1 | // SPDX-License-Identifier: GPL-2.0 |
2 | #include <linux/moduleloader.h> |
3 | #include <linux/workqueue.h> |
4 | #include <linux/netdevice.h> |
5 | #include <linux/filter.h> |
6 | #include <linux/cache.h> |
7 | #include <linux/if_vlan.h> |
8 | |
9 | #include <asm/cacheflush.h> |
10 | #include <asm/ptrace.h> |
11 | |
12 | #include "bpf_jit_32.h" |
13 | |
14 | static inline bool is_simm13(unsigned int value) |
15 | { |
16 | return value + 0x1000 < 0x2000; |
17 | } |
18 | |
19 | #define SEEN_DATAREF 1 /* might call external helpers */ |
20 | #define SEEN_XREG 2 /* ebx is used */ |
21 | #define SEEN_MEM 4 /* use mem[] for temporary storage */ |
22 | |
23 | #define S13(X) ((X) & 0x1fff) |
24 | #define IMMED 0x00002000 |
25 | #define RD(X) ((X) << 25) |
26 | #define RS1(X) ((X) << 14) |
27 | #define RS2(X) ((X)) |
28 | #define OP(X) ((X) << 30) |
29 | #define OP2(X) ((X) << 22) |
30 | #define OP3(X) ((X) << 19) |
31 | #define COND(X) ((X) << 25) |
32 | #define F1(X) OP(X) |
33 | #define F2(X, Y) (OP(X) | OP2(Y)) |
34 | #define F3(X, Y) (OP(X) | OP3(Y)) |
35 | |
36 | #define CONDN COND(0x0) |
37 | #define CONDE COND(0x1) |
38 | #define CONDLE COND(0x2) |
39 | #define CONDL COND(0x3) |
40 | #define CONDLEU COND(0x4) |
41 | #define CONDCS COND(0x5) |
42 | #define CONDNEG COND(0x6) |
43 | #define CONDVC COND(0x7) |
44 | #define CONDA COND(0x8) |
45 | #define CONDNE COND(0x9) |
46 | #define CONDG COND(0xa) |
47 | #define CONDGE COND(0xb) |
48 | #define CONDGU COND(0xc) |
49 | #define CONDCC COND(0xd) |
50 | #define CONDPOS COND(0xe) |
51 | #define CONDVS COND(0xf) |
52 | |
53 | #define CONDGEU CONDCC |
54 | #define CONDLU CONDCS |
55 | |
56 | #define WDISP22(X) (((X) >> 2) & 0x3fffff) |
57 | |
58 | #define BA (F2(0, 2) | CONDA) |
59 | #define BGU (F2(0, 2) | CONDGU) |
60 | #define BLEU (F2(0, 2) | CONDLEU) |
61 | #define BGEU (F2(0, 2) | CONDGEU) |
62 | #define BLU (F2(0, 2) | CONDLU) |
63 | #define BE (F2(0, 2) | CONDE) |
64 | #define BNE (F2(0, 2) | CONDNE) |
65 | |
66 | #define BE_PTR BE |
67 | |
68 | #define SETHI(K, REG) \ |
69 | (F2(0, 0x4) | RD(REG) | (((K) >> 10) & 0x3fffff)) |
70 | #define OR_LO(K, REG) \ |
71 | (F3(2, 0x02) | IMMED | RS1(REG) | ((K) & 0x3ff) | RD(REG)) |
72 | |
73 | #define ADD F3(2, 0x00) |
74 | #define AND F3(2, 0x01) |
75 | #define ANDCC F3(2, 0x11) |
76 | #define OR F3(2, 0x02) |
77 | #define XOR F3(2, 0x03) |
78 | #define SUB F3(2, 0x04) |
79 | #define SUBCC F3(2, 0x14) |
80 | #define MUL F3(2, 0x0a) /* umul */ |
81 | #define DIV F3(2, 0x0e) /* udiv */ |
82 | #define SLL F3(2, 0x25) |
83 | #define SRL F3(2, 0x26) |
84 | #define JMPL F3(2, 0x38) |
85 | #define CALL F1(1) |
86 | #define BR F2(0, 0x01) |
87 | #define RD_Y F3(2, 0x28) |
88 | #define WR_Y F3(2, 0x30) |
89 | |
90 | #define LD32 F3(3, 0x00) |
91 | #define LD8 F3(3, 0x01) |
92 | #define LD16 F3(3, 0x02) |
93 | #define LD64 F3(3, 0x0b) |
94 | #define ST32 F3(3, 0x04) |
95 | |
96 | #define LDPTR LD32 |
97 | #define BASE_STACKFRAME 96 |
98 | |
99 | #define LD32I (LD32 | IMMED) |
100 | #define LD8I (LD8 | IMMED) |
