LXR linux/arch/s390/net/bpf_jit

   1/*
   2 * BPF Jit compiler for s390.
   3 *
   4 * Copyright IBM Corp. 2012
   5 *
   6 * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
   7 */
   8#include <linux/moduleloader.h>
   9#include <linux/netdevice.h>
  10#include <linux/if_vlan.h>
  11#include <linux/filter.h>
  12#include <linux/random.h>
  13#include <linux/init.h>
  14#include <asm/cacheflush.h>
  15#include <asm/facility.h>
  16#include <asm/dis.h>
  17
  18/*
  19 * Conventions:
  20 *   %r2 = skb pointer
  21 *   %r3 = offset parameter
  22 *   %r4 = scratch register / length parameter
  23 *   %r5 = BPF A accumulator
  24 *   %r8 = return address
  25 *   %r9 = save register for skb pointer
  26 *   %r10 = skb->data
  27 *   %r11 = skb->len - skb->data_len (headlen)
  28 *   %r12 = BPF X accumulator
  29 *   %r13 = literal pool pointer
  30 *   0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS
  31 */
  32int bpf_jit_enable __read_mostly;
  33
  34/*
  35 * assembly code in arch/x86/net/bpf_jit.S
  36 */
  37extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
  38extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[];
  39
  40struct bpf_jit {
  41        unsigned int seen;
  42        u8 *start;
  43        u8 *prg;
  44        u8 *mid;
  45        u8 *lit;
  46        u8 *end;
  47        u8 *base_ip;
  48        u8 *ret0_ip;
  49        u8 *exit_ip;
  50        unsigned int off_load_word;
  51        unsigned int off_load_half;
  52        unsigned int off_load_byte;
  53        unsigned int off_load_bmsh;
  54        unsigned int off_load_iword;
  55        unsigned int off_load_ihalf;
  56        unsigned int off_load_ibyte;
  57};
  58
  59#define BPF_SIZE_MAX    4096    /* Max size for program */
  60
  61#define SEEN_DATAREF    1       /* might call external helpers */
  62#define SEEN_XREG       2       /* ebx is used */
  63#define SEEN_MEM        4       /* use mem[] for temporary storage */
  64#define SEEN_RET0       8       /* pc_ret0 points to a valid return 0 */
  65#define SEEN_LITERAL    16      /* code uses literals */
  66#define SEEN_LOAD_WORD  32      /* code uses sk_load_word */
  67#define SEEN_LOAD_HALF  64      /* code uses sk_load_half */
  68#define SEEN_LOAD_BYTE  128     /* code uses sk_load_byte */
  69#define SEEN_LOAD_BMSH  256     /* code uses sk_load_byte_msh */
  70#define SEEN_LOAD_IWORD 512     /* code uses sk_load_word_ind */
  71#define SEEN_LOAD_IHALF 1024    /* code uses sk_load_half_ind */
  72#define SEEN_LOAD_IBYTE 2048    /* code uses sk_load_byte_ind */
  73
  74#define EMIT2(op)                                       \
  75({                                                      \
  76        if (jit->prg + 2 <= jit->mid)                   \
  77                *(u16 *) jit->prg = op;                 \
  78        jit->prg += 2;                                  \
  79})
  80
  81#define EMIT4(op)                                       \
  82({                                                      \
  83        if (jit->prg + 4 <= jit->mid)                   \
  84                *(u32 *) jit->prg = op;                 \
  85        jit->prg += 4;                                  \
  86})
  87
  88#define EMIT4_DISP(op, disp)                            \
  89({                                                      \
  90        unsigned int __disp = (disp) & 0xfff;           \
  91        EMIT4(op | __disp);                             \
  92})
  93
  94#define EMIT4_IMM(op, imm)                              \
  95({                                                      \
  96        unsigned int __imm = (imm) & 0xffff;            \
  97        EMIT4(op | __imm);                              \
  98})
  99
 100#define EMIT4_PCREL(op, pcrel)                          \
 101({                                                      \
