xref: /openbmc/linux/arch/s390/net/bpf_jit_comp.c (revision be122522)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * BPF Jit compiler for s390.
4  *
5  * Minimum build requirements:
6  *
7  *  - HAVE_MARCH_Z196_FEATURES: laal, laalg
8  *  - HAVE_MARCH_Z10_FEATURES: msfi, cgrj, clgrj
9  *  - HAVE_MARCH_Z9_109_FEATURES: alfi, llilf, clfi, oilf, nilf
10  *  - PACK_STACK
11  *  - 64BIT
12  *
13  * Copyright IBM Corp. 2012,2015
14  *
15  * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
16  *	      Michael Holzheu <holzheu@linux.vnet.ibm.com>
17  */
18 
19 #define KMSG_COMPONENT "bpf_jit"
20 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
21 
22 #include <linux/netdevice.h>
23 #include <linux/filter.h>
24 #include <linux/init.h>
25 #include <linux/bpf.h>
26 #include <linux/mm.h>
27 #include <linux/kernel.h>
28 #include <asm/cacheflush.h>
29 #include <asm/dis.h>
30 #include <asm/facility.h>
31 #include <asm/nospec-branch.h>
32 #include <asm/set_memory.h>
33 #include "bpf_jit.h"
34 
35 struct bpf_jit {
36 	u32 seen;		/* Flags to remember seen eBPF instructions */
37 	u32 seen_reg[16];	/* Array to remember which registers are used */
38 	u32 *addrs;		/* Array with relative instruction addresses */
39 	u8 *prg_buf;		/* Start of program */
40 	int size;		/* Size of program and literal pool */
41 	int size_prg;		/* Size of program */
42 	int prg;		/* Current position in program */
43 	int lit32_start;	/* Start of 32-bit literal pool */
44 	int lit32;		/* Current position in 32-bit literal pool */
45 	int lit64_start;	/* Start of 64-bit literal pool */
46 	int lit64;		/* Current position in 64-bit literal pool */
47 	int base_ip;		/* Base address for literal pool */
48 	int exit_ip;		/* Address of exit */
49 	int r1_thunk_ip;	/* Address of expoline thunk for 'br %r1' */
50 	int r14_thunk_ip;	/* Address of expoline thunk for 'br %r14' */
51 	int tail_call_start;	/* Tail call start offset */
52 	int labels[1];		/* Labels for local jumps */
53 };
54 
55 #define SEEN_MEM	BIT(0)		/* use mem[] for temporary storage */
56 #define SEEN_LITERAL	BIT(1)		/* code uses literals */
57 #define SEEN_FUNC	BIT(2)		/* calls C functions */
58 #define SEEN_TAIL_CALL	BIT(3)		/* code uses tail calls */
59 #define SEEN_STACK	(SEEN_FUNC | SEEN_MEM)
60 
61 /*
62  * s390 registers
63  */
64 #define REG_W0		(MAX_BPF_JIT_REG + 0)	/* Work register 1 (even) */
65 #define REG_W1		(MAX_BPF_JIT_REG + 1)	/* Work register 2 (odd) */
66 #define REG_L		(MAX_BPF_JIT_REG + 2)	/* Literal pool register */
67 #define REG_15		(MAX_BPF_JIT_REG + 3)	/* Register 15 */
68 #define REG_0		REG_W0			/* Register 0 */
69 #define REG_1		REG_W1			/* Register 1 */
70 #define REG_2		BPF_REG_1		/* Register 2 */
71 #define REG_14		BPF_REG_0		/* Register 14 */
72 
73 /*
74  * Mapping of BPF registers to s390 registers
75  */
76 static const int reg2hex[] = {
77 	/* Return code */
78 	[BPF_REG_0]	= 14,
79 	/* Function parameters */
80 	[BPF_REG_1]	= 2,
81 	[BPF_REG_2]	= 3,
82 	[BPF_REG_3]	= 4,
83 	[BPF_REG_4]	= 5,
84 	[BPF_REG_5]	= 6,
85 	/* Call saved registers */
86 	[BPF_REG_6]	= 7,
87 	[BPF_REG_7]	= 8,
88 	[BPF_REG_8]	= 9,
89 	[BPF_REG_9]	= 10,
90 	/* BPF stack pointer */
91 	[BPF_REG_FP]	= 13,
92 	/* Register for blinding */
93 	[BPF_REG_AX]	= 12,
94 	/* Work registers for s390x backend */
95 	[REG_W0]	= 0,
96 	[REG_W1]	= 1,
97 	[REG_L]		= 11,
98 	[REG_15]	= 15,
99 };
100 
101 static inline u32 reg(u32 dst_reg, u32 src_reg)
102 {
103 	return reg2hex[dst_reg] << 4 | reg2hex[src_reg];
104 }
105 
106 static inline u32 reg_high(u32 reg)
107 {
108 	return reg2hex[reg] << 4;
109 }
110 
111 static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
112 {
113 	u32 r1 = reg2hex[b1];
114 
115 	if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
116 		jit->seen_reg[r1] = 1;
117 }
118 
119 #define REG_SET_SEEN(b1)					\
120 ({								\
121 	reg_set_seen(jit, b1);					\
122 })
123 
124 #define REG_SEEN(b1) jit->seen_reg[reg2hex[(b1)]]
125 
126 /*
127  * EMIT macros for code generation
128  */
129 
130 #define _EMIT2(op)						\
131 ({								\
132 	if (jit->prg_buf)					\
133 		*(u16 *) (jit->prg_buf + jit->prg) = (op);	\
134 	jit->prg += 2;						\
135 })
136 
137 #define EMIT2(op, b1, b2)					\
138 ({								\
139 	_EMIT2((op) | reg(b1, b2));				\
140 	REG_SET_SEEN(b1);					\
141 	REG_SET_SEEN(b2);					\
142 })
143 
144 #define _EMIT4(op)						\
145 ({								\
146 	if (jit->prg_buf)					\
147 		*(u32 *) (jit->prg_buf + jit->prg) = (op);	\
148 	jit->prg += 4;						\
149 })
150 
151 #define EMIT4(op, b1, b2)					\
152 ({								\
153 	_EMIT4((op) | reg(b1, b2));				\
154 	REG_SET_SEEN(b1);					\
155 	REG_SET_SEEN(b2);					\
156 })
157 
158 #define EMIT4_RRF(op, b1, b2, b3)				\
159 ({								\
160 	_EMIT4((op) | reg_high(b3) << 8 | reg(b1, b2));		\
161 	REG_SET_SEEN(b1);					\
162 	REG_SET_SEEN(b2);					\
163 	REG_SET_SEEN(b3);					\
164 })
165 
166 #define _EMIT4_DISP(op, disp)					\
167 ({								\
168 	unsigned int __disp = (disp) & 0xfff;			\
169 	_EMIT4((op) | __disp);					\
170 })
171 
172 #define EMIT4_DISP(op, b1, b2, disp)				\
173 ({								\
174 	_EMIT4_DISP((op) | reg_high(b1) << 16 |			\
175 		    reg_high(b2) << 8, (disp));			\
176 	REG_SET_SEEN(b1);					\
177 	REG_SET_SEEN(b2);					\
178 })
179 
180 #define EMIT4_IMM(op, b1, imm)					\
181 ({								\
182 	unsigned int __imm = (imm) & 0xffff;			\
183 	_EMIT4((op) | reg_high(b1) << 16 | __imm);		\
184 	REG_SET_SEEN(b1);					\
185 })
186 
187 #define EMIT4_PCREL(op, pcrel)					\
188 ({								\
189 	long __pcrel = ((pcrel) >> 1) & 0xffff;			\
190 	_EMIT4((op) | __pcrel);					\
191 })
192 
193 #define EMIT4_PCREL_RIC(op, mask, target)			\
194 ({								\
195 	int __rel = ((target) - jit->prg) / 2;			\
196 	_EMIT4((op) | (mask) << 20 | (__rel & 0xffff));		\
197 })
198 
199 #define _EMIT6(op1, op2)					\
200 ({								\
201 	if (jit->prg_buf) {					\
202 		*(u32 *) (jit->prg_buf + jit->prg) = (op1);	\
203 		*(u16 *) (jit->prg_buf + jit->prg + 4) = (op2);	\
204 	}							\
205 	jit->prg += 6;						\
206 })
207 
208 #define _EMIT6_DISP(op1, op2, disp)				\
209 ({								\
210 	unsigned int __disp = (disp) & 0xfff;			\
211 	_EMIT6((op1) | __disp, op2);				\
212 })
213 
214 #define _EMIT6_DISP_LH(op1, op2, disp)				\
215 ({								\
216 	u32 _disp = (u32) (disp);				\
217 	unsigned int __disp_h = _disp & 0xff000;		\
218 	unsigned int __disp_l = _disp & 0x00fff;		\
219 	_EMIT6((op1) | __disp_l, (op2) | __disp_h >> 4);	\
220 })
221 
222 #define EMIT6_DISP_LH(op1, op2, b1, b2, b3, disp)		\
223 ({								\
224 	_EMIT6_DISP_LH((op1) | reg(b1, b2) << 16 |		\
225 		       reg_high(b3) << 8, op2, disp);		\
226 	REG_SET_SEEN(b1);					\
227 	REG_SET_SEEN(b2);					\
228 	REG_SET_SEEN(b3);					\
229 })
230 