101 | #define LD16I (LD16 | IMMED) |
102 | #define LD64I (LD64 | IMMED) |
103 | #define LDPTRI (LDPTR | IMMED) |
104 | #define ST32I (ST32 | IMMED) |
105 | |
106 | #define emit_nop() \ |
107 | do { \ |
108 | *prog++ = SETHI(0, G0); \ |
109 | } while (0) |
110 | |
111 | #define emit_neg() \ |
112 | do { /* sub %g0, r_A, r_A */ \ |
113 | *prog++ = SUB | RS1(G0) | RS2(r_A) | RD(r_A); \ |
114 | } while (0) |
115 | |
116 | #define emit_reg_move(FROM, TO) \ |
117 | do { /* or %g0, FROM, TO */ \ |
118 | *prog++ = OR | RS1(G0) | RS2(FROM) | RD(TO); \ |
119 | } while (0) |
120 | |
121 | #define emit_clear(REG) \ |
122 | do { /* or %g0, %g0, REG */ \ |
123 | *prog++ = OR | RS1(G0) | RS2(G0) | RD(REG); \ |
124 | } while (0) |
125 | |
126 | #define emit_set_const(K, REG) \ |
127 | do { /* sethi %hi(K), REG */ \ |
128 | *prog++ = SETHI(K, REG); \ |
129 | /* or REG, %lo(K), REG */ \ |
130 | *prog++ = OR_LO(K, REG); \ |
131 | } while (0) |
132 | |
133 | /* Emit |
134 | * |
135 | * OP r_A, r_X, r_A |
136 | */ |
137 | #define emit_alu_X(OPCODE) \ |
138 | do { \ |
139 | seen |= SEEN_XREG; \ |
140 | *prog++ = OPCODE | RS1(r_A) | RS2(r_X) | RD(r_A); \ |
141 | } while (0) |
142 | |
143 | /* Emit either: |
144 | * |
145 | * OP r_A, K, r_A |
146 | * |
147 | * or |
148 | * |
149 | * sethi %hi(K), r_TMP |
150 | * or r_TMP, %lo(K), r_TMP |
151 | * OP r_A, r_TMP, r_A |
152 | * |
153 | * depending upon whether K fits in a signed 13-bit |
154 | * immediate instruction field. Emit nothing if K |
155 | * is zero. |
156 | */ |
157 | #define emit_alu_K(OPCODE, K) \ |
158 | do { \ |
159 | if (K || OPCODE == AND || OPCODE == MUL) { \ |
160 | unsigned int _insn = OPCODE; \ |
161 | _insn |= RS1(r_A) | RD(r_A); \ |
162 | if (is_simm13(K)) { \ |
163 | *prog++ = _insn | IMMED | S13(K); \ |
164 | } else { \ |
165 | emit_set_const(K, r_TMP); \ |
166 | *prog++ = _insn | RS2(r_TMP); \ |
167 | } \ |
168 | } \ |
169 | } while (0) |
170 | |
171 | #define emit_loadimm(K, DEST) \ |
172 | do { \ |
173 | if (is_simm13(K)) { \ |
174 | /* or %g0, K, DEST */ \ |
175 | *prog++ = OR | IMMED | RS1(G0) | S13(K) | RD(DEST); \ |
176 | } else { \ |
177 | emit_set_const(K, DEST); \ |
178 | } \ |
179 | } while (0) |
180 | |
181 | #define emit_loadptr(BASE, STRUCT, FIELD, DEST) \ |
182 | do { unsigned int _off = offsetof(STRUCT, FIELD); \ |
183 | BUILD_BUG_ON(sizeof_field(STRUCT, FIELD) != sizeof(void *)); \ |
184 | *prog++ = LDPTRI | RS1(BASE) | S13(_off) | RD(DEST); \ |
185 | } while (0) |
186 | |
187 | #define emit_load32(BASE, STRUCT, FIELD, DEST) \ |
188 | do { unsigned int _off = offsetof(STRUCT, FIELD); \ |
189 | BUILD_BUG_ON(sizeof_field(STRUCT, FIELD) != sizeof(u32)); \ |
190 | *prog++ = LD32I | RS1(BASE) | S13(_off) | RD(DEST); \ |
191 | } while (0) |
192 | |
193 | #define emit_load16(BASE, STRUCT, FIELD, DEST) \ |
194 | do { unsigned int _off = offsetof(STRUCT, FIELD); \ |
195 | BUILD_BUG_ON(sizeof_field(STRUCT, FIELD) != sizeof(u16)); \ |
196 | *prog++ = LD16I | RS1(BASE) | S13(_off) | RD(DEST); \ |
197 | } while (0) |
198 | |
