?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s390/mm: four page table levels vs. fork
[linux/fpc-iii.git] / arch / s390 / net / bpf_jit_comp.c
bloba2cbd875543a3f206328221c521be3e3aeeab596
1 /*
2 * BPF Jit compiler for s390.
3 *
4 * Copyright IBM Corp. 2012
5 *
6 * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
7 */
8 #include <linux/moduleloader.h>
9 #include <linux/netdevice.h>
10 #include <linux/if_vlan.h>
11 #include <linux/filter.h>
12 #include <linux/random.h>
13 #include <linux/init.h>
14 #include <asm/cacheflush.h>
15 #include <asm/facility.h>
16 #include <asm/dis.h>
17
18 /*
19 * Conventions:
20 * %r2 = skb pointer
21 * %r3 = offset parameter
22 * %r4 = scratch register / length parameter
23 * %r5 = BPF A accumulator
24 * %r8 = return address
25 * %r9 = save register for skb pointer
26 * %r10 = skb->data
27 * %r11 = skb->len - skb->data_len (headlen)
28 * %r12 = BPF X accumulator
29 * %r13 = literal pool pointer
30 * 0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS
31 */
32 int bpf_jit_enable __read_mostly;
33
34 /*
35 * assembly code in arch/x86/net/bpf_jit.S
36 */
37 extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
38 extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[];
39
40 struct bpf_jit {
41 unsigned int seen;
42 u8 *start;
43 u8 *prg;
44 u8 *mid;
45 u8 *lit;
46 u8 *end;
47 u8 *base_ip;
48 u8 *ret0_ip;
49 u8 *exit_ip;
50 unsigned int off_load_word;
51 unsigned int off_load_half;
52 unsigned int off_load_byte;
53 unsigned int off_load_bmsh;
54 unsigned int off_load_iword;
55 unsigned int off_load_ihalf;
56 unsigned int off_load_ibyte;
57 };
58
59 #define BPF_SIZE_MAX 4096 /* Max size for program */
60
61 #define SEEN_DATAREF 1 /* might call external helpers */
62 #define SEEN_XREG 2 /* ebx is used */
63 #define SEEN_MEM 4 /* use mem[] for temporary storage */
64 #define SEEN_RET0 8 /* pc_ret0 points to a valid return 0 */
65 #define SEEN_LITERAL 16 /* code uses literals */
66 #define SEEN_LOAD_WORD 32 /* code uses sk_load_word */
67 #define SEEN_LOAD_HALF 64 /* code uses sk_load_half */
68 #define SEEN_LOAD_BYTE 128 /* code uses sk_load_byte */
69 #define SEEN_LOAD_BMSH 256 /* code uses sk_load_byte_msh */
70 #define SEEN_LOAD_IWORD 512 /* code uses sk_load_word_ind */
71 #define SEEN_LOAD_IHALF 1024 /* code uses sk_load_half_ind */
72 #define SEEN_LOAD_IBYTE 2048 /* code uses sk_load_byte_ind */
73
74 #define EMIT2(op) \
75 ({ \
76 if (jit->prg + 2 <= jit->mid) \
77 *(u16 *) jit->prg = op; \
78 jit->prg += 2; \
79 })
80
81 #define EMIT4(op) \
82 ({ \
83 if (jit->prg + 4 <= jit->mid) \
84 *(u32 *) jit->prg = op; \
85 jit->prg += 4; \
86 })
87
88 #define EMIT4_DISP(op, disp) \
89 ({ \
90 unsigned int __disp = (disp) & 0xfff; \
91 EMIT4(op | __disp); \
92 })
93
94 #define EMIT4_IMM(op, imm) \
95 ({ \
96 unsigned int __imm = (imm) & 0xffff; \
97 EMIT4(op | __imm); \
98 })
99
100 #define EMIT4_PCREL(op, pcrel) \
101 ({ \
102 long __pcrel = ((pcrel) >> 1) & 0xffff; \
103 EMIT4(op | __pcrel); \
104 })
105
106 #define EMIT6(op1, op2) \
107 ({ \
108 if (jit->prg + 6 <= jit->mid) { \
109 *(u32 *) jit->prg = op1; \
110 *(u16 *) (jit->prg + 4) = op2; \
111 } \
112 jit->prg += 6; \
113 })
114
115 #define EMIT6_DISP(op1, op2, disp) \
116 ({ \
117 unsigned int __disp = (disp) & 0xfff; \
118 EMIT6(op1 | __disp, op2); \
119 })