231 #define EMIT6_PCREL_LABEL(op1, op2, b1, b2, label, mask)	\
232 ({								\
233 	int rel = (jit->labels[label] - jit->prg) >> 1;		\
234 	_EMIT6((op1) | reg(b1, b2) << 16 | (rel & 0xffff),	\
235 	       (op2) | (mask) << 12);				\
236 	REG_SET_SEEN(b1);					\
237 	REG_SET_SEEN(b2);					\
238 })
239 
240 #define EMIT6_PCREL_IMM_LABEL(op1, op2, b1, imm, label, mask)	\
241 ({								\
242 	int rel = (jit->labels[label] - jit->prg) >> 1;		\
243 	_EMIT6((op1) | (reg_high(b1) | (mask)) << 16 |		\
244 		(rel & 0xffff), (op2) | ((imm) & 0xff) << 8);	\
245 	REG_SET_SEEN(b1);					\
246 	BUILD_BUG_ON(((unsigned long) (imm)) > 0xff);		\
247 })
248 
249 #define EMIT6_PCREL(op1, op2, b1, b2, i, off, mask)		\
250 ({								\
251 	/* Branch instruction needs 6 bytes */			\
252 	int rel = (addrs[(i) + (off) + 1] - (addrs[(i) + 1] - 6)) / 2;\
253 	_EMIT6((op1) | reg(b1, b2) << 16 | (rel & 0xffff), (op2) | (mask));\
254 	REG_SET_SEEN(b1);					\
255 	REG_SET_SEEN(b2);					\
256 })
257 
258 #define EMIT6_PCREL_RILB(op, b, target)				\
259 ({								\
260 	unsigned int rel = (int)((target) - jit->prg) / 2;	\
261 	_EMIT6((op) | reg_high(b) << 16 | rel >> 16, rel & 0xffff);\
262 	REG_SET_SEEN(b);					\
263 })
264 
265 #define EMIT6_PCREL_RIL(op, target)				\
266 ({								\
267 	unsigned int rel = (int)((target) - jit->prg) / 2;	\
268 	_EMIT6((op) | rel >> 16, rel & 0xffff);			\
269 })
270 
271 #define EMIT6_PCREL_RILC(op, mask, target)			\
272 ({								\
273 	EMIT6_PCREL_RIL((op) | (mask) << 20, (target));		\
274 })
275 
276 #define _EMIT6_IMM(op, imm)					\
277 ({								\
278 	unsigned int __imm = (imm);				\
279 	_EMIT6((op) | (__imm >> 16), __imm & 0xffff);		\
280 })
281 
282 #define EMIT6_IMM(op, b1, imm)					\
283 ({								\
284 	_EMIT6_IMM((op) | reg_high(b1) << 16, imm);		\
285 	REG_SET_SEEN(b1);					\
286 })
287 
288 #define _EMIT_CONST_U32(val)					\
289 ({								\
290 	unsigned int ret;					\
291 	ret = jit->lit32;					\
292 	if (jit->prg_buf)					\
293 		*(u32 *)(jit->prg_buf + jit->lit32) = (u32)(val);\
294 	jit->lit32 += 4;					\
295 	ret;							\
296 })
297 
298 #define EMIT_CONST_U32(val)					\
299 ({								\
300 	jit->seen |= SEEN_LITERAL;				\
301 	_EMIT_CONST_U32(val) - jit->base_ip;			\
302 })
303 
304 #define _EMIT_CONST_U64(val)					\
305 ({								\
306 	unsigned int ret;					\
307 	ret = jit->lit64;					\
308 	if (jit->prg_buf)					\
309 		*(u64 *)(jit->prg_buf + jit->lit64) = (u64)(val);\
310 	jit->lit64 += 8;					\
311 	ret;							\
312 })
313 
314 #define EMIT_CONST_U64(val)					\
315 ({								\
316 	jit->seen |= SEEN_LITERAL;				\
317 	_EMIT_CONST_U64(val) - jit->base_ip;			\
318 })
319 
320 #define EMIT_ZERO(b1)						\
321 ({								\
322 	if (!fp->aux->verifier_zext) {				\
323 		/* llgfr %dst,%dst (zero extend to 64 bit) */	\
324 		EMIT4(0xb9160000, b1, b1);			\
325 		REG_SET_SEEN(b1);				\
326 	}							\
327 })
328 
329 /*
330  * Return whether this is the first pass. The first pass is special, since we
331  * don't know any sizes yet, and thus must be conservative.
332  */
333 static bool is_first_pass(struct bpf_jit *jit)
334 {
335 	return jit->size == 0;
336 }
337 
338 /*
339  * Return whether this is the code generation pass. The code generation pass is
340  * special, since we should change as little as possible.
341  */
342 static bool is_codegen_pass(struct bpf_jit *jit)
343 {
344 	return jit->prg_buf;
345 }
346 
347 /*
348  * Return whether "rel" can be encoded as a short PC-relative offset
349  */
350 static bool is_valid_rel(int rel)
351 {
352 	return rel >= -65536 && rel <= 65534;
353 }
354 
355 /*
356  * Return whether "off" can be reached using a short PC-relative offset
357  */
358 static bool can_use_rel(struct bpf_jit *jit, int off)
359 {
360 	return is_valid_rel(off - jit->prg);
361 }
362 
363 /*
364  * Return whether given displacement can be encoded using
365  * Long-Displacement Facility
366  */
367 static bool is_valid_ldisp(int disp)
368 {
369 	return disp >= -524288 && disp <= 524287;
370 }
371 
372 /*
373  * Return whether the next 32-bit literal pool entry can be referenced using
374  * Long-Displacement Facility
375  */
376 static bool can_use_ldisp_for_lit32(struct bpf_jit *jit)
377 {
378 	return is_valid_ldisp(jit->lit32 - jit->base_ip);
379 }
380 
381 /*
382  * Return whether the next 64-bit literal pool entry can be referenced using
383  * Long-Displacement Facility
384  */
385 static bool can_use_ldisp_for_lit64(struct bpf_jit *jit)
386 {
387 	return is_valid_ldisp(jit->lit64 - jit->base_ip);
388 }
389 
390 /*
391  * Fill whole space with illegal instructions
392  */
393 static void jit_fill_hole(void *area, unsigned int size)
394 {
395 	memset(area, 0, size);
396 }
397 
398 /*
399  * Save registers from "rs" (register start) to "re" (register end) on stack
400  */
401 static void save_regs(struct bpf_jit *jit, u32 rs, u32 re)
402 {
403 	u32 off = STK_OFF_R6 + (rs - 6) * 8;
404 
405 	if (rs == re)
406 		/* stg %rs,off(%r15) */
407 		_EMIT6(0xe300f000 | rs << 20 | off, 0x0024);
408 	else
409 		/* stmg %rs,%re,off(%r15) */
410 		_EMIT6_DISP(0xeb00f000 | rs << 20 | re << 16, 0x0024, off);
411 }
412 
413 /*
414  * Restore registers from "rs" (register start) to "re" (register end) on stack
415  */
416 static void restore_regs(struct bpf_jit *jit, u32 rs, u32 re, u32 stack_depth)
417 {
418 	u32 off = STK_OFF_R6 + (rs - 6) * 8;
419 
420 	if (jit->seen & SEEN_STACK)
421 		off += STK_OFF + stack_depth;
422 
423 	if (rs == re)
424 		/* lg %rs,off(%r15) */
425 		_EMIT6(0xe300f000 | rs << 20 | off, 0x0004);
426 	else
427 		/* lmg %rs,%re,off(%r15) */
428 		_EMIT6_DISP(0xeb00f000 | rs << 20 | re << 16, 0x0004, off);
429 }
430 
431 /*
432  * Return first seen register (from start)
433  */
434 static int get_start(struct bpf_jit *jit, int start)
435 {
436 	int i;
437 
438 	for (i = start; i <= 15; i++) {
439 		if (jit->seen_reg[i])
440 			return i;
441 	}
442 	return 0;
443 }
444 
445 /*
446  * Return last seen register (from start) (gap >= 2)
447  */
448 static int get_end(struct bpf_jit *jit, int start)
449 {
450 	int i;
451 
452 	for (i = start; i < 15; i++) {
453 		if (!jit->seen_reg[i] && !jit->seen_reg[i + 1])
454 			return i - 1;
455 	}
456 	return jit->seen_reg[15] ? 15 : 14;
457 }
458 
459 #define REGS_SAVE	1
460 #define REGS_RESTORE	0
461 /*
462  * Save and restore clobbered registers (6-15) on stack.
463  * We save/restore registers in chunks with gap >= 2 registers.
464  */
465 static void save_restore_regs(struct bpf_jit *jit, int op, u32 stack_depth)
466 {
467 	const int last = 15, save_restore_size = 6;
468 	int re = 6, rs;
469 
470 	if (is_first_pass(jit)) {
471 		/*
472 		 * We don't know yet which registers are used. Reserve space
473 		 * conservatively.