199 | #define __emit_load8(BASE, STRUCT, FIELD, DEST) \ |
200 | do { unsigned int _off = offsetof(STRUCT, FIELD); \ |
201 | *prog++ = LD8I | RS1(BASE) | S13(_off) | RD(DEST); \ |
202 | } while (0) |
203 | |
204 | #define emit_load8(BASE, STRUCT, FIELD, DEST) \ |
205 | do { BUILD_BUG_ON(sizeof_field(STRUCT, FIELD) != sizeof(u8)); \ |
206 | __emit_load8(BASE, STRUCT, FIELD, DEST); \ |
207 | } while (0) |
208 | |
209 | #define BIAS (-4) |
210 | |
211 | #define emit_ldmem(OFF, DEST) \ |
212 | do { *prog++ = LD32I | RS1(SP) | S13(BIAS - (OFF)) | RD(DEST); \ |
213 | } while (0) |
214 | |
215 | #define emit_stmem(OFF, SRC) \ |
216 | do { *prog++ = ST32I | RS1(SP) | S13(BIAS - (OFF)) | RD(SRC); \ |
217 | } while (0) |
218 | |
219 | #ifdef CONFIG_SMP |
220 | #define emit_load_cpu(REG) \ |
221 | emit_load32(G6, struct thread_info, cpu, REG) |
222 | #else |
223 | #define emit_load_cpu(REG) emit_clear(REG) |
224 | #endif |
225 | |
226 | #define emit_skb_loadptr(FIELD, DEST) \ |
227 | emit_loadptr(r_SKB, struct sk_buff, FIELD, DEST) |
228 | #define emit_skb_load32(FIELD, DEST) \ |
229 | emit_load32(r_SKB, struct sk_buff, FIELD, DEST) |
230 | #define emit_skb_load16(FIELD, DEST) \ |
231 | emit_load16(r_SKB, struct sk_buff, FIELD, DEST) |
232 | #define __emit_skb_load8(FIELD, DEST) \ |
233 | __emit_load8(r_SKB, struct sk_buff, FIELD, DEST) |
234 | #define emit_skb_load8(FIELD, DEST) \ |
235 | emit_load8(r_SKB, struct sk_buff, FIELD, DEST) |
236 | |
237 | #define emit_jmpl(BASE, IMM_OFF, LREG) \ |
238 | *prog++ = (JMPL | IMMED | RS1(BASE) | S13(IMM_OFF) | RD(LREG)) |
239 | |
240 | #define emit_call(FUNC) \ |
241 | do { void *_here = image + addrs[i] - 8; \ |
242 | unsigned int _off = (void *)(FUNC) - _here; \ |
243 | *prog++ = CALL | (((_off) >> 2) & 0x3fffffff); \ |
244 | emit_nop(); \ |
245 | } while (0) |
246 | |
247 | #define emit_branch(BR_OPC, DEST) \ |
248 | do { unsigned int _here = addrs[i] - 8; \ |
249 | *prog++ = BR_OPC | WDISP22((DEST) - _here); \ |
250 | } while (0) |
251 | |
252 | #define emit_branch_off(BR_OPC, OFF) \ |
253 | do { *prog++ = BR_OPC | WDISP22(OFF); \ |
254 | } while (0) |
255 | |
256 | #define emit_jump(DEST) emit_branch(BA, DEST) |
257 | |
258 | #define emit_read_y(REG) *prog++ = RD_Y | RD(REG) |
259 | #define emit_write_y(REG) *prog++ = WR_Y | IMMED | RS1(REG) | S13(0) |
260 | |
261 | #define emit_cmp(R1, R2) \ |
262 | *prog++ = (SUBCC | RS1(R1) | RS2(R2) | RD(G0)) |
263 | |
264 | #define emit_cmpi(R1, IMM) \ |
265 | *prog++ = (SUBCC | IMMED | RS1(R1) | S13(IMM) | RD(G0)); |
266 | |
267 | #define emit_btst(R1, R2) \ |
268 | *prog++ = (ANDCC | RS1(R1) | RS2(R2) | RD(G0)) |
269 | |
270 | #define emit_btsti(R1, IMM) \ |
271 | *prog++ = (ANDCC | IMMED | RS1(R1) | S13(IMM) | RD(G0)); |
272 | |
273 | #define emit_sub(R1, R2, R3) \ |
274 | *prog++ = (SUB | RS1(R1) | RS2(R2) | RD(R3)) |
275 | |
276 | #define emit_subi(R1, IMM, R3) \ |
277 | *prog++ = (SUB | IMMED | RS1(R1) | S13(IMM) | RD(R3)) |
278 | |
279 | #define emit_add(R1, R2, R3) \ |
280 | *prog++ = (ADD | RS1(R1) | RS2(R2) | RD(R3)) |
281 | |