 102        long __pcrel = ((pcrel) >> 1) & 0xffff;         \
 103        EMIT4(op | __pcrel);                            \
 104})
 105
 106#define EMIT6(op1, op2)                                 \
 107({                                                      \
 108        if (jit->prg + 6 <= jit->mid) {                 \
 109                *(u32 *) jit->prg = op1;                \
 110                *(u16 *) (jit->prg + 4) = op2;          \
 111        }                                               \
 112        jit->prg += 6;                                  \
 113})
 114
 115#define EMIT6_DISP(op1, op2, disp)                      \
 116({                                                      \
 117        unsigned int __disp = (disp) & 0xfff;           \
 118        EMIT6(op1 | __disp, op2);                       \
 119})
 120
 121#define EMIT6_IMM(op, imm)                              \
 122({                                                      \
 123        unsigned int __imm = (imm);                     \
 124        EMIT6(op | (__imm >> 16), __imm & 0xffff);      \
 125})
 126
 127#define EMIT_CONST(val)                                 \
 128({                                                      \
 129        unsigned int ret;                               \
 130        ret = (unsigned int) (jit->lit - jit->base_ip); \
 131        jit->seen |= SEEN_LITERAL;                      \
 132        if (jit->lit + 4 <= jit->end)                   \
 133                *(u32 *) jit->lit = val;                \
 134        jit->lit += 4;                                  \
 135        ret;                                            \
 136})
 137
 138#define EMIT_FN_CONST(bit, fn)                          \
 139({                                                      \
 140        unsigned int ret;                               \
 141        ret = (unsigned int) (jit->lit - jit->base_ip); \
 142        if (jit->seen & bit) {                          \
 143                jit->seen |= SEEN_LITERAL;              \
 144                if (jit->lit + 8 <= jit->end)           \
 145                        *(void **) jit->lit = fn;       \
 146                jit->lit += 8;                          \
 147        }                                               \
 148        ret;                                            \
 149})
 150
 151static void bpf_jit_prologue(struct bpf_jit *jit)
 152{
 153        /* Save registers and create stack frame if necessary */
 154        if (jit->seen & SEEN_DATAREF) {
 155                /* stmg %r8,%r15,88(%r15) */
 156                EMIT6(0xeb8ff058, 0x0024);
 157                /* lgr %r14,%r15 */
 158                EMIT4(0xb90400ef);
 159                /* aghi %r15,<offset> */
 160                EMIT4_IMM(0xa7fb0000, (jit->seen & SEEN_MEM) ? -112 : -80);
 161                /* stg %r14,152(%r15) */
 162                EMIT6(0xe3e0f098, 0x0024);
 163        } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
 164                /* stmg %r12,%r13,120(%r15) */
 165                EMIT6(0xebcdf078, 0x0024);
 166        else if (jit->seen & SEEN_XREG)
 167                /* stg %r12,120(%r15) */
 168                EMIT6(0xe3c0f078, 0x0024);
 169        else if (jit->seen & SEEN_LITERAL)
 170                /* stg %r13,128(%r15) */
 171                EMIT6(0xe3d0f080, 0x0024);
 172
 173        /* Setup literal pool */
 174        if (jit->seen & SEEN_LITERAL) {
 175                /* basr %r13,0 */
 176                EMIT2(0x0dd0);
 177                jit->base_ip = jit->prg;
 178        }
 179        jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word);
 180        jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half);
 181        jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte);
 182        jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh);