120
121 #define EMIT6_IMM(op, imm) \
122 ({ \
123 unsigned int __imm = (imm); \
124 EMIT6(op | (__imm >> 16), __imm & 0xffff); \
125 })
126
127 #define EMIT_CONST(val) \
128 ({ \
129 unsigned int ret; \
130 ret = (unsigned int) (jit->lit - jit->base_ip); \
131 jit->seen |= SEEN_LITERAL; \
132 if (jit->lit + 4 <= jit->end) \
133 *(u32 *) jit->lit = val; \
134 jit->lit += 4; \
135 ret; \
136 })
137
138 #define EMIT_FN_CONST(bit, fn) \
139 ({ \
140 unsigned int ret; \
141 ret = (unsigned int) (jit->lit - jit->base_ip); \
142 if (jit->seen & bit) { \
143 jit->seen |= SEEN_LITERAL; \
144 if (jit->lit + 8 <= jit->end) \
145 *(void **) jit->lit = fn; \
146 jit->lit += 8; \
147 } \
148 ret; \
149 })
150
151 static void bpf_jit_prologue(struct bpf_jit *jit)
152 {
153 /* Save registers and create stack frame if necessary */
154 if (jit->seen & SEEN_DATAREF) {
155 /* stmg %r8,%r15,88(%r15) */
156 EMIT6(0xeb8ff058, 0x0024);
157 /* lgr %r14,%r15 */
158 EMIT4(0xb90400ef);
159 /* aghi %r15,<offset> */
160 EMIT4_IMM(0xa7fb0000, (jit->seen & SEEN_MEM) ? -112 : -80);
161 /* stg %r14,152(%r15) */
162 EMIT6(0xe3e0f098, 0x0024);
163 } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
164 /* stmg %r12,%r13,120(%r15) */
165 EMIT6(0xebcdf078, 0x0024);
166 else if (jit->seen & SEEN_XREG)
167 /* stg %r12,120(%r15) */
168 EMIT6(0xe3c0f078, 0x0024);
169 else if (jit->seen & SEEN_LITERAL)
170 /* stg %r13,128(%r15) */
171 EMIT6(0xe3d0f080, 0x0024);
172
173 /* Setup literal pool */
174 if (jit->seen & SEEN_LITERAL) {
175 /* basr %r13,0 */
176 EMIT2(0x0dd0);
177 jit->base_ip = jit->prg;
178 }
179 jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word);
180 jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half);
181 jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte);
182 jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh);
183 jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind);
184 jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind);
185 jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind);
186
187 /* Filter needs to access skb data */
188 if (jit->seen & SEEN_DATAREF) {
189 /* l %r11,<len>(%r2) */
190 EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len));
191 /* s %r11,<data_len>(%r2) */
192 EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len));
193 /* lg %r10,<data>(%r2) */
194 EMIT6_DISP(0xe3a02000, 0x0004,
195 offsetof(struct sk_buff, data));
196 }
197 }
198
199 static void bpf_jit_epilogue(struct bpf_jit *jit)
200 {
201 /* Return 0 */
202 if (jit->seen & SEEN_RET0) {
203 jit->ret0_ip = jit->prg;
204 /* lghi %r2,0 */
205 EMIT4(0xa7290000);
206 }
207 jit->exit_ip = jit->prg;
208 /* Restore registers */
209 if (jit->seen & SEEN_DATAREF)
210 /* lmg %r8,%r15,<offset>(%r15) */
211 EMIT6_DISP(0xeb8ff000, 0x0004,
212 (jit->seen & SEEN_MEM) ? 200 : 168);
213 else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
214 /* lmg %r12,%r13,120(%r15) */
215 EMIT6(0xebcdf078, 0x0004);
216 else if (jit->seen & SEEN_XREG)
217 /* lg %r12,120(%r15) */
218 EMIT6(0xe3c0f078, 0x0004);
219 else if (jit->seen & SEEN_LITERAL)
220 /* lg %r13,128(%r15) */
221 EMIT6(0xe3d0f080, 0x0004);
222 /* br %r14 */
223 EMIT2(0x07fe);
224 }
225
226 /* Helper to find the offset of pkt_type in sk_buff
227 * Make sure its still a 3bit field starting at the MSBs within a byte.