282 | #define emit_addi(R1, IMM, R3) \ |
283 | *prog++ = (ADD | IMMED | RS1(R1) | S13(IMM) | RD(R3)) |
284 | |
285 | #define emit_and(R1, R2, R3) \ |
286 | *prog++ = (AND | RS1(R1) | RS2(R2) | RD(R3)) |
287 | |
288 | #define emit_andi(R1, IMM, R3) \ |
289 | *prog++ = (AND | IMMED | RS1(R1) | S13(IMM) | RD(R3)) |
290 | |
291 | #define emit_alloc_stack(SZ) \ |
292 | *prog++ = (SUB | IMMED | RS1(SP) | S13(SZ) | RD(SP)) |
293 | |
294 | #define emit_release_stack(SZ) \ |
295 | *prog++ = (ADD | IMMED | RS1(SP) | S13(SZ) | RD(SP)) |
296 | |
297 | /* A note about branch offset calculations. The addrs[] array, |
298 | * indexed by BPF instruction, records the address after all the |
299 | * sparc instructions emitted for that BPF instruction. |
300 | * |
301 | * The most common case is to emit a branch at the end of such |
302 | * a code sequence. So this would be two instructions, the |
303 | * branch and its delay slot. |
304 | * |
305 | * Therefore by default the branch emitters calculate the branch |
306 | * offset field as: |
307 | * |
308 | * destination - (addrs[i] - 8) |
309 | * |
310 | * This "addrs[i] - 8" is the address of the branch itself or |
311 | * what "." would be in assembler notation. The "8" part is |
312 | * how we take into consideration the branch and its delay |
313 | * slot mentioned above. |
314 | * |
315 | * Sometimes we need to emit a branch earlier in the code |
316 | * sequence. And in these situations we adjust "destination" |
317 | * to accommodate this difference. For example, if we needed |
318 | * to emit a branch (and its delay slot) right before the |
319 | * final instruction emitted for a BPF opcode, we'd use |
320 | * "destination + 4" instead of just plain "destination" above. |
321 | * |
322 | * This is why you see all of these funny emit_branch() and |
323 | * emit_jump() calls with adjusted offsets. |
324 | */ |
325 | |
326 | void bpf_jit_compile(struct bpf_prog *fp) |
327 | { |
328 | unsigned int cleanup_addr, proglen, oldproglen = 0; |
329 | u32 temp[8], *prog, *func, seen = 0, pass; |
330 | const struct sock_filter *filter = fp->insns; |
331 | int i, flen = fp->len, pc_ret0 = -1; |
332 | unsigned int *addrs; |
333 | void *image; |
334 | |
335 | if (!bpf_jit_enable) |
336 | return; |
337 | |
338 | addrs = kmalloc_array(n: flen, size: sizeof(*addrs), GFP_KERNEL); |
339 | if (addrs == NULL) |
340 | return; |
341 | |
342 | /* Before first pass, make a rough estimation of addrs[] |
343 | * each bpf instruction is translated to less than 64 bytes |
344 | */ |
345 | for (proglen = 0, i = 0; i < flen; i++) { |
346 | proglen += 64; |
347 | addrs[i] = proglen; |
348 | } |
349 | cleanup_addr = proglen; /* epilogue address */ |
350 | image = NULL; |
351 | for (pass = 0; pass < 10; pass++) { |
352 | u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; |
353 | |
354 | /* no prologue/epilogue for trivial filters (RET something) */ |
355 | proglen = 0; |
356 | prog = temp; |
357 | |
358 | /* Prologue */ |
359 | if (seen_or_pass0) { |
360 | if (seen_or_pass0 & SEEN_MEM) { |