 183        jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind);
 184        jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind);
 185        jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind);
 186
 187        /* Filter needs to access skb data */
 188        if (jit->seen & SEEN_DATAREF) {
 189                /* l %r11,<len>(%r2) */
 190                EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len));
 191                /* s %r11,<data_len>(%r2) */
 192                EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len));
 193                /* lg %r10,<data>(%r2) */
 194                EMIT6_DISP(0xe3a02000, 0x0004,
 195                           offsetof(struct sk_buff, data));
 196        }
 197}
 198
 199static void bpf_jit_epilogue(struct bpf_jit *jit)
 200{
 201        /* Return 0 */
 202        if (jit->seen & SEEN_RET0) {
 203                jit->ret0_ip = jit->prg;
 204                /* lghi %r2,0 */
 205                EMIT4(0xa7290000);
 206        }
 207        jit->exit_ip = jit->prg;
 208        /* Restore registers */
 209        if (jit->seen & SEEN_DATAREF)
 210                /* lmg %r8,%r15,<offset>(%r15) */
 211                EMIT6_DISP(0xeb8ff000, 0x0004,
 212                           (jit->seen & SEEN_MEM) ? 200 : 168);
 213        else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
 214                /* lmg %r12,%r13,120(%r15) */
 215                EMIT6(0xebcdf078, 0x0004);
 216        else if (jit->seen & SEEN_XREG)
 217                /* lg %r12,120(%r15) */
 218                EMIT6(0xe3c0f078, 0x0004);
 219        else if (jit->seen & SEEN_LITERAL)
 220                /* lg %r13,128(%r15) */
 221                EMIT6(0xe3d0f080, 0x0004);
 222        /* br %r14 */
 223        EMIT2(0x07fe);
 224}
 225
 226/* Helper to find the offset of pkt_type in sk_buff
 227 * Make sure its still a 3bit field starting at the MSBs within a byte.
 228 */
 229#define PKT_TYPE_MAX 0xe0
 230static int pkt_type_offset;
 231
 232static int __init bpf_pkt_type_offset_init(void)
 233{
 234        struct sk_buff skb_probe = {
 235                .pkt_type = ~0,
 236        };
 237        char *ct = (char *)&skb_probe;
 238        int off;
 239
 240        pkt_type_offset = -1;
 241        for (off = 0; off < sizeof(struct sk_buff); off++) {
 242                if (!ct[off])
 243                        continue;
 244                if (ct[off] == PKT_TYPE_MAX)
 245                        pkt_type_offset = off;
 246                else {
 247                        /* Found non matching bit pattern, fix needed. */
 248                        WARN_ON_ONCE(1);
 249                        pkt_type_offset = -1;
 250                        return -1;
 251                }
 252        }
 253        return 0;
 254}
 255device_initcall(bpf_pkt_type_offset_init);
 256
 257/*
 258 * make sure we dont leak kernel information to user
 259 */
 260static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
 261{
 262        /* Clear temporary memory if (seen & SEEN_MEM) */
 263        if (jit->seen & SEEN_MEM)
 264                /* xc 0(64,%r15),0(%r15) */
 265                EMIT6(0xd73ff000, 0xf000);
 266        /* Clear X if (seen & SEEN_XREG) */
 267        if (jit->seen & SEEN_XREG)
 268                /* lhi %r12,0 */
 269                EMIT4(0xa7c80000);
 270        /* Clear A if the first register does not set it. */
 271        switch (filter[0].code) {
 272        case BPF_S_LD_W_ABS:
 273        case BPF_S_LD_H_ABS:
 274        case BPF_S_LD_B_ABS:
 275        case BPF_S_LD_W_LEN:
 276        case BPF_S_LD_W_IND:
 277        case BPF_S_LD_H_IND:
 278        case BPF_S_LD_B_IND:
 279        case BPF_S_LDX_B_MSH:
 280        case BPF_S_LD_IMM:
 281        case BPF_S_LD_MEM:
 282        case BPF_S_MISC_TXA:
 283        case BPF_S_ANC_PROTOCOL:
 284        case BPF_S_ANC_PKTTYPE:
 285        case BPF_S_ANC_IFINDEX:
 286        case BPF_S_ANC_MARK:
 287        case BPF_S_ANC_QUEUE:
 288        case BPF_S_ANC_HATYPE:
 289        case BPF_S_ANC_RXHASH:
 290        case BPF_S_ANC_CPU:
 291        case BPF_S_ANC_VLAN_TAG:
 292        case BPF_S_ANC_VLAN_TAG_PRESENT:
 293        case BPF_S_RET_K:
 294                /* first instruction sets A register */
 295                break;
 296        default: /* A = 0 */
 297                /* lhi %r5,0 */
 298                EMIT4(0xa7580000);
 299        }
 300}
 301
 302static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
 303                        unsigned int *addrs, int i, int last)
 304{
 305        unsigned int K;
 306        int offset;
 307        unsigned int mask;
 308
 309        K = filter->k;
 310        switch (filter->code) {
 311        case BPF_S_ALU_ADD_X: /* A += X */
 312                jit->seen |= SEEN_XREG;
 313                /* ar %r5,%r12 */
 314                EMIT2(0x1a5c);
 315                break;
 316        case BPF_S_ALU_ADD_K: /* A += K */
 317                if (!K)
 318                        break;
 319                if (K <= 16383)
 320                        /* ahi %r5,<K> */
 321                        EMIT4_IMM(0xa75a0000, K);
 322                else if (test_facility(21))
 323                        /* alfi %r5,<K> */
 324                        EMIT6_IMM(0xc25b0000, K);
 325                else
 326                        /* a %r5,<d(K)>(%r13) */
 327                        EMIT4_DISP(0x5a50d000, EMIT_CONST(K));
 328                break;
 329        case BPF_S_ALU_SUB_X: /* A -= X */
 330                jit->seen |= SEEN_XREG;
 331                /* sr %r5,%r12 */
 332                EMIT2(0x1b5c);
 333                break;
 334        case BPF_S_ALU_SUB_K: /* A -= K */
 335                if (!K)
 336                        break;
 337                if (K <= 16384)
 338                        /* ahi %r5,-K */
 339                        EMIT4_IMM(0xa75a0000, -K);
 340                else if (test_facility(21))
 341                        /* alfi %r5,-K */
 342                        EMIT6_IMM(0xc25b0000, -K);
 343                else
 344                        /* s %r5,<d(K)>(%r13) */
 345                        EMIT4_DISP(0x5b50d000, EMIT_CONST(K));
 346                break;
 347        case BPF_S_ALU_MUL_X: /* A *= X */
 348                jit->seen |= SEEN_XREG;
 349                /* msr %r5,%r12 */
 350                EMIT4(0xb252005c);
 351                break;
 352        case BPF_S_ALU_MUL_K: /* A *= K */
 353                if (K <= 16383)
 354                        /* mhi %r5,K */
 355                        EMIT4_IMM(0xa75c0000, K);
 356                else if (test_facility(34))
 357                        /* msfi %r5,<K> */
 358                        EMIT6_IMM(0xc2510000, K);
 359                else
 360                        /* ms %r5,<d(K)>(%r13) */
 361                        EMIT4_DISP(0x7150d000, EMIT_CONST(K));
 362                break;
 363        case BPF_S_ALU_DIV_X: /* A /= X */
 364                jit->seen |= SEEN_XREG | SEEN_RET0;
 365                /* ltr %r12,%r12 */
 366                EMIT2(0x12cc);
 367                /* jz <ret0> */
 368                EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
 369                /* lhi %r4,0 */
 370                EMIT4(0xa7480000);
 371                /* dlr %r4,%r12 */
 372                EMIT4(0xb997004c);
 373                break;
 374        case BPF_S_ALU_DIV_K: /* A /= K */
 375                if (K == 1)
 376                        break;
 377                /* lhi %r4,0 */
 378                EMIT4(0xa7480000);
 379                /* dl %r4,<d(K)>(%r13) */
 380                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