228 */
229 #define PKT_TYPE_MAX 0xe0
230 static int pkt_type_offset;
231
232 static int __init bpf_pkt_type_offset_init(void)
233 {
234 struct sk_buff skb_probe = {
235 .pkt_type = ~0,
236 };
237 char *ct = (char *)&skb_probe;
238 int off;
239
240 pkt_type_offset = -1;
241 for (off = 0; off < sizeof(struct sk_buff); off++) {
242 if (!ct[off])
243 continue;
244 if (ct[off] == PKT_TYPE_MAX)
245 pkt_type_offset = off;
246 else {
247 /* Found non matching bit pattern, fix needed. */
248 WARN_ON_ONCE(1);
249 pkt_type_offset = -1;
250 return -1;
251 }
252 }
253 return 0;
254 }
255 device_initcall(bpf_pkt_type_offset_init);
256
257 /*
258 * make sure we dont leak kernel information to user
259 */
260 static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
261 {
262 /* Clear temporary memory if (seen & SEEN_MEM) */
263 if (jit->seen & SEEN_MEM)
264 /* xc 0(64,%r15),0(%r15) */
265 EMIT6(0xd73ff000, 0xf000);
266 /* Clear X if (seen & SEEN_XREG) */
267 if (jit->seen & SEEN_XREG)
268 /* lhi %r12,0 */
269 EMIT4(0xa7c80000);
270 /* Clear A if the first register does not set it. */
271 switch (filter[0].code) {
272 case BPF_LD | BPF_W | BPF_ABS:
273 case BPF_LD | BPF_H | BPF_ABS:
274 case BPF_LD | BPF_B | BPF_ABS:
275 case BPF_LD | BPF_W | BPF_LEN:
276 case BPF_LD | BPF_W | BPF_IND:
277 case BPF_LD | BPF_H | BPF_IND:
278 case BPF_LD | BPF_B | BPF_IND:
279 case BPF_LD | BPF_IMM:
280 case BPF_LD | BPF_MEM:
281 case BPF_MISC | BPF_TXA:
282 case BPF_RET | BPF_K:
283 /* first instruction sets A register */
284 break;
285 default: /* A = 0 */
286 /* lhi %r5,0 */
287 EMIT4(0xa7580000);
288 }
289 }
290
291 static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
292 unsigned int *addrs, int i, int last)
293 {
294 unsigned int K;
295 int offset;
296 unsigned int mask;
297 u16 code;
298
299 K = filter->k;
300 code = bpf_anc_helper(filter);
301
302 switch (code) {
303 case BPF_ALU | BPF_ADD | BPF_X: /* A += X */
304 jit->seen |= SEEN_XREG;
305 /* ar %r5,%r12 */
306 EMIT2(0x1a5c);
307 break;
308 case BPF_ALU | BPF_ADD | BPF_K: /* A += K */
309 if (!K)
310 break;
311 if (K <= 16383)
312 /* ahi %r5,<K> */
313 EMIT4_IMM(0xa75a0000, K);
314 else if (test_facility(21))
315 /* alfi %r5,<K> */
316 EMIT6_IMM(0xc25b0000, K);
317 else
318 /* a %r5,<d(K)>(%r13) */
319 EMIT4_DISP(0x5a50d000, EMIT_CONST(K));
320 break;
321 case BPF_ALU | BPF_SUB | BPF_X: /* A -= X */
322 jit->seen |= SEEN_XREG;
323 /* sr %r5,%r12 */
324 EMIT2(0x1b5c);
325 break;
326 case BPF_ALU | BPF_SUB | BPF_K: /* A -= K */
327 if (!K)
328 break;
329 if (K <= 16384)
330 /* ahi %r5,-K */
331 EMIT4_IMM(0xa75a0000, -K);
332 else if (test_facility(21))
333 /* alfi %r5,-K */
334 EMIT6_IMM(0xc25b0000, -K);
335 else
336 /* s %r5,<d(K)>(%r13) */
337 EMIT4_DISP(0x5b50d000, EMIT_CONST(K));
338 break;
339 case BPF_ALU | BPF_MUL | BPF_X: /* A *= X */
340 jit->seen |= SEEN_XREG;
341 /* msr %r5,%r12 */
342 EMIT4(0xb252005c);
343 break;
344 case BPF_ALU | BPF_MUL | BPF_K: /* A *= K */
345 if (K <= 16383)
346 /* mhi %r5,K */
347 EMIT4_IMM(0xa75c0000, K);
348 else if (test_facility(34))
349 /* msfi %r5,<K> */
350 EMIT6_IMM(0xc2510000, K);
351 else
352 /* ms %r5,<d(K)>(%r13) */
353 EMIT4_DISP(0x7150d000, EMIT_CONST(K));
354 break;
355 case BPF_ALU | BPF_DIV | BPF_X: /* A /= X */
356 jit->seen |= SEEN_XREG | SEEN_RET0;
357 /* ltr %r12,%r12 */
358 EMIT2(0x12cc);