361 | unsigned int sz = BASE_STACKFRAME; |
362 | sz += BPF_MEMWORDS * sizeof(u32); |
363 | emit_alloc_stack(sz); |
364 | } |
365 | |
366 | /* Make sure we dont leek kernel memory. */ |
367 | if (seen_or_pass0 & SEEN_XREG) |
368 | emit_clear(r_X); |
369 | |
370 | /* If this filter needs to access skb data, |
371 | * load %o4 and %o5 with: |
372 | * %o4 = skb->len - skb->data_len |
373 | * %o5 = skb->data |
374 | * And also back up %o7 into r_saved_O7 so we can |
375 | * invoke the stubs using 'call'. |
376 | */ |
377 | if (seen_or_pass0 & SEEN_DATAREF) { |
378 | emit_load32(r_SKB, struct sk_buff, len, r_HEADLEN); |
379 | emit_load32(r_SKB, struct sk_buff, data_len, r_TMP); |
380 | emit_sub(r_HEADLEN, r_TMP, r_HEADLEN); |
381 | emit_loadptr(r_SKB, struct sk_buff, data, r_SKB_DATA); |
382 | } |
383 | } |
384 | emit_reg_move(O7, r_saved_O7); |
385 | |
386 | /* Make sure we dont leak kernel information to the user. */ |
387 | if (bpf_needs_clear_a(first: &filter[0])) |
388 | emit_clear(r_A); /* A = 0 */ |
389 | |
390 | for (i = 0; i < flen; i++) { |
391 | unsigned int K = filter[i].k; |
392 | unsigned int t_offset; |
393 | unsigned int f_offset; |
394 | u32 t_op, f_op; |
395 | u16 code = bpf_anc_helper(ftest: &filter[i]); |
396 | int ilen; |
397 | |
398 | switch (code) { |
399 | case BPF_ALU | BPF_ADD | BPF_X: /* A += X; */ |
400 | emit_alu_X(ADD); |
401 | break; |
402 | case BPF_ALU | BPF_ADD | BPF_K: /* A += K; */ |
403 | emit_alu_K(ADD, K); |
404 | break; |
405 | case BPF_ALU | BPF_SUB | BPF_X: /* A -= X; */ |
406 | emit_alu_X(SUB); |
407 | break; |
408 | case BPF_ALU | BPF_SUB | BPF_K: /* A -= K */ |
409 | emit_alu_K(SUB, K); |
410 | break; |
411 | case BPF_ALU | BPF_AND | BPF_X: /* A &= X */ |
412 | emit_alu_X(AND); |
413 | break; |
414 | case BPF_ALU | BPF_AND | BPF_K: /* A &= K */ |
415 | emit_alu_K(AND, K); |
416 | break; |
417 | case BPF_ALU | BPF_OR | BPF_X: /* A |= X */ |
418 | emit_alu_X(OR); |
419 | break; |
420 | case BPF_ALU | BPF_OR | BPF_K: /* A |= K */ |
421 | emit_alu_K(OR, K); |
422 | break; |
423 | case BPF_ANC | SKF_AD_ALU_XOR_X: /* A ^= X; */ |
424 | case BPF_ALU | BPF_XOR | BPF_X: |
425 | emit_alu_X(XOR); |
426 | break; |
427 | case BPF_ALU | BPF_XOR | BPF_K: /* A ^= K */ |
428 | emit_alu_K(XOR, K); |
429 | break; |
430 | case BPF_ALU | BPF_LSH | BPF_X: /* A <<= X */ |
431 | emit_alu_X(SLL); |
432 | break; |
433 | case BPF_ALU | BPF_LSH | BPF_K: /* A <<= K */ |
434 | emit_alu_K(SLL, K); |
435 | break; |
436 | case BPF_ALU | BPF_RSH | BPF_X: /* A >>= X */ |
437 | emit_alu_X(SRL); |
438 | break; |
439 | case BPF_ALU | BPF_RSH | BPF_K: /* A >>= K */ |
440 | emit_alu_K(SRL, K); |
441 | break; |
442 | case BPF_ALU | BPF_MUL | BPF_X: /* A *= X; */ |
443 | emit_alu_X(MUL); |
444 | break; |
445 | case BPF_ALU | BPF_MUL | BPF_K: /* A *= K */ |
446 | emit_alu_K(MUL, K); |
447 | break; |
448 | case BPF_ALU | BPF_DIV | BPF_K: /* A /= K with K != 0*/ |
449 | if (K == 1) |
450 | break; |
451 | emit_write_y(G0); |
452 | /* The Sparc v8 architecture requires |
453 | * three instructions between a %y |