474 		 */
475 		jit->prg += (last - re + 1) * save_restore_size;
476 		return;
477 	}
478 
479 	do {
480 		rs = get_start(jit, re);
481 		if (!rs)
482 			break;
483 		re = get_end(jit, rs + 1);
484 		if (op == REGS_SAVE)
485 			save_regs(jit, rs, re);
486 		else
487 			restore_regs(jit, rs, re, stack_depth);
488 		re++;
489 	} while (re <= last);
490 }
491 
492 /*
493  * Emit function prologue
494  *
495  * Save registers and create stack frame if necessary.
496  * See stack frame layout desription in "bpf_jit.h"!
497  */
498 static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth)
499 {
500 	if (jit->seen & SEEN_TAIL_CALL) {
501 		/* xc STK_OFF_TCCNT(4,%r15),STK_OFF_TCCNT(%r15) */
502 		_EMIT6(0xd703f000 | STK_OFF_TCCNT, 0xf000 | STK_OFF_TCCNT);
503 	} else {
504 		/* j tail_call_start: NOP if no tail calls are used */
505 		EMIT4_PCREL(0xa7f40000, 6);
506 		_EMIT2(0);
507 	}
508 	/* Tail calls have to skip above initialization */
509 	jit->tail_call_start = jit->prg;
510 	/* Save registers */
511 	save_restore_regs(jit, REGS_SAVE, stack_depth);
512 	/* Setup literal pool */
513 	if (is_first_pass(jit) || (jit->seen & SEEN_LITERAL)) {
514 		if (!is_first_pass(jit) &&
515 		    is_valid_ldisp(jit->size - (jit->prg + 2))) {
516 			/* basr %l,0 */
517 			EMIT2(0x0d00, REG_L, REG_0);
518 			jit->base_ip = jit->prg;
519 		} else {
520 			/* larl %l,lit32_start */
521 			EMIT6_PCREL_RILB(0xc0000000, REG_L, jit->lit32_start);
522 			jit->base_ip = jit->lit32_start;
523 		}
524 	}
525 	/* Setup stack and backchain */
526 	if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) {
527 		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
528 			/* lgr %w1,%r15 (backchain) */
529 			EMIT4(0xb9040000, REG_W1, REG_15);
530 		/* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */
531 		EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED);
532 		/* aghi %r15,-STK_OFF */
533 		EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth));
534 		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
535 			/* stg %w1,152(%r15) (backchain) */
536 			EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
537 				      REG_15, 152);
538 	}
539 }
540 
541 /*
542  * Function epilogue
543  */
544 static void bpf_jit_epilogue(struct bpf_jit *jit, u32 stack_depth)
545 {
546 	jit->exit_ip = jit->prg;
547 	/* Load exit code: lgr %r2,%b0 */
548 	EMIT4(0xb9040000, REG_2, BPF_REG_0);
549 	/* Restore registers */
550 	save_restore_regs(jit, REGS_RESTORE, stack_depth);
551 	if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable) {
552 		jit->r14_thunk_ip = jit->prg;
553 		/* Generate __s390_indirect_jump_r14 thunk */
554 		if (test_facility(35)) {
555 			/* exrl %r0,.+10 */
556 			EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10);
557 		} else {
558 			/* larl %r1,.+14 */
559 			EMIT6_PCREL_RILB(0xc0000000, REG_1, jit->prg + 14);
560 			/* ex 0,0(%r1) */
561 			EMIT4_DISP(0x44000000, REG_0, REG_1, 0);
562 		}
563 		/* j . */
564 		EMIT4_PCREL(0xa7f40000, 0);
565 	}
566 	/* br %r14 */
567 	_EMIT2(0x07fe);
568 
569 	if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable &&
570 	    (is_first_pass(jit) || (jit->seen & SEEN_FUNC))) {
571 		jit->r1_thunk_ip = jit->prg;
572 		/* Generate __s390_indirect_jump_r1 thunk */
573 		if (test_facility(35)) {
574 			/* exrl %r0,.+10 */
575 			EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10);
576 			/* j . */
577 			EMIT4_PCREL(0xa7f40000, 0);
578 			/* br %r1 */
579 			_EMIT2(0x07f1);
580 		} else {
581 			/* ex 0,S390_lowcore.br_r1_tampoline */
582 			EMIT4_DISP(0x44000000, REG_0, REG_0,
583 				   offsetof(struct lowcore, br_r1_trampoline));
584 			/* j . */
585 			EMIT4_PCREL(0xa7f40000, 0);
586 		}
587 	}
588 }
589 
590 /*
591  * Compile one eBPF instruction into s390x code
592  *
593  * NOTE: Use noinline because for gcov (-fprofile-arcs) gcc allocates a lot of
594  * stack space for the large switch statement.
595  */
596 static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
597 				 int i, bool extra_pass)
598 {
599 	struct bpf_insn *insn = &fp->insnsi[i];
600 	u32 dst_reg = insn->dst_reg;
601 	u32 src_reg = insn->src_reg;
602 	int last, insn_count = 1;
603 	u32 *addrs = jit->addrs;
604 	s32 imm = insn->imm;
605 	s16 off = insn->off;
606 	unsigned int mask;
607 
608 	switch (insn->code) {
609 	/*
610 	 * BPF_MOV
611 	 */
612 	case BPF_ALU | BPF_MOV | BPF_X: /* dst = (u32) src */
613 		/* llgfr %dst,%src */
614 		EMIT4(0xb9160000, dst_reg, src_reg);
615 		if (insn_is_zext(&insn[1]))
616 			insn_count = 2;
617 		break;
618 	case BPF_ALU64 | BPF_MOV | BPF_X: /* dst = src */
619 		/* lgr %dst,%src */
620 		EMIT4(0xb9040000, dst_reg, src_reg);
621 		break;
622 	case BPF_ALU | BPF_MOV | BPF_K: /* dst = (u32) imm */
623 		/* llilf %dst,imm */
624 		EMIT6_IMM(0xc00f0000, dst_reg, imm);
625 		if (insn_is_zext(&insn[1]))
626 			insn_count = 2;
627 		break;
628 	case BPF_ALU64 | BPF_MOV | BPF_K: /* dst = imm */
629 		/* lgfi %dst,imm */
630 		EMIT6_IMM(0xc0010000, dst_reg, imm);
631 		break;
632 	/*
633 	 * BPF_LD 64
634 	 */
635 	case BPF_LD | BPF_IMM | BPF_DW: /* dst = (u64) imm */
636 	{
637 		/* 16 byte instruction that uses two 'struct bpf_insn' */
638 		u64 imm64;
639 
640 		imm64 = (u64)(u32) insn[0].imm | ((u64)(u32) insn[1].imm) << 32;
641 		/* lgrl %dst,imm */
642 		EMIT6_PCREL_RILB(0xc4080000, dst_reg, _EMIT_CONST_U64(imm64));
643 		insn_count = 2;
644 		break;
645 	}
646 	/*
647 	 * BPF_ADD
648 	 */
649 	case BPF_ALU | BPF_ADD | BPF_X: /* dst = (u32) dst + (u32) src */
650 		/* ar %dst,%src */
651 		EMIT2(0x1a00, dst_reg, src_reg);
652 		EMIT_ZERO(dst_reg);
653 		break;
654 	case BPF_ALU64 | BPF_ADD | BPF_X: /* dst = dst + src */
655 		/* agr %dst,%src */
656 		EMIT4(0xb9080000, dst_reg, src_reg);
657 		break;
658 	case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */
659 		if (!imm)
660 			break;
661 		/* alfi %dst,imm */
662 		EMIT6_IMM(0xc20b0000, dst_reg, imm);
663 		EMIT_ZERO(dst_reg);
664 		break;
665 	case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */
666 		if (!imm)
667 			break;
668 		/* agfi %dst,imm */
669 		EMIT6_IMM(0xc2080000, dst_reg, imm);
670 		break;
671 	/*
672 	 * BPF_SUB
673 	 */
674 	case BPF_ALU | BPF_SUB | BPF_X: /* dst = (u32) dst - (u32) src */
675 		/* sr %dst,%src */
676 		EMIT2(0x1b00, dst_reg, src_reg);
677 		EMIT_ZERO(dst_reg);
678 		break;
679 	case BPF_ALU64 | BPF_SUB | BPF_X: /* dst = dst - src */
680 		/* sgr %dst,%src */
681 		EMIT4(0xb9090000, dst_reg, src_reg);
682 		break;
683 	case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */
684 		if (!imm)
685 			break;
686 		/* alfi %dst,-imm */
687 		EMIT6_IMM(0xc20b0000, dst_reg, -imm);
688 		EMIT_ZERO(dst_reg);
689 		break;