 381                break;
 382        case BPF_S_ALU_MOD_X: /* A %= X */
 383                jit->seen |= SEEN_XREG | SEEN_RET0;
 384                /* ltr %r12,%r12 */
 385                EMIT2(0x12cc);
 386                /* jz <ret0> */
 387                EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
 388                /* lhi %r4,0 */
 389                EMIT4(0xa7480000);
 390                /* dlr %r4,%r12 */
 391                EMIT4(0xb997004c);
 392                /* lr %r5,%r4 */
 393                EMIT2(0x1854);
 394                break;
 395        case BPF_S_ALU_MOD_K: /* A %= K */
 396                if (K == 1) {
 397                        /* lhi %r5,0 */
 398                        EMIT4(0xa7580000);
 399                        break;
 400                }
 401                /* lhi %r4,0 */
 402                EMIT4(0xa7480000);
 403                /* dl %r4,<d(K)>(%r13) */
 404                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
 405                /* lr %r5,%r4 */
 406                EMIT2(0x1854);
 407                break;
 408        case BPF_S_ALU_AND_X: /* A &= X */
 409                jit->seen |= SEEN_XREG;
 410                /* nr %r5,%r12 */
 411                EMIT2(0x145c);
 412                break;
 413        case BPF_S_ALU_AND_K: /* A &= K */
 414                if (test_facility(21))
 415                        /* nilf %r5,<K> */
 416                        EMIT6_IMM(0xc05b0000, K);
 417                else
 418                        /* n %r5,<d(K)>(%r13) */
 419                        EMIT4_DISP(0x5450d000, EMIT_CONST(K));
 420                break;
 421        case BPF_S_ALU_OR_X: /* A |= X */
 422                jit->seen |= SEEN_XREG;
 423                /* or %r5,%r12 */
 424                EMIT2(0x165c);
 425                break;
 426        case BPF_S_ALU_OR_K: /* A |= K */
 427                if (test_facility(21))
 428                        /* oilf %r5,<K> */
 429                        EMIT6_IMM(0xc05d0000, K);
 430                else
 431                        /* o %r5,<d(K)>(%r13) */
 432                        EMIT4_DISP(0x5650d000, EMIT_CONST(K));
 433                break;
 434        case BPF_S_ANC_ALU_XOR_X: /* A ^= X; */
 435        case BPF_S_ALU_XOR_X:
 436                jit->seen |= SEEN_XREG;
 437                /* xr %r5,%r12 */
 438                EMIT2(0x175c);
 439                break;
 440        case BPF_S_ALU_XOR_K: /* A ^= K */
 441                if (!K)
 442                        break;
 443                /* x %r5,<d(K)>(%r13) */
 444                EMIT4_DISP(0x5750d000, EMIT_CONST(K));
 445                break;
 446        case BPF_S_ALU_LSH_X: /* A <<= X; */
 447                jit->seen |= SEEN_XREG;
 448                /* sll %r5,0(%r12) */
 449                EMIT4(0x8950c000);
 450                break;
 451        case BPF_S_ALU_LSH_K: /* A <<= K */
 452                if (K == 0)
 453                        break;
 454                /* sll %r5,K */
 455                EMIT4_DISP(0x89500000, K);
 456                break;
 457        case BPF_S_ALU_RSH_X: /* A >>= X; */
 458                jit->seen |= SEEN_XREG;
 459                /* srl %r5,0(%r12) */
 460                EMIT4(0x8850c000);
 461                break;
 462        case BPF_S_ALU_RSH_K: /* A >>= K; */
 463                if (K == 0)
 464                        break;
 465                /* srl %r5,K */
 466                EMIT4_DISP(0x88500000, K);
 467                break;
 468        case BPF_S_ALU_NEG: /* A = -A */
 469                /* lnr %r5,%r5 */
 470                EMIT2(0x1155);
 471                break;
 472        case BPF_S_JMP_JA: /* ip += K */
 473                offset = addrs[i + K] + jit->start - jit->prg;
 474                EMIT4_PCREL(0xa7f40000, offset);
 475                break;