454 | * register write and the first use. |
455 | */ |
456 | emit_nop(); |
457 | emit_nop(); |
458 | emit_nop(); |
459 | emit_alu_K(DIV, K); |
460 | break; |
461 | case BPF_ALU | BPF_DIV | BPF_X: /* A /= X; */ |
462 | emit_cmpi(r_X, 0); |
463 | if (pc_ret0 > 0) { |
464 | t_offset = addrs[pc_ret0 - 1]; |
465 | emit_branch(BE, t_offset + 20); |
466 | emit_nop(); /* delay slot */ |
467 | } else { |
468 | emit_branch_off(BNE, 16); |
469 | emit_nop(); |
470 | emit_jump(cleanup_addr + 20); |
471 | emit_clear(r_A); |
472 | } |
473 | emit_write_y(G0); |
474 | /* The Sparc v8 architecture requires |
475 | * three instructions between a %y |
476 | * register write and the first use. |
477 | */ |
478 | emit_nop(); |
479 | emit_nop(); |
480 | emit_nop(); |
481 | emit_alu_X(DIV); |
482 | break; |
483 | case BPF_ALU | BPF_NEG: |
484 | emit_neg(); |
485 | break; |
486 | case BPF_RET | BPF_K: |
487 | if (!K) { |
488 | if (pc_ret0 == -1) |
489 | pc_ret0 = i; |
490 | emit_clear(r_A); |
491 | } else { |
492 | emit_loadimm(K, r_A); |
493 | } |
494 | fallthrough; |
495 | case BPF_RET | BPF_A: |
496 | if (seen_or_pass0) { |
497 | if (i != flen - 1) { |
498 | emit_jump(cleanup_addr); |
499 | emit_nop(); |
500 | break; |
501 | } |
502 | if (seen_or_pass0 & SEEN_MEM) { |
503 | unsigned int sz = BASE_STACKFRAME; |
504 | sz += BPF_MEMWORDS * sizeof(u32); |
505 | emit_release_stack(sz); |
506 | } |
507 | } |
508 | /* jmpl %r_saved_O7 + 8, %g0 */ |
509 | emit_jmpl(r_saved_O7, 8, G0); |
510 | emit_reg_move(r_A, O0); /* delay slot */ |
511 | break; |
512 | case BPF_MISC | BPF_TAX: |
513 | seen |= SEEN_XREG; |
514 | emit_reg_move(r_A, r_X); |
515 | break; |
516 | case BPF_MISC | BPF_TXA: |
517 | seen |= SEEN_XREG; |
518 | emit_reg_move(r_X, r_A); |
519 | break; |
520 | case BPF_ANC | SKF_AD_CPU: |
521 | emit_load_cpu(r_A); |
522 | break; |
523 | case BPF_ANC | SKF_AD_PROTOCOL: |
524 | emit_skb_load16(protocol, r_A); |
525 | break; |
526 | case BPF_ANC | SKF_AD_PKTTYPE: |
527 | __emit_skb_load8(__pkt_type_offset, r_A); |
528 | emit_andi(r_A, PKT_TYPE_MAX, r_A); |
529 | emit_alu_K(SRL, 5); |
530 | break; |
531 | case BPF_ANC | SKF_AD_IFINDEX: |
532 | emit_skb_loadptr(dev, r_A); |
533 | emit_cmpi(r_A, 0); |
534 | emit_branch(BE_PTR, cleanup_addr + 4); |
535 | emit_nop(); |
536 | emit_load32(r_A, struct net_device, ifindex, r_A); |
537 | break; |
538 | case BPF_ANC | SKF_AD_MARK: |
539 | emit_skb_load32(mark, r_A); |
540 | break; |
541 | case BPF_ANC | SKF_AD_QUEUE: |
542 | emit_skb_load16(queue_mapping, r_A); |
543 | break; |
544 | case BPF_ANC | SKF_AD_HATYPE: |
545 | emit_skb_loadptr(dev, r_A); |
546 | emit_cmpi(r_A, 0); |
547 | emit_branch(BE_PTR, cleanup_addr + 4); |
548 | emit_nop(); |
549 | emit_load16(r_A, struct net_device, type, r_A); |
550 | break; |
551 | case BPF_ANC | SKF_AD_RXHASH: |
552 | emit_skb_load32(hash, r_A); |
553 | break; |
554 | case BPF_ANC | SKF_AD_VLAN_TAG: |
555 | emit_skb_load16(vlan_tci, r_A); |
556 | break; |
557 | case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT: |