690 	case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
691 		if (!imm)
692 			break;
693 		/* agfi %dst,-imm */
694 		EMIT6_IMM(0xc2080000, dst_reg, -imm);
695 		break;
696 	/*
697 	 * BPF_MUL
698 	 */
699 	case BPF_ALU | BPF_MUL | BPF_X: /* dst = (u32) dst * (u32) src */
700 		/* msr %dst,%src */
701 		EMIT4(0xb2520000, dst_reg, src_reg);
702 		EMIT_ZERO(dst_reg);
703 		break;
704 	case BPF_ALU64 | BPF_MUL | BPF_X: /* dst = dst * src */
705 		/* msgr %dst,%src */
706 		EMIT4(0xb90c0000, dst_reg, src_reg);
707 		break;
708 	case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */
709 		if (imm == 1)
710 			break;
711 		/* msfi %r5,imm */
712 		EMIT6_IMM(0xc2010000, dst_reg, imm);
713 		EMIT_ZERO(dst_reg);
714 		break;
715 	case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */
716 		if (imm == 1)
717 			break;
718 		/* msgfi %dst,imm */
719 		EMIT6_IMM(0xc2000000, dst_reg, imm);
720 		break;
721 	/*
722 	 * BPF_DIV / BPF_MOD
723 	 */
724 	case BPF_ALU | BPF_DIV | BPF_X: /* dst = (u32) dst / (u32) src */
725 	case BPF_ALU | BPF_MOD | BPF_X: /* dst = (u32) dst % (u32) src */
726 	{
727 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
728 
729 		/* lhi %w0,0 */
730 		EMIT4_IMM(0xa7080000, REG_W0, 0);
731 		/* lr %w1,%dst */
732 		EMIT2(0x1800, REG_W1, dst_reg);
733 		/* dlr %w0,%src */
734 		EMIT4(0xb9970000, REG_W0, src_reg);
735 		/* llgfr %dst,%rc */
736 		EMIT4(0xb9160000, dst_reg, rc_reg);
737 		if (insn_is_zext(&insn[1]))
738 			insn_count = 2;
739 		break;
740 	}
741 	case BPF_ALU64 | BPF_DIV | BPF_X: /* dst = dst / src */
742 	case BPF_ALU64 | BPF_MOD | BPF_X: /* dst = dst % src */
743 	{
744 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
745 
746 		/* lghi %w0,0 */
747 		EMIT4_IMM(0xa7090000, REG_W0, 0);
748 		/* lgr %w1,%dst */
749 		EMIT4(0xb9040000, REG_W1, dst_reg);
750 		/* dlgr %w0,%dst */
751 		EMIT4(0xb9870000, REG_W0, src_reg);
752 		/* lgr %dst,%rc */
753 		EMIT4(0xb9040000, dst_reg, rc_reg);
754 		break;
755 	}
756 	case BPF_ALU | BPF_DIV | BPF_K: /* dst = (u32) dst / (u32) imm */
757 	case BPF_ALU | BPF_MOD | BPF_K: /* dst = (u32) dst % (u32) imm */
758 	{
759 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
760 
761 		if (imm == 1) {
762 			if (BPF_OP(insn->code) == BPF_MOD)
763 				/* lhgi %dst,0 */
764 				EMIT4_IMM(0xa7090000, dst_reg, 0);
765 			break;
766 		}
767 		/* lhi %w0,0 */
768 		EMIT4_IMM(0xa7080000, REG_W0, 0);
769 		/* lr %w1,%dst */
770 		EMIT2(0x1800, REG_W1, dst_reg);
771 		if (!is_first_pass(jit) && can_use_ldisp_for_lit32(jit)) {
772 			/* dl %w0,<d(imm)>(%l) */
773 			EMIT6_DISP_LH(0xe3000000, 0x0097, REG_W0, REG_0, REG_L,
774 				      EMIT_CONST_U32(imm));
775 		} else {
776 			/* lgfrl %dst,imm */
777 			EMIT6_PCREL_RILB(0xc40c0000, dst_reg,
778 					 _EMIT_CONST_U32(imm));
779 			jit->seen |= SEEN_LITERAL;
780 			/* dlr %w0,%dst */
781 			EMIT4(0xb9970000, REG_W0, dst_reg);
782 		}
783 		/* llgfr %dst,%rc */
784 		EMIT4(0xb9160000, dst_reg, rc_reg);
785 		if (insn_is_zext(&insn[1]))
786 			insn_count = 2;
787 		break;
788 	}
789 	case BPF_ALU64 | BPF_DIV | BPF_K: /* dst = dst / imm */
790 	case BPF_ALU64 | BPF_MOD | BPF_K: /* dst = dst % imm */
791 	{
792 		int rc_reg = BPF_OP(insn->code) == BPF_DIV ? REG_W1 : REG_W0;
793 
794 		if (imm == 1) {
795 			if (BPF_OP(insn->code) == BPF_MOD)
796 				/* lhgi %dst,0 */
797 				EMIT4_IMM(0xa7090000, dst_reg, 0);
798 			break;
799 		}
800 		/* lghi %w0,0 */
801 		EMIT4_IMM(0xa7090000, REG_W0, 0);
802 		/* lgr %w1,%dst */
803 		EMIT4(0xb9040000, REG_W1, dst_reg);
804 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
805 			/* dlg %w0,<d(imm)>(%l) */
806 			EMIT6_DISP_LH(0xe3000000, 0x0087, REG_W0, REG_0, REG_L,
807 				      EMIT_CONST_U64(imm));
808 		} else {
809 			/* lgrl %dst,imm */
810 			EMIT6_PCREL_RILB(0xc4080000, dst_reg,
811 					 _EMIT_CONST_U64(imm));
812 			jit->seen |= SEEN_LITERAL;
813 			/* dlgr %w0,%dst */
814 			EMIT4(0xb9870000, REG_W0, dst_reg);
815 		}
816 		/* lgr %dst,%rc */
817 		EMIT4(0xb9040000, dst_reg, rc_reg);
818 		break;
819 	}
820 	/*
821 	 * BPF_AND
822 	 */
823 	case BPF_ALU | BPF_AND | BPF_X: /* dst = (u32) dst & (u32) src */
824 		/* nr %dst,%src */
825 		EMIT2(0x1400, dst_reg, src_reg);
826 		EMIT_ZERO(dst_reg);
827 		break;
828 	case BPF_ALU64 | BPF_AND | BPF_X: /* dst = dst & src */
829 		/* ngr %dst,%src */
830 		EMIT4(0xb9800000, dst_reg, src_reg);
831 		break;
832 	case BPF_ALU | BPF_AND | BPF_K: /* dst = (u32) dst & (u32) imm */
833 		/* nilf %dst,imm */
834 		EMIT6_IMM(0xc00b0000, dst_reg, imm);
835 		EMIT_ZERO(dst_reg);
836 		break;
837 	case BPF_ALU64 | BPF_AND | BPF_K: /* dst = dst & imm */
838 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
839 			/* ng %dst,<d(imm)>(%l) */
840 			EMIT6_DISP_LH(0xe3000000, 0x0080,
841 				      dst_reg, REG_0, REG_L,
842 				      EMIT_CONST_U64(imm));
843 		} else {
844 			/* lgrl %w0,imm */
845 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
846 					 _EMIT_CONST_U64(imm));
847 			jit->seen |= SEEN_LITERAL;
848 			/* ngr %dst,%w0 */
849 			EMIT4(0xb9800000, dst_reg, REG_W0);
850 		}
851 		break;
852 	/*
853 	 * BPF_OR
854 	 */
855 	case BPF_ALU | BPF_OR | BPF_X: /* dst = (u32) dst | (u32) src */
856 		/* or %dst,%src */
857 		EMIT2(0x1600, dst_reg, src_reg);
858 		EMIT_ZERO(dst_reg);
859 		break;
860 	case BPF_ALU64 | BPF_OR | BPF_X: /* dst = dst | src */
861 		/* ogr %dst,%src */
862 		EMIT4(0xb9810000, dst_reg, src_reg);
863 		break;
864 	case BPF_ALU | BPF_OR | BPF_K: /* dst = (u32) dst | (u32) imm */
865 		/* oilf %dst,imm */
866 		EMIT6_IMM(0xc00d0000, dst_reg, imm);
867 		EMIT_ZERO(dst_reg);
868 		break;
869 	case BPF_ALU64 | BPF_OR | BPF_K: /* dst = dst | imm */
870 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
871 			/* og %dst,<d(imm)>(%l) */
872 			EMIT6_DISP_LH(0xe3000000, 0x0081,
873 				      dst_reg, REG_0, REG_L,
874 				      EMIT_CONST_U64(imm));
875 		} else {
876 			/* lgrl %w0,imm */
877 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
878 					 _EMIT_CONST_U64(imm));
879 			jit->seen |= SEEN_LITERAL;
880 			/* ogr %dst,%w0 */
881 			EMIT4(0xb9810000, dst_reg, REG_W0);
882 		}
883 		break;
884 	/*
885 	 * BPF_XOR
886 	 */
887 	case BPF_ALU | BPF_XOR | BPF_X: /* dst = (u32) dst ^ (u32) src */
888 		/* xr %dst,%src */
889 		EMIT2(0x1700, dst_reg, src_reg);
890 		EMIT_ZERO(dst_reg);
891 		break;
892 	case BPF_ALU64 | BPF_XOR | BPF_X: /* dst = dst ^ src */
893 		/* xgr %dst,%src */
894 		EMIT4(0xb9820000, dst_reg, src_reg);
895 		break;
896 	case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */
897 		if (!imm)
898 			break;
899 		/* xilf %dst,imm */
900 		EMIT6_IMM(0xc0070000, dst_reg, imm);
901 		EMIT_ZERO(dst_reg);
902 		break;