359 /* jz <ret0> */
360 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
361 /* lhi %r4,0 */
362 EMIT4(0xa7480000);
363 /* dlr %r4,%r12 */
364 EMIT4(0xb997004c);
365 break;
366 case BPF_ALU | BPF_DIV | BPF_K: /* A /= K */
367 if (K == 1)
368 break;
369 /* lhi %r4,0 */
370 EMIT4(0xa7480000);
371 /* dl %r4,<d(K)>(%r13) */
372 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
373 break;
374 case BPF_ALU | BPF_MOD | BPF_X: /* A %= X */
375 jit->seen |= SEEN_XREG | SEEN_RET0;
376 /* ltr %r12,%r12 */
377 EMIT2(0x12cc);
378 /* jz <ret0> */
379 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
380 /* lhi %r4,0 */
381 EMIT4(0xa7480000);
382 /* dlr %r4,%r12 */
383 EMIT4(0xb997004c);
384 /* lr %r5,%r4 */
385 EMIT2(0x1854);
386 break;
387 case BPF_ALU | BPF_MOD | BPF_K: /* A %= K */
388 if (K == 1) {
389 /* lhi %r5,0 */
390 EMIT4(0xa7580000);
391 break;
392 }
393 /* lhi %r4,0 */
394 EMIT4(0xa7480000);
395 /* dl %r4,<d(K)>(%r13) */
396 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
397 /* lr %r5,%r4 */
398 EMIT2(0x1854);
399 break;
400 case BPF_ALU | BPF_AND | BPF_X: /* A &= X */
401 jit->seen |= SEEN_XREG;
402 /* nr %r5,%r12 */
403 EMIT2(0x145c);
404 break;
405 case BPF_ALU | BPF_AND | BPF_K: /* A &= K */
406 if (test_facility(21))
407 /* nilf %r5,<K> */
408 EMIT6_IMM(0xc05b0000, K);
409 else
410 /* n %r5,<d(K)>(%r13) */
411 EMIT4_DISP(0x5450d000, EMIT_CONST(K));
412 break;
413 case BPF_ALU | BPF_OR | BPF_X: /* A |= X */
414 jit->seen |= SEEN_XREG;
415 /* or %r5,%r12 */
416 EMIT2(0x165c);
417 break;
418 case BPF_ALU | BPF_OR | BPF_K: /* A |= K */
419 if (test_facility(21))
420 /* oilf %r5,<K> */
421 EMIT6_IMM(0xc05d0000, K);
422 else
423 /* o %r5,<d(K)>(%r13) */
424 EMIT4_DISP(0x5650d000, EMIT_CONST(K));
425 break;
426 case BPF_ANC | SKF_AD_ALU_XOR_X: /* A ^= X; */
427 case BPF_ALU | BPF_XOR | BPF_X:
428 jit->seen |= SEEN_XREG;
429 /* xr %r5,%r12 */
430 EMIT2(0x175c);
431 break;
432 case BPF_ALU | BPF_XOR | BPF_K: /* A ^= K */
433 if (!K)
434 break;
435 /* x %r5,<d(K)>(%r13) */
436 EMIT4_DISP(0x5750d000, EMIT_CONST(K));
437 break;
438 case BPF_ALU | BPF_LSH | BPF_X: /* A <<= X; */
439 jit->seen |= SEEN_XREG;
440 /* sll %r5,0(%r12) */
441 EMIT4(0x8950c000);
442 break;
443 case BPF_ALU | BPF_LSH | BPF_K: /* A <<= K */
444 if (K == 0)
445 break;
446 /* sll %r5,K */
447 EMIT4_DISP(0x89500000, K);
448 break;
449 case BPF_ALU | BPF_RSH | BPF_X: /* A >>= X; */
450 jit->seen |= SEEN_XREG;
451 /* srl %r5,0(%r12) */
452 EMIT4(0x8850c000);
453 break;
454 case BPF_ALU | BPF_RSH | BPF_K: /* A >>= K; */
455 if (K == 0)
456 break;
457 /* srl %r5,K */
458 EMIT4_DISP(0x88500000, K);
459 break;
460 case BPF_ALU | BPF_NEG: /* A = -A */
461 /* lnr %r5,%r5 */
462 EMIT2(0x1155);
463 break;
464 case BPF_JMP | BPF_JA: /* ip += K */
465 offset = addrs[i + K] + jit->start - jit->prg;
466 EMIT4_PCREL(0xa7f40000, offset);
467 break;
468 case BPF_JMP | BPF_JGT | BPF_K: /* ip += (A > K) ? jt : jf */
469 mask = 0x200000; /* jh */
470 goto kbranch;
471 case BPF_JMP | BPF_JGE | BPF_K: /* ip += (A >= K) ? jt : jf */
472 mask = 0xa00000; /* jhe */
473 goto kbranch;
474 case BPF_JMP | BPF_JEQ | BPF_K: /* ip += (A == K) ? jt : jf */
475 mask = 0x800000; /* je */
476 kbranch: /* Emit compare if the branch targets are different */
477 if (filter->jt != filter->jf) {
478 if (K <= 16383)
479 /* chi %r5,<K> */