558 | emit_skb_load32(vlan_all, r_A); |
559 | emit_cmpi(r_A, 0); |
560 | emit_branch_off(BE, 12); |
561 | emit_nop(); |
562 | emit_loadimm(1, r_A); |
563 | break; |
564 | case BPF_LD | BPF_W | BPF_LEN: |
565 | emit_skb_load32(len, r_A); |
566 | break; |
567 | case BPF_LDX | BPF_W | BPF_LEN: |
568 | emit_skb_load32(len, r_X); |
569 | break; |
570 | case BPF_LD | BPF_IMM: |
571 | emit_loadimm(K, r_A); |
572 | break; |
573 | case BPF_LDX | BPF_IMM: |
574 | emit_loadimm(K, r_X); |
575 | break; |
576 | case BPF_LD | BPF_MEM: |
577 | seen |= SEEN_MEM; |
578 | emit_ldmem(K * 4, r_A); |
579 | break; |
580 | case BPF_LDX | BPF_MEM: |
581 | seen |= SEEN_MEM | SEEN_XREG; |
582 | emit_ldmem(K * 4, r_X); |
583 | break; |
584 | case BPF_ST: |
585 | seen |= SEEN_MEM; |
586 | emit_stmem(K * 4, r_A); |
587 | break; |
588 | case BPF_STX: |
589 | seen |= SEEN_MEM | SEEN_XREG; |
590 | emit_stmem(K * 4, r_X); |
591 | break; |
592 | |
593 | #define CHOOSE_LOAD_FUNC(K, func) \ |
594 | ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset) |
595 | |
596 | case BPF_LD | BPF_W | BPF_ABS: |
597 | func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_word); |
598 | common_load: seen |= SEEN_DATAREF; |
599 | emit_loadimm(K, r_OFF); |
600 | emit_call(func); |
601 | break; |
602 | case BPF_LD | BPF_H | BPF_ABS: |
603 | func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_half); |
604 | goto common_load; |
605 | case BPF_LD | BPF_B | BPF_ABS: |
606 | func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte); |
607 | goto common_load; |
608 | case BPF_LDX | BPF_B | BPF_MSH: |
609 | func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte_msh); |
610 | goto common_load; |
611 | case BPF_LD | BPF_W | BPF_IND: |
612 | func = bpf_jit_load_word; |
613 | common_load_ind: seen |= SEEN_DATAREF | SEEN_XREG; |
614 | if (K) { |
615 | if (is_simm13(value: K)) { |
616 | emit_addi(r_X, K, r_OFF); |
617 | } else { |
618 | emit_loadimm(K, r_TMP); |
619 | emit_add(r_X, r_TMP, r_OFF); |
620 | } |
621 | } else { |
622 | emit_reg_move(r_X, r_OFF); |
623 | } |
624 | emit_call(func); |
625 | break; |
626 | case BPF_LD | BPF_H | BPF_IND: |
627 | func = bpf_jit_load_half; |
628 | goto common_load_ind; |
629 | case BPF_LD | BPF_B | BPF_IND: |
630 | func = bpf_jit_load_byte; |
631 | goto common_load_ind; |
632 | case BPF_JMP | BPF_JA: |
633 | emit_jump(addrs[i + K]); |
634 | emit_nop(); |
635 | break; |
636 | |
637 | #define COND_SEL(CODE, TOP, FOP) \ |
638 | case CODE: \ |
639 | t_op = TOP; \ |
640 | f_op = FOP; \ |
641 | goto cond_branch |
642 | |
643 | COND_SEL(BPF_JMP | BPF_JGT | BPF_K, BGU, BLEU); |
644 | COND_SEL(BPF_JMP | BPF_JGE | BPF_K, BGEU, BLU); |
645 | COND_SEL(BPF_JMP | BPF_JEQ | BPF_K, BE, BNE); |
646 | COND_SEL(BPF_JMP | BPF_JSET | BPF_K, BNE, BE); |
647 | COND_SEL(BPF_JMP | BPF_JGT | BPF_X, BGU, BLEU); |
648 | COND_SEL(BPF_JMP | BPF_JGE | BPF_X, BGEU, BLU); |
649 | COND_SEL(BPF_JMP | BPF_JEQ | BPF_X, BE, BNE); |
650 | COND_SEL(BPF_JMP | BPF_JSET | BPF_X, BNE, BE); |
651 | |
652 | cond_branch: f_offset = addrs[i + filter[i].jf]; |