903 	case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */
904 		if (!is_first_pass(jit) && can_use_ldisp_for_lit64(jit)) {
905 			/* xg %dst,<d(imm)>(%l) */
906 			EMIT6_DISP_LH(0xe3000000, 0x0082,
907 				      dst_reg, REG_0, REG_L,
908 				      EMIT_CONST_U64(imm));
909 		} else {
910 			/* lgrl %w0,imm */
911 			EMIT6_PCREL_RILB(0xc4080000, REG_W0,
912 					 _EMIT_CONST_U64(imm));
913 			jit->seen |= SEEN_LITERAL;
914 			/* xgr %dst,%w0 */
915 			EMIT4(0xb9820000, dst_reg, REG_W0);
916 		}
917 		break;
918 	/*
919 	 * BPF_LSH
920 	 */
921 	case BPF_ALU | BPF_LSH | BPF_X: /* dst = (u32) dst << (u32) src */
922 		/* sll %dst,0(%src) */
923 		EMIT4_DISP(0x89000000, dst_reg, src_reg, 0);
924 		EMIT_ZERO(dst_reg);
925 		break;
926 	case BPF_ALU64 | BPF_LSH | BPF_X: /* dst = dst << src */
927 		/* sllg %dst,%dst,0(%src) */
928 		EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0);
929 		break;
930 	case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */
931 		if (imm == 0)
932 			break;
933 		/* sll %dst,imm(%r0) */
934 		EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
935 		EMIT_ZERO(dst_reg);
936 		break;
937 	case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */
938 		if (imm == 0)
939 			break;
940 		/* sllg %dst,%dst,imm(%r0) */
941 		EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, REG_0, imm);
942 		break;
943 	/*
944 	 * BPF_RSH
945 	 */
946 	case BPF_ALU | BPF_RSH | BPF_X: /* dst = (u32) dst >> (u32) src */
947 		/* srl %dst,0(%src) */
948 		EMIT4_DISP(0x88000000, dst_reg, src_reg, 0);
949 		EMIT_ZERO(dst_reg);
950 		break;
951 	case BPF_ALU64 | BPF_RSH | BPF_X: /* dst = dst >> src */
952 		/* srlg %dst,%dst,0(%src) */
953 		EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0);
954 		break;
955 	case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */
956 		if (imm == 0)
957 			break;
958 		/* srl %dst,imm(%r0) */
959 		EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
960 		EMIT_ZERO(dst_reg);
961 		break;
962 	case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */
963 		if (imm == 0)
964 			break;
965 		/* srlg %dst,%dst,imm(%r0) */
966 		EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, REG_0, imm);
967 		break;
968 	/*
969 	 * BPF_ARSH
970 	 */
971 	case BPF_ALU | BPF_ARSH | BPF_X: /* ((s32) dst) >>= src */
972 		/* sra %dst,%dst,0(%src) */
973 		EMIT4_DISP(0x8a000000, dst_reg, src_reg, 0);
974 		EMIT_ZERO(dst_reg);
975 		break;
976 	case BPF_ALU64 | BPF_ARSH | BPF_X: /* ((s64) dst) >>= src */
977 		/* srag %dst,%dst,0(%src) */
978 		EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, src_reg, 0);
979 		break;
980 	case BPF_ALU | BPF_ARSH | BPF_K: /* ((s32) dst >> imm */
981 		if (imm == 0)
982 			break;
983 		/* sra %dst,imm(%r0) */
984 		EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm);
985 		EMIT_ZERO(dst_reg);
986 		break;
987 	case BPF_ALU64 | BPF_ARSH | BPF_K: /* ((s64) dst) >>= imm */
988 		if (imm == 0)
989 			break;
990 		/* srag %dst,%dst,imm(%r0) */
991 		EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, REG_0, imm);
992 		break;
993 	/*
994 	 * BPF_NEG
995 	 */
996 	case BPF_ALU | BPF_NEG: /* dst = (u32) -dst */
997 		/* lcr %dst,%dst */
998 		EMIT2(0x1300, dst_reg, dst_reg);
999 		EMIT_ZERO(dst_reg);
1000 		break;
1001 	case BPF_ALU64 | BPF_NEG: /* dst = -dst */
1002 		/* lcgr %dst,%dst */
1003 		EMIT4(0xb9030000, dst_reg, dst_reg);
1004 		break;
1005 	/*
1006 	 * BPF_FROM_BE/LE
1007 	 */
1008 	case BPF_ALU | BPF_END | BPF_FROM_BE:
1009 		/* s390 is big endian, therefore only clear high order bytes */
1010 		switch (imm) {
1011 		case 16: /* dst = (u16) cpu_to_be16(dst) */
1012 			/* llghr %dst,%dst */
1013 			EMIT4(0xb9850000, dst_reg, dst_reg);
1014 			if (insn_is_zext(&insn[1]))
1015 				insn_count = 2;
1016 			break;
1017 		case 32: /* dst = (u32) cpu_to_be32(dst) */
1018 			if (!fp->aux->verifier_zext)
1019 				/* llgfr %dst,%dst */
1020 				EMIT4(0xb9160000, dst_reg, dst_reg);
1021 			break;
1022 		case 64: /* dst = (u64) cpu_to_be64(dst) */
1023 			break;
1024 		}
1025 		break;
1026 	case BPF_ALU | BPF_END | BPF_FROM_LE:
1027 		switch (imm) {
1028 		case 16: /* dst = (u16) cpu_to_le16(dst) */
1029 			/* lrvr %dst,%dst */
1030 			EMIT4(0xb91f0000, dst_reg, dst_reg);
1031 			/* srl %dst,16(%r0) */
1032 			EMIT4_DISP(0x88000000, dst_reg, REG_0, 16);
1033 			/* llghr %dst,%dst */
1034 			EMIT4(0xb9850000, dst_reg, dst_reg);
1035 			if (insn_is_zext(&insn[1]))
1036 				insn_count = 2;
1037 			break;
1038 		case 32: /* dst = (u32) cpu_to_le32(dst) */
1039 			/* lrvr %dst,%dst */
1040 			EMIT4(0xb91f0000, dst_reg, dst_reg);
1041 			if (!fp->aux->verifier_zext)
1042 				/* llgfr %dst,%dst */
1043 				EMIT4(0xb9160000, dst_reg, dst_reg);
1044 			break;
1045 		case 64: /* dst = (u64) cpu_to_le64(dst) */
1046 			/* lrvgr %dst,%dst */
1047 			EMIT4(0xb90f0000, dst_reg, dst_reg);
1048 			break;
1049 		}
1050 		break;
1051 	/*
1052 	 * BPF_ST(X)
1053 	 */
1054 	case BPF_STX | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = src_reg */
1055 		/* stcy %src,off(%dst) */
1056 		EMIT6_DISP_LH(0xe3000000, 0x0072, src_reg, dst_reg, REG_0, off);
1057 		jit->seen |= SEEN_MEM;
1058 		break;
1059 	case BPF_STX | BPF_MEM | BPF_H: /* (u16 *)(dst + off) = src */
1060 		/* sthy %src,off(%dst) */
1061 		EMIT6_DISP_LH(0xe3000000, 0x0070, src_reg, dst_reg, REG_0, off);
1062 		jit->seen |= SEEN_MEM;
1063 		break;
1064 	case BPF_STX | BPF_MEM | BPF_W: /* *(u32 *)(dst + off) = src */
1065 		/* sty %src,off(%dst) */
1066 		EMIT6_DISP_LH(0xe3000000, 0x0050, src_reg, dst_reg, REG_0, off);
1067 		jit->seen |= SEEN_MEM;
1068 		break;
1069 	case BPF_STX | BPF_MEM | BPF_DW: /* (u64 *)(dst + off) = src */
1070 		/* stg %src,off(%dst) */
1071 		EMIT6_DISP_LH(0xe3000000, 0x0024, src_reg, dst_reg, REG_0, off);
1072 		jit->seen |= SEEN_MEM;
1073 		break;
1074 	case BPF_ST | BPF_MEM | BPF_B: /* *(u8 *)(dst + off) = imm */
1075 		/* lhi %w0,imm */
1076 		EMIT4_IMM(0xa7080000, REG_W0, (u8) imm);
1077 		/* stcy %w0,off(dst) */
1078 		EMIT6_DISP_LH(0xe3000000, 0x0072, REG_W0, dst_reg, REG_0, off);
1079 		jit->seen |= SEEN_MEM;
1080 		break;
1081 	case BPF_ST | BPF_MEM | BPF_H: /* (u16 *)(dst + off) = imm */
1082 		/* lhi %w0,imm */
1083 		EMIT4_IMM(0xa7080000, REG_W0, (u16) imm);
1084 		/* sthy %w0,off(dst) */
1085 		EMIT6_DISP_LH(0xe3000000, 0x0070, REG_W0, dst_reg, REG_0, off);
1086 		jit->seen |= SEEN_MEM;
1087 		break;
1088 	case BPF_ST | BPF_MEM | BPF_W: /* *(u32 *)(dst + off) = imm */
1089 		/* llilf %w0,imm  */
1090 		EMIT6_IMM(0xc00f0000, REG_W0, (u32) imm);
1091 		/* sty %w0,off(%dst) */
1092 		EMIT6_DISP_LH(0xe3000000, 0x0050, REG_W0, dst_reg, REG_0, off);
1093 		jit->seen |= SEEN_MEM;
1094 		break;
1095 	case BPF_ST | BPF_MEM | BPF_DW: /* *(u64 *)(dst + off) = imm */