480 EMIT4_IMM(0xa75e0000, K);
481 else if (test_facility(21))
482 /* clfi %r5,<K> */
483 EMIT6_IMM(0xc25f0000, K);
484 else
485 /* c %r5,<d(K)>(%r13) */
486 EMIT4_DISP(0x5950d000, EMIT_CONST(K));
487 }
488 branch: if (filter->jt == filter->jf) {
489 if (filter->jt == 0)
490 break;
491 /* j <jt> */
492 offset = addrs[i + filter->jt] + jit->start - jit->prg;
493 EMIT4_PCREL(0xa7f40000, offset);
494 break;
495 }
496 if (filter->jt != 0) {
497 /* brc <mask>,<jt> */
498 offset = addrs[i + filter->jt] + jit->start - jit->prg;
499 EMIT4_PCREL(0xa7040000 | mask, offset);
500 }
501 if (filter->jf != 0) {
502 /* brc <mask^15>,<jf> */
503 offset = addrs[i + filter->jf] + jit->start - jit->prg;
504 EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset);
505 }
506 break;
507 case BPF_JMP | BPF_JSET | BPF_K: /* ip += (A & K) ? jt : jf */
508 mask = 0x700000; /* jnz */
509 /* Emit test if the branch targets are different */
510 if (filter->jt != filter->jf) {
511 if (K > 65535) {
512 /* lr %r4,%r5 */
513 EMIT2(0x1845);
514 /* n %r4,<d(K)>(%r13) */
515 EMIT4_DISP(0x5440d000, EMIT_CONST(K));
516 } else
517 /* tmll %r5,K */
518 EMIT4_IMM(0xa7510000, K);
519 }
520 goto branch;
521 case BPF_JMP | BPF_JGT | BPF_X: /* ip += (A > X) ? jt : jf */
522 mask = 0x200000; /* jh */
523 goto xbranch;
524 case BPF_JMP | BPF_JGE | BPF_X: /* ip += (A >= X) ? jt : jf */
525 mask = 0xa00000; /* jhe */
526 goto xbranch;
527 case BPF_JMP | BPF_JEQ | BPF_X: /* ip += (A == X) ? jt : jf */
528 mask = 0x800000; /* je */
529 xbranch: /* Emit compare if the branch targets are different */
530 if (filter->jt != filter->jf) {
531 jit->seen |= SEEN_XREG;
532 /* cr %r5,%r12 */
533 EMIT2(0x195c);
534 }
535 goto branch;
536 case BPF_JMP | BPF_JSET | BPF_X: /* ip += (A & X) ? jt : jf */
537 mask = 0x700000; /* jnz */
538 /* Emit test if the branch targets are different */
539 if (filter->jt != filter->jf) {
540 jit->seen |= SEEN_XREG;
541 /* lr %r4,%r5 */
542 EMIT2(0x1845);
543 /* nr %r4,%r12 */
544 EMIT2(0x144c);
545 }
546 goto branch;
547 case BPF_LD | BPF_W | BPF_ABS: /* A = *(u32 *) (skb->data+K) */
548 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD;
549 offset = jit->off_load_word;
550 goto load_abs;
551 case BPF_LD | BPF_H | BPF_ABS: /* A = *(u16 *) (skb->data+K) */
552 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF;
553 offset = jit->off_load_half;
554 goto load_abs;
555 case BPF_LD | BPF_B | BPF_ABS: /* A = *(u8 *) (skb->data+K) */
556 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE;
557 offset = jit->off_load_byte;
558 load_abs: if ((int) K < 0)
559 goto out;
560 call_fn: /* lg %r1,<d(function)>(%r13) */
561 EMIT6_DISP(0xe310d000, 0x0004, offset);
562 /* l %r3,<d(K)>(%r13) */
563 EMIT4_DISP(0x5830d000, EMIT_CONST(K));
564 /* basr %r8,%r1 */
565 EMIT2(0x0d81);
566 /* jnz <ret0> */
567 EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg));
568 break;
569 case BPF_LD | BPF_W | BPF_IND: /* A = *(u32 *) (skb->data+K+X) */
570 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD;
571 offset = jit->off_load_iword;
572 goto call_fn;
573 case BPF_LD | BPF_H | BPF_IND: /* A = *(u16 *) (skb->data+K+X) */
574 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF;
575 offset = jit->off_load_ihalf;
576 goto call_fn;
577 case BPF_LD | BPF_B | BPF_IND: /* A = *(u8 *) (skb->data+K+X) */
