1496 	/* On the first pass anything goes */
1497 	if (is_first_pass(jit))
1498 		return true;
1499 
1500 	/* The codegen pass must not change anything */
1501 	if (is_codegen_pass(jit))
1502 		return jit->addrs[i] == jit->prg;
1503 
1504 	/* Passes in between must not increase code size */
1505 	return jit->addrs[i] >= jit->prg;
1506 }
1507 
1508 /*
1509  * Update the address of i-th instruction
1510  */
1511 static int bpf_set_addr(struct bpf_jit *jit, int i)
1512 {
1513 	if (!bpf_is_new_addr_sane(jit, i))
1514 		return -1;
1515 	jit->addrs[i] = jit->prg;
1516 	return 0;
1517 }
1518 
1519 /*
1520  * Compile eBPF program into s390x code
1521  */
1522 static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp,
1523 			bool extra_pass, u32 stack_depth)
1524 {
1525 	int i, insn_count, lit32_size, lit64_size;
1526 
1527 	jit->lit32 = jit->lit32_start;
1528 	jit->lit64 = jit->lit64_start;
1529 	jit->prg = 0;
1530 
1531 	bpf_jit_prologue(jit, stack_depth);
1532 	if (bpf_set_addr(jit, 0) < 0)
1533 		return -1;
1534 	for (i = 0; i < fp->len; i += insn_count) {
1535 		insn_count = bpf_jit_insn(jit, fp, i, extra_pass, stack_depth);
1536 		if (insn_count < 0)
1537 			return -1;
1538 		/* Next instruction address */
1539 		if (bpf_set_addr(jit, i + insn_count) < 0)
1540 			return -1;
1541 	}
1542 	bpf_jit_epilogue(jit, stack_depth);
1543 
1544 	lit32_size = jit->lit32 - jit->lit32_start;
1545 	lit64_size = jit->lit64 - jit->lit64_start;
1546 	jit->lit32_start = jit->prg;
1547 	if (lit32_size)
1548 		jit->lit32_start = ALIGN(jit->lit32_start, 4);
1549 	jit->lit64_start = jit->lit32_start + lit32_size;
1550 	if (lit64_size)
1551 		jit->lit64_start = ALIGN(jit->lit64_start, 8);
1552 	jit->size = jit->lit64_start + lit64_size;
1553 	jit->size_prg = jit->prg;
1554 	return 0;
1555 }
1556 
1557 bool bpf_jit_needs_zext(void)
1558 {
1559 	return true;
1560 }
1561 
1562 struct s390_jit_data {
1563 	struct bpf_binary_header *header;
1564 	struct bpf_jit ctx;
1565 	int pass;
1566 };
1567 
1568 /*
1569  * Compile eBPF program "fp"
1570  */
1571 struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
1572 {
1573 	u32 stack_depth = round_up(fp->aux->stack_depth, 8);
1574 	struct bpf_prog *tmp, *orig_fp = fp;
1575 	struct bpf_binary_header *header;
1576 	struct s390_jit_data *jit_data;
1577 	bool tmp_blinded = false;
1578 	bool extra_pass = false;
1579 	struct bpf_jit jit;
1580 	int pass;
1581 
1582 	if (!fp->jit_requested)
1583 		return orig_fp;
1584 
1585 	tmp = bpf_jit_blind_constants(fp);
1586 	/*
1587 	 * If blinding was requested and we failed during blinding,
1588 	 * we must fall back to the interpreter.
1589 	 */
1590 	if (IS_ERR(tmp))
1591 		return orig_fp;
1592 	if (tmp != fp) {
1593 		tmp_blinded = true;
1594 		fp = tmp;
1595 	}
1596 
1597 	jit_data = fp->aux->jit_data;
1598 	if (!jit_data) {
1599 		jit_data = kzalloc(sizeof(*jit_data), GFP_KERNEL);
1600 		if (!jit_data) {
1601 			fp = orig_fp;
1602 			goto out;
1603 		}
1604 		fp->aux->jit_data = jit_data;
1605 	}
1606 	if (jit_data->ctx.addrs) {
1607 		jit = jit_data->ctx;
1608 		header = jit_data->header;
1609 		extra_pass = true;
1610 		pass = jit_data->pass + 1;
1611 		goto skip_init_ctx;
1612 	}
1613 
1614 	memset(&jit, 0, sizeof(jit));
1615 	jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL);
1616 	if (jit.addrs == NULL) {
1617 		fp = orig_fp;
1618 		goto out;
1619 	}
1620 	/*
1621 	 * Three initial passes:
1622 	 *   - 1/2: Determine clobbered registers
1623 	 *   - 3:   Calculate program size and addrs arrray
1624 	 */
1625 	for (pass = 1; pass <= 3; pass++) {
1626 		if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) {
1627 			fp = orig_fp;
1628 			goto free_addrs;
1629 		}
1630 	}
1631 	/*
1632 	 * Final pass: Allocate and generate program
1633 	 */
1634 	header = bpf_jit_binary_alloc(jit.size, &jit.prg_buf, 8, jit_fill_hole);
1635 	if (!header) {
1636 		fp = orig_fp;
1637 		goto free_addrs;
1638 	}
1639 skip_init_ctx:
1640 	if (bpf_jit_prog(&jit, fp, extra_pass, stack_depth)) {
1641 		bpf_jit_binary_free(header);
1642 		fp = orig_fp;
1643 		goto free_addrs;
1644 	}
1645 	if (bpf_jit_enable > 1) {
1646 		bpf_jit_dump(fp->len, jit.size, pass, jit.prg_buf);
1647 		print_fn_code(jit.prg_buf, jit.size_prg);
1648 	}
1649 	if (!fp->is_func || extra_pass) {
1650 		bpf_jit_binary_lock_ro(header);
1651 	} else {
1652 		jit_data->header = header;
1653 		jit_data->ctx = jit;
1654 		jit_data->pass = pass;
1655 	}
1656 	fp->bpf_func = (void *) jit.prg_buf;
1657 	fp->jited = 1;
1658 	fp->jited_len = jit.size;
1659 
1660 	if (!fp->is_func || extra_pass) {
1661 		bpf_prog_fill_jited_linfo(fp, jit.addrs + 1);
1662 free_addrs:
1663 		kvfree(jit.addrs);
1664 		kfree(jit_data);
1665 		fp->aux->jit_data = NULL;
1666 	}
1667 out:
1668 	if (tmp_blinded)
1669 		bpf_jit_prog_release_other(fp, fp == orig_fp ?
1670 					   tmp : orig_fp);
1671 	return fp;
1672 }
1673