1096 		/* lgfi %w0,imm */
1097 		EMIT6_IMM(0xc0010000, REG_W0, imm);
1098 		/* stg %w0,off(%dst) */
1099 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W0, dst_reg, REG_0, off);
1100 		jit->seen |= SEEN_MEM;
1101 		break;
1102 	/*
1103 	 * BPF_STX XADD (atomic_add)
1104 	 */
1105 	case BPF_STX | BPF_XADD | BPF_W: /* *(u32 *)(dst + off) += src */
1106 		/* laal %w0,%src,off(%dst) */
1107 		EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W0, src_reg,
1108 			      dst_reg, off);
1109 		jit->seen |= SEEN_MEM;
1110 		break;
1111 	case BPF_STX | BPF_XADD | BPF_DW: /* *(u64 *)(dst + off) += src */
1112 		/* laalg %w0,%src,off(%dst) */
1113 		EMIT6_DISP_LH(0xeb000000, 0x00ea, REG_W0, src_reg,
1114 			      dst_reg, off);
1115 		jit->seen |= SEEN_MEM;
1116 		break;
1117 	/*
1118 	 * BPF_LDX
1119 	 */
1120 	case BPF_LDX | BPF_MEM | BPF_B: /* dst = *(u8 *)(ul) (src + off) */
1121 		/* llgc %dst,0(off,%src) */
1122 		EMIT6_DISP_LH(0xe3000000, 0x0090, dst_reg, src_reg, REG_0, off);
1123 		jit->seen |= SEEN_MEM;
1124 		if (insn_is_zext(&insn[1]))
1125 			insn_count = 2;
1126 		break;
1127 	case BPF_LDX | BPF_MEM | BPF_H: /* dst = *(u16 *)(ul) (src + off) */
1128 		/* llgh %dst,0(off,%src) */
1129 		EMIT6_DISP_LH(0xe3000000, 0x0091, dst_reg, src_reg, REG_0, off);
1130 		jit->seen |= SEEN_MEM;
1131 		if (insn_is_zext(&insn[1]))
1132 			insn_count = 2;
1133 		break;
1134 	case BPF_LDX | BPF_MEM | BPF_W: /* dst = *(u32 *)(ul) (src + off) */
1135 		/* llgf %dst,off(%src) */
1136 		jit->seen |= SEEN_MEM;
1137 		EMIT6_DISP_LH(0xe3000000, 0x0016, dst_reg, src_reg, REG_0, off);
1138 		if (insn_is_zext(&insn[1]))
1139 			insn_count = 2;
1140 		break;
1141 	case BPF_LDX | BPF_MEM | BPF_DW: /* dst = *(u64 *)(ul) (src + off) */
1142 		/* lg %dst,0(off,%src) */
1143 		jit->seen |= SEEN_MEM;
1144 		EMIT6_DISP_LH(0xe3000000, 0x0004, dst_reg, src_reg, REG_0, off);
1145 		break;
1146 	/*
1147 	 * BPF_JMP / CALL
1148 	 */
1149 	case BPF_JMP | BPF_CALL:
1150 	{
1151 		u64 func;
1152 		bool func_addr_fixed;
1153 		int ret;
1154 
1155 		ret = bpf_jit_get_func_addr(fp, insn, extra_pass,
1156 					    &func, &func_addr_fixed);
1157 		if (ret < 0)
1158 			return -1;
1159 
1160 		REG_SET_SEEN(BPF_REG_5);
1161 		jit->seen |= SEEN_FUNC;
1162 		/* lgrl %w1,func */
1163 		EMIT6_PCREL_RILB(0xc4080000, REG_W1, _EMIT_CONST_U64(func));
1164 		if (__is_defined(CC_USING_EXPOLINE) && !nospec_disable) {
1165 			/* brasl %r14,__s390_indirect_jump_r1 */
1166 			EMIT6_PCREL_RILB(0xc0050000, REG_14, jit->r1_thunk_ip);
1167 		} else {
1168 			/* basr %r14,%w1 */
1169 			EMIT2(0x0d00, REG_14, REG_W1);
1170 		}
1171 		/* lgr %b0,%r2: load return value into %b0 */
1172 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
1173 		break;
1174 	}
1175 	case BPF_JMP | BPF_TAIL_CALL:
1176 		/*
1177 		 * Implicit input:
1178 		 *  B1: pointer to ctx
1179 		 *  B2: pointer to bpf_array
1180 		 *  B3: index in bpf_array
1181 		 */
1182 		jit->seen |= SEEN_TAIL_CALL;
1183 
1184 		/*
1185 		 * if (index >= array->map.max_entries)
1186 		 *         goto out;
1187 		 */
1188 
1189 		/* llgf %w1,map.max_entries(%b2) */
1190 		EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,
1191 			      offsetof(struct bpf_array, map.max_entries));
1192 		/* if ((u32)%b3 >= (u32)%w1) goto out; */
1193 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1194 			/* clrj %b3,%w1,0xa,label0 */
1195 			EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,
1196 					  REG_W1, 0, 0xa);
1197 		} else {
1198 			/* clr %b3,%w1 */
1199 			EMIT2(0x1500, BPF_REG_3, REG_W1);
1200 			/* brcl 0xa,label0 */
1201 			EMIT6_PCREL_RILC(0xc0040000, 0xa, jit->labels[0]);
1202 		}
1203 
1204 		/*
1205 		 * if (tail_call_cnt++ > MAX_TAIL_CALL_CNT)
1206 		 *         goto out;
1207 		 */
1208 
1209 		if (jit->seen & SEEN_STACK)
1210 			off = STK_OFF_TCCNT + STK_OFF + fp->aux->stack_depth;
1211 		else
1212 			off = STK_OFF_TCCNT;
1213 		/* lhi %w0,1 */
1214 		EMIT4_IMM(0xa7080000, REG_W0, 1);
1215 		/* laal %w1,%w0,off(%r15) */
1216 		EMIT6_DISP_LH(0xeb000000, 0x00fa, REG_W1, REG_W0, REG_15, off);
1217 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1218 			/* clij %w1,MAX_TAIL_CALL_CNT,0x2,label0 */
1219 			EMIT6_PCREL_IMM_LABEL(0xec000000, 0x007f, REG_W1,
1220 					      MAX_TAIL_CALL_CNT, 0, 0x2);
1221 		} else {
1222 			/* clfi %w1,MAX_TAIL_CALL_CNT */
1223 			EMIT6_IMM(0xc20f0000, REG_W1, MAX_TAIL_CALL_CNT);
1224 			/* brcl 0x2,label0 */
1225 			EMIT6_PCREL_RILC(0xc0040000, 0x2, jit->labels[0]);
1226 		}
1227 
1228 		/*
1229 		 * prog = array->ptrs[index];
1230 		 * if (prog == NULL)
1231 		 *         goto out;
1232 		 */
1233 
1234 		/* llgfr %r1,%b3: %r1 = (u32) index */
1235 		EMIT4(0xb9160000, REG_1, BPF_REG_3);
1236 		/* sllg %r1,%r1,3: %r1 *= 8 */
1237 		EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);
1238 		/* ltg %r1,prog(%b2,%r1) */
1239 		EMIT6_DISP_LH(0xe3000000, 0x0002, REG_1, BPF_REG_2,
1240 			      REG_1, offsetof(struct bpf_array, ptrs));
1241 		if (!is_first_pass(jit) && can_use_rel(jit, jit->labels[0])) {
1242 			/* brc 0x8,label0 */
1243 			EMIT4_PCREL_RIC(0xa7040000, 0x8, jit->labels[0]);
1244 		} else {
1245 			/* brcl 0x8,label0 */
1246 			EMIT6_PCREL_RILC(0xc0040000, 0x8, jit->labels[0]);
1247 		}
1248 
1249 		/*
1250 		 * Restore registers before calling function
1251 		 */
1252 		save_restore_regs(jit, REGS_RESTORE, fp->aux->stack_depth);
1253 
1254 		/*
1255 		 * goto *(prog->bpf_func + tail_call_start);
1256 		 */
1257 
1258 		/* lg %r1,bpf_func(%r1) */
1259 		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, REG_1, REG_0,
1260 			      offsetof(struct bpf_prog, bpf_func));
1261 		/* bc 0xf,tail_call_start(%r1) */
1262 		_EMIT4(0x47f01000 + jit->tail_call_start);
1263 		/* out: */
1264 		jit->labels[0] = jit->prg;
1265 		break;
1266 	case BPF_JMP | BPF_EXIT: /* return b0 */
1267 		last = (i == fp->len - 1) ? 1 : 0;
1268 		if (last)
1269 			break;
1270 		/* j <exit> */
1271 		EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
1272 		break;
1273 	/*
1274 	 * Branch relative (number of skipped instructions) to offset on
1275 	 * condition.
1276 	 *
1277 	 * Condition code to mask mapping:
1278 	 *
1279 	 * CC | Description	   | Mask
1280 	 * ------------------------------
1281 	 * 0  | Operands equal	   |	8
1282 	 * 1  | First operand low  |	4
1283 	 * 2  | First operand high |	2
1284 	 * 3  | Unused		   |	1
1285 	 *
1286 	 * For s390x relative branches: ip = ip + off_bytes
1287 	 * For BPF relative branches:	insn = insn + off_insns + 1
1288 	 *
1289 	 * For example for s390x with offset 0 we jump to the branch
1290 	 * instruction itself (loop) and for BPF with offset 0 we
1291 	 * branch to the instruction behind the branch.