578 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE;
579 offset = jit->off_load_ibyte;
580 goto call_fn;
581 case BPF_LDX | BPF_B | BPF_MSH:
582 /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */
583 jit->seen |= SEEN_RET0;
584 if ((int) K < 0) {
585 /* j <ret0> */
586 EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg));
587 break;
588 }
589 jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH;
590 offset = jit->off_load_bmsh;
591 goto call_fn;
592 case BPF_LD | BPF_W | BPF_LEN: /* A = skb->len; */
593 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
594 /* l %r5,<d(len)>(%r2) */
595 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len));
596 break;
597 case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */
598 jit->seen |= SEEN_XREG;
599 /* l %r12,<d(len)>(%r2) */
600 EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len));
601 break;
602 case BPF_LD | BPF_IMM: /* A = K */
603 if (K <= 16383)
604 /* lhi %r5,K */
605 EMIT4_IMM(0xa7580000, K);
606 else if (test_facility(21))
607 /* llilf %r5,<K> */
608 EMIT6_IMM(0xc05f0000, K);
609 else
610 /* l %r5,<d(K)>(%r13) */
611 EMIT4_DISP(0x5850d000, EMIT_CONST(K));
612 break;
613 case BPF_LDX | BPF_IMM: /* X = K */
614 jit->seen |= SEEN_XREG;
615 if (K <= 16383)
616 /* lhi %r12,<K> */
617 EMIT4_IMM(0xa7c80000, K);
618 else if (test_facility(21))
619 /* llilf %r12,<K> */
620 EMIT6_IMM(0xc0cf0000, K);
621 else
622 /* l %r12,<d(K)>(%r13) */
623 EMIT4_DISP(0x58c0d000, EMIT_CONST(K));
624 break;
625 case BPF_LD | BPF_MEM: /* A = mem[K] */
626 jit->seen |= SEEN_MEM;
627 /* l %r5,<K>(%r15) */
628 EMIT4_DISP(0x5850f000,
629 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
630 break;
631 case BPF_LDX | BPF_MEM: /* X = mem[K] */
632 jit->seen |= SEEN_XREG | SEEN_MEM;
633 /* l %r12,<K>(%r15) */
634 EMIT4_DISP(0x58c0f000,
635 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
636 break;
637 case BPF_MISC | BPF_TAX: /* X = A */
638 jit->seen |= SEEN_XREG;
639 /* lr %r12,%r5 */
640 EMIT2(0x18c5);
641 break;
642 case BPF_MISC | BPF_TXA: /* A = X */
643 jit->seen |= SEEN_XREG;
644 /* lr %r5,%r12 */
645 EMIT2(0x185c);
646 break;
647 case BPF_RET | BPF_K:
648 if (K == 0) {
649 jit->seen |= SEEN_RET0;
650 if (last)
651 break;
652 /* j <ret0> */
653 EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg);
654 } else {
655 if (K <= 16383)
656 /* lghi %r2,K */
657 EMIT4_IMM(0xa7290000, K);
658 else
659 /* llgf %r2,<K>(%r13) */
660 EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K));
661 /* j <exit> */
662 if (last && !(jit->seen & SEEN_RET0))
663 break;
664 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
665 }
666 break;
667 case BPF_RET | BPF_A:
668 /* llgfr %r2,%r5 */
669 EMIT4(0xb9160025);
670 /* j <exit> */
671 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
672 break;
673 case BPF_ST: /* mem[K] = A */
674 jit->seen |= SEEN_MEM;
675 /* st %r5,<K>(%r15) */
676 EMIT4_DISP(0x5050f000,
677 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
678 break;
679 case BPF_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */
680 jit->seen |= SEEN_XREG | SEEN_MEM;
681 /* st %r12,<K>(%r15) */
682 EMIT4_DISP(0x50c0f000,
683 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
684 break;
685 case BPF_ANC | SKF_AD_PROTOCOL: /* A = ntohs(skb->protocol); */
686 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2);
687 /* lhi %r5,0 */