653 | t_offset = addrs[i + filter[i].jt]; |
654 | |
655 | /* same targets, can avoid doing the test :) */ |
656 | if (filter[i].jt == filter[i].jf) { |
657 | emit_jump(t_offset); |
658 | emit_nop(); |
659 | break; |
660 | } |
661 | |
662 | switch (code) { |
663 | case BPF_JMP | BPF_JGT | BPF_X: |
664 | case BPF_JMP | BPF_JGE | BPF_X: |
665 | case BPF_JMP | BPF_JEQ | BPF_X: |
666 | seen |= SEEN_XREG; |
667 | emit_cmp(r_A, r_X); |
668 | break; |
669 | case BPF_JMP | BPF_JSET | BPF_X: |
670 | seen |= SEEN_XREG; |
671 | emit_btst(r_A, r_X); |
672 | break; |
673 | case BPF_JMP | BPF_JEQ | BPF_K: |
674 | case BPF_JMP | BPF_JGT | BPF_K: |
675 | case BPF_JMP | BPF_JGE | BPF_K: |
676 | if (is_simm13(value: K)) { |
677 | emit_cmpi(r_A, K); |
678 | } else { |
679 | emit_loadimm(K, r_TMP); |
680 | emit_cmp(r_A, r_TMP); |
681 | } |
682 | break; |
683 | case BPF_JMP | BPF_JSET | BPF_K: |
684 | if (is_simm13(value: K)) { |
685 | emit_btsti(r_A, K); |
686 | } else { |
687 | emit_loadimm(K, r_TMP); |
688 | emit_btst(r_A, r_TMP); |
689 | } |
690 | break; |
691 | } |
692 | if (filter[i].jt != 0) { |
693 | if (filter[i].jf) |
694 | t_offset += 8; |
695 | emit_branch(t_op, t_offset); |
696 | emit_nop(); /* delay slot */ |
697 | if (filter[i].jf) { |
698 | emit_jump(f_offset); |
699 | emit_nop(); |
700 | } |
701 | break; |
702 | } |
703 | emit_branch(f_op, f_offset); |
704 | emit_nop(); /* delay slot */ |
705 | break; |
706 | |
707 | default: |
708 | /* hmm, too complex filter, give up with jit compiler */ |
709 | goto out; |
710 | } |
711 | ilen = (void *) prog - (void *) temp; |
712 | if (image) { |
713 | if (unlikely(proglen + ilen > oldproglen)) { |
714 | pr_err("bpb_jit_compile fatal error\n" ); |
715 | kfree(objp: addrs); |
716 | module_memfree(module_region: image); |
717 | return; |
718 | } |
719 | memcpy(image + proglen, temp, ilen); |
720 | } |
721 | proglen += ilen; |
722 | addrs[i] = proglen; |
723 | prog = temp; |
724 | } |
725 | /* last bpf instruction is always a RET : |
726 | * use it to give the cleanup instruction(s) addr |
727 | */ |
728 | cleanup_addr = proglen - 8; /* jmpl; mov r_A,%o0; */ |
729 | if (seen_or_pass0 & SEEN_MEM) |
730 | cleanup_addr -= 4; /* add %sp, X, %sp; */ |
731 | |
732 | if (image) { |
733 | if (proglen != oldproglen) |
734 | pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n" , |
735 | proglen, oldproglen); |
736 | break; |
737 | } |
738 | if (proglen == oldproglen) { |
739 | image = module_alloc(size: proglen); |
740 | if (!image) |
741 | goto out; |
742 | } |
743 | oldproglen = proglen; |
744 | } |
745 | |
746 | if (bpf_jit_enable > 1) |
747 | bpf_jit_dump(flen, proglen, pass: pass + 1, image); |
748 | |
749 | if (image) { |
750 | fp->bpf_func = (void *)image; |
751 | fp->jited = 1; |
752 | } |
753 | out: |
754 | kfree(objp: addrs); |
755 | return; |
756 | } |
757 | |
758 | void bpf_jit_free(struct bpf_prog *fp) |
759 | { |
760 | if (fp->jited) |
761 | module_memfree(module_region: fp->bpf_func); |
762 | |
763 | bpf_prog_unlock_free(fp); |
764 | } |
765 | |