1292 	 */
1293 	case BPF_JMP | BPF_JA: /* if (true) */
1294 		mask = 0xf000; /* j */
1295 		goto branch_oc;
1296 	case BPF_JMP | BPF_JSGT | BPF_K: /* ((s64) dst > (s64) imm) */
1297 	case BPF_JMP32 | BPF_JSGT | BPF_K: /* ((s32) dst > (s32) imm) */
1298 		mask = 0x2000; /* jh */
1299 		goto branch_ks;
1300 	case BPF_JMP | BPF_JSLT | BPF_K: /* ((s64) dst < (s64) imm) */
1301 	case BPF_JMP32 | BPF_JSLT | BPF_K: /* ((s32) dst < (s32) imm) */
1302 		mask = 0x4000; /* jl */
1303 		goto branch_ks;
1304 	case BPF_JMP | BPF_JSGE | BPF_K: /* ((s64) dst >= (s64) imm) */
1305 	case BPF_JMP32 | BPF_JSGE | BPF_K: /* ((s32) dst >= (s32) imm) */
1306 		mask = 0xa000; /* jhe */
1307 		goto branch_ks;
1308 	case BPF_JMP | BPF_JSLE | BPF_K: /* ((s64) dst <= (s64) imm) */
1309 	case BPF_JMP32 | BPF_JSLE | BPF_K: /* ((s32) dst <= (s32) imm) */
1310 		mask = 0xc000; /* jle */
1311 		goto branch_ks;
1312 	case BPF_JMP | BPF_JGT | BPF_K: /* (dst_reg > imm) */
1313 	case BPF_JMP32 | BPF_JGT | BPF_K: /* ((u32) dst_reg > (u32) imm) */
1314 		mask = 0x2000; /* jh */
1315 		goto branch_ku;
1316 	case BPF_JMP | BPF_JLT | BPF_K: /* (dst_reg < imm) */
1317 	case BPF_JMP32 | BPF_JLT | BPF_K: /* ((u32) dst_reg < (u32) imm) */
1318 		mask = 0x4000; /* jl */
1319 		goto branch_ku;
1320 	case BPF_JMP | BPF_JGE | BPF_K: /* (dst_reg >= imm) */
1321 	case BPF_JMP32 | BPF_JGE | BPF_K: /* ((u32) dst_reg >= (u32) imm) */
1322 		mask = 0xa000; /* jhe */
1323 		goto branch_ku;
1324 	case BPF_JMP | BPF_JLE | BPF_K: /* (dst_reg <= imm) */
1325 	case BPF_JMP32 | BPF_JLE | BPF_K: /* ((u32) dst_reg <= (u32) imm) */
1326 		mask = 0xc000; /* jle */
1327 		goto branch_ku;
1328 	case BPF_JMP | BPF_JNE | BPF_K: /* (dst_reg != imm) */
1329 	case BPF_JMP32 | BPF_JNE | BPF_K: /* ((u32) dst_reg != (u32) imm) */
1330 		mask = 0x7000; /* jne */
1331 		goto branch_ku;
1332 	case BPF_JMP | BPF_JEQ | BPF_K: /* (dst_reg == imm) */
1333 	case BPF_JMP32 | BPF_JEQ | BPF_K: /* ((u32) dst_reg == (u32) imm) */
1334 		mask = 0x8000; /* je */
1335 		goto branch_ku;
1336 	case BPF_JMP | BPF_JSET | BPF_K: /* (dst_reg & imm) */
1337 	case BPF_JMP32 | BPF_JSET | BPF_K: /* ((u32) dst_reg & (u32) imm) */
1338 		mask = 0x7000; /* jnz */
1339 		if (BPF_CLASS(insn->code) == BPF_JMP32) {
1340 			/* llilf %w1,imm (load zero extend imm) */
1341 			EMIT6_IMM(0xc00f0000, REG_W1, imm);
1342 			/* nr %w1,%dst */
1343 			EMIT2(0x1400, REG_W1, dst_reg);
1344 		} else {
1345 			/* lgfi %w1,imm (load sign extend imm) */
1346 			EMIT6_IMM(0xc0010000, REG_W1, imm);
1347 			/* ngr %w1,%dst */
1348 			EMIT4(0xb9800000, REG_W1, dst_reg);
1349 		}
1350 		goto branch_oc;
1351 
1352 	case BPF_JMP | BPF_JSGT | BPF_X: /* ((s64) dst > (s64) src) */
1353 	case BPF_JMP32 | BPF_JSGT | BPF_X: /* ((s32) dst > (s32) src) */
1354 		mask = 0x2000; /* jh */
1355 		goto branch_xs;
1356 	case BPF_JMP | BPF_JSLT | BPF_X: /* ((s64) dst < (s64) src) */
1357 	case BPF_JMP32 | BPF_JSLT | BPF_X: /* ((s32) dst < (s32) src) */
1358 		mask = 0x4000; /* jl */
1359 		goto branch_xs;
1360 	case BPF_JMP | BPF_JSGE | BPF_X: /* ((s64) dst >= (s64) src) */
1361 	case BPF_JMP32 | BPF_JSGE | BPF_X: /* ((s32) dst >= (s32) src) */
1362 		mask = 0xa000; /* jhe */
1363 		goto branch_xs;
1364 	case BPF_JMP | BPF_JSLE | BPF_X: /* ((s64) dst <= (s64) src) */
1365 	case BPF_JMP32 | BPF_JSLE | BPF_X: /* ((s32) dst <= (s32) src) */
1366 		mask = 0xc000; /* jle */
1367 		goto branch_xs;
1368 	case BPF_JMP | BPF_JGT | BPF_X: /* (dst > src) */
1369 	case BPF_JMP32 | BPF_JGT | BPF_X: /* ((u32) dst > (u32) src) */
1370 		mask = 0x2000; /* jh */
1371 		goto branch_xu;
1372 	case BPF_JMP | BPF_JLT | BPF_X: /* (dst < src) */
1373 	case BPF_JMP32 | BPF_JLT | BPF_X: /* ((u32) dst < (u32) src) */
1374 		mask = 0x4000; /* jl */
1375 		goto branch_xu;
1376 	case BPF_JMP | BPF_JGE | BPF_X: /* (dst >= src) */
1377 	case BPF_JMP32 | BPF_JGE | BPF_X: /* ((u32) dst >= (u32) src) */
1378 		mask = 0xa000; /* jhe */
1379 		goto branch_xu;
1380 	case BPF_JMP | BPF_JLE | BPF_X: /* (dst <= src) */
1381 	case BPF_JMP32 | BPF_JLE | BPF_X: /* ((u32) dst <= (u32) src) */
1382 		mask = 0xc000; /* jle */
1383 		goto branch_xu;
1384 	case BPF_JMP | BPF_JNE | BPF_X: /* (dst != src) */
1385 	case BPF_JMP32 | BPF_JNE | BPF_X: /* ((u32) dst != (u32) src) */
1386 		mask = 0x7000; /* jne */
1387 		goto branch_xu;
1388 	case BPF_JMP | BPF_JEQ | BPF_X: /* (dst == src) */
1389 	case BPF_JMP32 | BPF_JEQ | BPF_X: /* ((u32) dst == (u32) src) */
1390 		mask = 0x8000; /* je */
1391 		goto branch_xu;
1392 	case BPF_JMP | BPF_JSET | BPF_X: /* (dst & src) */
1393 	case BPF_JMP32 | BPF_JSET | BPF_X: /* ((u32) dst & (u32) src) */
1394 	{
1395 		bool is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1396 
1397 		mask = 0x7000; /* jnz */
1398 		/* nrk or ngrk %w1,%dst,%src */
1399 		EMIT4_RRF((is_jmp32 ? 0xb9f40000 : 0xb9e40000),
1400 			  REG_W1, dst_reg, src_reg);
1401 		goto branch_oc;
1402 branch_ks:
1403 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1404 		/* cfi or cgfi %dst,imm */
1405 		EMIT6_IMM(is_jmp32 ? 0xc20d0000 : 0xc20c0000,
1406 			  dst_reg, imm);
1407 		if (!is_first_pass(jit) &&
1408 		    can_use_rel(jit, addrs[i + off + 1])) {
1409 			/* brc mask,off */
1410 			EMIT4_PCREL_RIC(0xa7040000,
1411 					mask >> 12, addrs[i + off + 1]);
1412 		} else {
1413 			/* brcl mask,off */
1414 			EMIT6_PCREL_RILC(0xc0040000,
1415 					 mask >> 12, addrs[i + off + 1]);
1416 		}
1417 		break;
1418 branch_ku:
1419 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1420 		/* clfi or clgfi %dst,imm */
1421 		EMIT6_IMM(is_jmp32 ? 0xc20f0000 : 0xc20e0000,
1422 			  dst_reg, imm);
1423 		if (!is_first_pass(jit) &&
1424 		    can_use_rel(jit, addrs[i + off + 1])) {
1425 			/* brc mask,off */
1426 			EMIT4_PCREL_RIC(0xa7040000,
1427 					mask >> 12, addrs[i + off + 1]);
1428 		} else {
1429 			/* brcl mask,off */
1430 			EMIT6_PCREL_RILC(0xc0040000,
1431 					 mask >> 12, addrs[i + off + 1]);
1432 		}
1433 		break;
1434 branch_xs:
1435 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1436 		if (!is_first_pass(jit) &&
1437 		    can_use_rel(jit, addrs[i + off + 1])) {
1438 			/* crj or cgrj %dst,%src,mask,off */
1439 			EMIT6_PCREL(0xec000000, (is_jmp32 ? 0x0076 : 0x0064),
1440 				    dst_reg, src_reg, i, off, mask);
1441 		} else {
1442 			/* cr or cgr %dst,%src */
1443 			if (is_jmp32)