688 EMIT4(0xa7580000);
689 /* icm %r5,3,<d(protocol)>(%r2) */
690 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol));
691 break;
692 case BPF_ANC | SKF_AD_IFINDEX: /* if (!skb->dev) return 0;
693 * A = skb->dev->ifindex */
694 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
695 jit->seen |= SEEN_RET0;
696 /* lg %r1,<d(dev)>(%r2) */
697 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
698 /* ltgr %r1,%r1 */
699 EMIT4(0xb9020011);
700 /* jz <ret0> */
701 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
702 /* l %r5,<d(ifindex)>(%r1) */
703 EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex));
704 break;
705 case BPF_ANC | SKF_AD_MARK: /* A = skb->mark */
706 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
707 /* l %r5,<d(mark)>(%r2) */
708 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark));
709 break;
710 case BPF_ANC | SKF_AD_QUEUE: /* A = skb->queue_mapping */
711 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2);
712 /* lhi %r5,0 */
713 EMIT4(0xa7580000);
714 /* icm %r5,3,<d(queue_mapping)>(%r2) */
715 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping));
716 break;
717 case BPF_ANC | SKF_AD_HATYPE: /* if (!skb->dev) return 0;
718 * A = skb->dev->type */
719 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2);
720 jit->seen |= SEEN_RET0;
721 /* lg %r1,<d(dev)>(%r2) */
722 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
723 /* ltgr %r1,%r1 */
724 EMIT4(0xb9020011);
725 /* jz <ret0> */
726 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
727 /* lhi %r5,0 */
728 EMIT4(0xa7580000);
729 /* icm %r5,3,<d(type)>(%r1) */
730 EMIT4_DISP(0xbf531000, offsetof(struct net_device, type));
731 break;
732 case BPF_ANC | SKF_AD_RXHASH: /* A = skb->hash */
733 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4);
734 /* l %r5,<d(hash)>(%r2) */
735 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, hash));
736 break;
737 case BPF_ANC | SKF_AD_VLAN_TAG:
738 case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT:
739 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, vlan_tci) != 2);
740 BUILD_BUG_ON(VLAN_TAG_PRESENT != 0x1000);
741 /* lhi %r5,0 */
742 EMIT4(0xa7580000);
743 /* icm %r5,3,<d(vlan_tci)>(%r2) */
744 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, vlan_tci));
745 if (code == (BPF_ANC | SKF_AD_VLAN_TAG)) {
746 /* nill %r5,0xefff */
747 EMIT4_IMM(0xa5570000, ~VLAN_TAG_PRESENT);
748 } else {
749 /* nill %r5,0x1000 */
750 EMIT4_IMM(0xa5570000, VLAN_TAG_PRESENT);
751 /* srl %r5,12 */
752 EMIT4_DISP(0x88500000, 12);
753 }
754 break;
755 case BPF_ANC | SKF_AD_PKTTYPE:
756 if (pkt_type_offset < 0)
757 goto out;
758 /* lhi %r5,0 */
759 EMIT4(0xa7580000);
760 /* ic %r5,<d(pkt_type_offset)>(%r2) */
761 EMIT4_DISP(0x43502000, pkt_type_offset);
762 /* srl %r5,5 */
763 EMIT4_DISP(0x88500000, 5);
764 break;
765 case BPF_ANC | SKF_AD_CPU: /* A = smp_processor_id() */
766 #ifdef CONFIG_SMP
767 /* l %r5,<d(cpu_nr)> */
768 EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr));
769 #else
770 /* lhi %r5,0 */
771 EMIT4(0xa7580000);
772 #endif
773 break;
774 default: /* too complex, give up */
775 goto out;
776 }
777 addrs[i] = jit->prg - jit->start;
778 return 0;
779 out:
780 return -1;
781 }
782
783 /*
784 * Note: for security reasons, bpf code will follow a randomly
785 * sized amount of illegal instructions.
786 */
787 struct bpf_binary_header {
788 unsigned int pages;
789 u8 image[];
790 };
791
792 static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
793 u8 **image_ptr)
794 {
795 struct bpf_binary_header *header;
796 unsigned int sz, hole;
797
798 /* Most BPF filters are really small, but if some of them fill a page,
799 * allow at least 128 extra bytes for illegal instructions.
800 */
801 sz = round_up(bpfsize + sizeof(*header) + 128, PAGE_SIZE);
802 header = module_alloc(sz);
803 if (!header)
804 return NULL;
805 memset(header, 0, sz);
806 header->pages = sz / PAGE_SIZE;
807 hole = min(sz - (bpfsize + sizeof(*header)), PAGE_SIZE - sizeof(*header));
808 /* Insert random number of illegal instructions before BPF code
809 * and make sure the first instruction starts at an even address.
810 */
811 *image_ptr = &header->image[(prandom_u32() % hole) & -2];
812 return header;
813 }
814
815 void bpf_jit_compile(struct sk_filter *fp)
816 {
817 struct bpf_binary_header *header = NULL;
818 unsigned long size, prg_len, lit_len;
819 struct bpf_jit jit, cjit;
820 unsigned int *addrs;
821 int pass, i;
822
823 if (!bpf_jit_enable)
824 return;
825 addrs = kcalloc(fp->len, sizeof(*addrs), GFP_KERNEL);
826 if (addrs == NULL)
827 return;
828 memset(&jit, 0, sizeof(cjit));
829 memset(&cjit, 0, sizeof(cjit));
830
831 for (pass = 0; pass < 10; pass++) {
832 jit.prg = jit.start;
833 jit.lit = jit.mid;
834
835 bpf_jit_prologue(&jit);
836 bpf_jit_noleaks(&jit, fp->insns);
837 for (i = 0; i < fp->len; i++) {
838 if (bpf_jit_insn(&jit, fp->insns + i, addrs, i,
839 i == fp->len - 1))
840 goto out;
841 }
842 bpf_jit_epilogue(&jit);
843 if (jit.start) {
844 WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit);
845 if (memcmp(&jit, &cjit, sizeof(jit)) == 0)
846 break;
847 } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) {
848 prg_len = jit.prg - jit.start;
849 lit_len = jit.lit - jit.mid;
850 size = prg_len + lit_len;
851 if (size >= BPF_SIZE_MAX)
852 goto out;
853 header = bpf_alloc_binary(size, &jit.start);
854 if (!header)
855 goto out;
856 jit.prg = jit.mid = jit.start + prg_len;
857 jit.lit = jit.end = jit.start + prg_len + lit_len;
858 jit.base_ip += (unsigned long) jit.start;
859 jit.exit_ip += (unsigned long) jit.start;
860 jit.ret0_ip += (unsigned long) jit.start;
861 }
862 cjit = jit;
863 }
864 if (bpf_jit_enable > 1) {
865 bpf_jit_dump(fp->len, jit.end - jit.start, pass, jit.start);
866 if (jit.start)
867 print_fn_code(jit.start, jit.mid - jit.start);
868 }
869 if (jit.start) {
870 set_memory_ro((unsigned long)header, header->pages);
871 fp->bpf_func = (void *) jit.start;
872 fp->jited = 1;
873 }
874 out:
875 kfree(addrs);
876 }
877
878 void bpf_jit_free(struct sk_filter *fp)
879 {
880 unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
881 struct bpf_binary_header *header = (void *)addr;
882
883 if (!fp->jited)
884 goto free_filter;
885
886 set_memory_rw(addr, header->pages);
887 module_free(NULL, header);
888
889 free_filter:
890 kfree(fp);
891 }
Linux with added FPC-III support