1444 				EMIT2(0x1900, dst_reg, src_reg);
1445 			else
1446 				EMIT4(0xb9200000, dst_reg, src_reg);
1447 			/* brcl mask,off */
1448 			EMIT6_PCREL_RILC(0xc0040000,
1449 					 mask >> 12, addrs[i + off + 1]);
1450 		}
1451 		break;
1452 branch_xu:
1453 		is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
1454 		if (!is_first_pass(jit) &&
1455 		    can_use_rel(jit, addrs[i + off + 1])) {
1456 			/* clrj or clgrj %dst,%src,mask,off */
1457 			EMIT6_PCREL(0xec000000, (is_jmp32 ? 0x0077 : 0x0065),
1458 				    dst_reg, src_reg, i, off, mask);
1459 		} else {
1460 			/* clr or clgr %dst,%src */
1461 			if (is_jmp32)
1462 				EMIT2(0x1500, dst_reg, src_reg);
1463 			else
1464 				EMIT4(0xb9210000, dst_reg, src_reg);
1465 			/* brcl mask,off */
1466 			EMIT6_PCREL_RILC(0xc0040000,
1467 					 mask >> 12, addrs[i + off + 1]);
1468 		}
1469 		break;
1470 branch_oc:
1471 		if (!is_first_pass(jit) &&
1472 		    can_use_rel(jit, addrs[i + off + 1])) {
1473 			/* brc mask,off */
1474 			EMIT4_PCREL_RIC(0xa7040000,
1475 					mask >> 12, addrs[i + off + 1]);
1476 		} else {
1477 			/* brcl mask,off */
1478 			EMIT6_PCREL_RILC(0xc0040000,
1479 					 mask >> 12, addrs[i + off + 1]);
1480 		}
1481 		break;
1482 	}
1483 	default: /* too complex, give up */
1484 		pr_err("Unknown opcode %02x\n", insn->code);
1485 		return -1;
1486 	}
1487 	return insn_count;
1488 }
1489 
1490 /*
1491  * Return whether new i-th instruction address does not violate any invariant
1492  */
1493 static bool bpf_is_new_addr_sane(struct bpf_jit *jit, int i)
1494 {
1495 	/* On the first pass anything goes */
1496 	if (is_first_pass(jit))
1497 		return true;
1498 
1499 	/* The codegen pass must not change anything */
1500 	if (is_codegen_pass(jit))
1501 		return jit->addrs[i] == jit->prg;
1502 
1503 	/* Passes in between must not increase code size */
1504 	return jit->addrs[i] >= jit->prg;
1505 }
1506 
1507 /*
1508  * Update the address of i-th instruction
1509  */
1510 static int bpf_set_addr(struct bpf_jit *jit, int i)
1511 {
1512 	if (!bpf_is_new_addr_sane(jit, i))
1513 		return -1;
1514 	jit->addrs[i] = jit->prg;
1515 	return 0;
1516 }
1517 
1518 /*
1519  * Compile eBPF program into s390x code
1520  */
1521 static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp,
1522 			bool extra_pass)
1523 {
1524 	int i, insn_count, lit32_size, lit64_size;
1525 
1526 	jit->lit32 = jit->lit32_start;
1527 	jit->lit64 = jit->lit64_start;
1528 	jit->prg = 0;
1529 
1530 	bpf_jit_prologue(jit, fp->aux->stack_depth);
1531 	if (bpf_set_addr(jit, 0) < 0)
1532 		return -1;
1533 	for (i = 0; i < fp->len; i += insn_count) {
1534 		insn_count = bpf_jit_insn(jit, fp, i, extra_pass);
1535 		if (insn_count < 0)
1536 			return -1;
1537 		/* Next instruction address */
1538 		if (bpf_set_addr(jit, i + insn_count) < 0)
1539 			return -1;
1540 	}
1541 	bpf_jit_epilogue(jit, fp->aux->stack_depth);
1542 
1543 	lit32_size = jit->lit32 - jit->lit32_start;
1544 	lit64_size = jit->lit64 - jit->lit64_start;
1545 	jit->lit32_start = jit->prg;
1546 	if (lit32_size)
1547 		jit->lit32_start = ALIGN(jit->lit32_start, 4);
1548 	jit->lit64_start = jit->lit32_start + lit32_size;
1549 	if (lit64_size)
1550 		jit->lit64_start = ALIGN(jit->lit64_start, 8);
1551 	jit->size = jit->lit64_start + lit64_size;
1552 	jit->size_prg = jit->prg;
1553 	return 0;
1554 }
1555 
1556 bool bpf_jit_needs_zext(void)
1557 {
1558 	return true;
1559 }
1560 
1561 struct s390_jit_data {
1562 	struct bpf_binary_header *header;
1563 	struct bpf_jit ctx;
1564 	int pass;
1565 };
1566 
1567 /*
1568  * Compile eBPF program "fp"
1569  */
1570 struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
1571 {
1572 	struct bpf_prog *tmp, *orig_fp = fp;
1573 	struct bpf_binary_header *header;
1574 	struct s390_jit_data *jit_data;
1575 	bool tmp_blinded = false;
1576 	bool extra_pass = false;
1577 	struct bpf_jit jit;
1578 	int pass;
1579 
1580 	if (!fp->jit_requested)
1581 		return orig_fp;
1582 
1583 	tmp = bpf_jit_blind_constants(fp);
1584 	/*
1585 	 * If blinding was requested and we failed during blinding,
1586 	 * we must fall back to the interpreter.
1587 	 */
1588 	if (IS_ERR(tmp))
1589 		return orig_fp;
1590 	if (tmp != fp) {
1591 		tmp_blinded = true;
1592 		fp = tmp;
1593 	}
1594 
1595 	jit_data = fp->aux->jit_data;
1596 	if (!jit_data) {
1597 		jit_data = kzalloc(sizeof(*jit_data), GFP_KERNEL);
1598 		if (!jit_data) {
1599 			fp = orig_fp;
1600 			goto out;
1601 		}
1602 		fp->aux->jit_data = jit_data;
1603 	}
1604 	if (jit_data->ctx.addrs) {
1605 		jit = jit_data->ctx;
1606 		header = jit_data->header;
1607 		extra_pass = true;
1608 		pass = jit_data->pass + 1;
1609 		goto skip_init_ctx;
1610 	}
1611 
1612 	memset(&jit, 0, sizeof(jit));
1613 	jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL);
1614 	if (jit.addrs == NULL) {
1615 		fp = orig_fp;
1616 		goto out;
1617 	}
1618 	/*
1619 	 * Three initial passes:
1620 	 *   - 1/2: Determine clobbered registers
1621 	 *   - 3:   Calculate program size and addrs arrray
1622 	 */
1623 	for (pass = 1; pass <= 3; pass++) {
1624 		if (bpf_jit_prog(&jit, fp, extra_pass)) {
1625 			fp = orig_fp;
1626 			goto free_addrs;
1627 		}
1628 	}
1629 	/*
1630 	 * Final pass: Allocate and generate program
1631 	 */
1632 	header = bpf_jit_binary_alloc(jit.size, &jit.prg_buf, 8, jit_fill_hole);
1633 	if (!header) {
1634 		fp = orig_fp;
1635 		goto free_addrs;
1636 	}
1637 skip_init_ctx:
1638 	if (bpf_jit_prog(&jit, fp, extra_pass)) {
1639 		bpf_jit_binary_free(header);
1640 		fp = orig_fp;
1641 		goto free_addrs;
1642 	}
1643 	if (bpf_jit_enable > 1) {
1644 		bpf_jit_dump(fp->len, jit.size, pass, jit.prg_buf);
1645 		print_fn_code(jit.prg_buf, jit.size_prg);
1646 	}
1647 	if (!fp->is_func || extra_pass) {
1648 		bpf_jit_binary_lock_ro(header);
1649 	} else {
1650 		jit_data->header = header;
1651 		jit_data->ctx = jit;
1652 		jit_data->pass = pass;
1653 	}
1654 	fp->bpf_func = (void *) jit.prg_buf;
1655 	fp->jited = 1;
1656 	fp->jited_len = jit.size;
1657 
1658 	if (!fp->is_func || extra_pass) {
1659 		bpf_prog_fill_jited_linfo(fp, jit.addrs + 1);
1660 free_addrs:
1661 		kvfree(jit.addrs);
1662 		kfree(jit_data);
1663 		fp->aux->jit_data = NULL;
1664 	}
1665 out:
1666 	if (tmp_blinded)
1667 		bpf_jit_prog_release_other(fp, fp == orig_fp ?
1668 					   tmp : orig_fp);
1669 	return fp;
1670 }
1671