 476        case BPF_S_JMP_JGT_K: /* ip += (A > K) ? jt : jf */
 477                mask = 0x200000; /* jh */
 478                goto kbranch;
 479        case BPF_S_JMP_JGE_K: /* ip += (A >= K) ? jt : jf */
 480                mask = 0xa00000; /* jhe */
 481                goto kbranch;
 482        case BPF_S_JMP_JEQ_K: /* ip += (A == K) ? jt : jf */
 483                mask = 0x800000; /* je */
 484kbranch:        /* Emit compare if the branch targets are different */
 485                if (filter->jt != filter->jf) {
 486                        if (K <= 16383)
 487                                /* chi %r5,<K> */
 488                                EMIT4_IMM(0xa75e0000, K);
 489                        else if (test_facility(21))
 490                                /* clfi %r5,<K> */
 491                                EMIT6_IMM(0xc25f0000, K);
 492                        else
 493                                /* c %r5,<d(K)>(%r13) */
 494                                EMIT4_DISP(0x5950d000, EMIT_CONST(K));
 495                }
 496branch:         if (filter->jt == filter->jf) {
 497                        if (filter->jt == 0)
 498                                break;
 499                        /* j <jt> */
 500                        offset = addrs[i + filter->jt] + jit->start - jit->prg;
 501                        EMIT4_PCREL(0xa7f40000, offset);
 502                        break;
 503                }
 504                if (filter->jt != 0) {
 505                        /* brc  <mask>,<jt> */
 506                        offset = addrs[i + filter->jt] + jit->start - jit->prg;
 507                        EMIT4_PCREL(0xa7040000 | mask, offset);
 508                }
 509                if (filter->jf != 0) {
 510                        /* brc  <mask^15>,<jf> */
 511                        offset = addrs[i + filter->jf] + jit->start - jit->prg;
 512                        EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset);
 513                }
 514                break;
 515        case BPF_S_JMP_JSET_K: /* ip += (A & K) ? jt : jf */
 516                mask = 0x700000; /* jnz */
 517                /* Emit test if the branch targets are different */
 518                if (filter->jt != filter->jf) {
 519                        if (K > 65535) {
 520                                /* lr %r4,%r5 */
 521                                EMIT2(0x1845);
 522                                /* n %r4,<d(K)>(%r13) */
 523                                EMIT4_DISP(0x5440d000, EMIT_CONST(K));
 524                        } else
 525                                /* tmll %r5,K */
 526                                EMIT4_IMM(0xa7510000, K);
 527                }
 528                goto branch;
 529        case BPF_S_JMP_JGT_X: /* ip += (A > X) ? jt : jf */
 530                mask = 0x200000; /* jh */
 531                goto xbranch;
 532        case BPF_S_JMP_JGE_X: /* ip += (A >= X) ? jt : jf */
 533                mask = 0xa00000; /* jhe */
 534                goto xbranch;
 535        case BPF_S_JMP_JEQ_X: /* ip += (A == X) ? jt : jf */
 536                mask = 0x800000; /* je */
 537xbranch:        /* Emit compare if the branch targets are different */
 538                if (filter->jt != filter->jf) {
 539                        jit->seen |= SEEN_XREG;
 540                        /* cr %r5,%r12 */
 541                        EMIT2(0x195c);
 542                }
 543                goto branch;
 544        case BPF_S_JMP_JSET_X: /* ip += (A & X) ? jt : jf */
 545                mask = 0x700000; /* jnz */
 546                /* Emit test if the branch targets are different */
 547                if (filter->jt != filter->jf) {
 548                        jit->seen |= SEEN_XREG;
 549                        /* lr %r4,%r5 */
 550                        EMIT2(0x1845);
 551                        /* nr %r4,%r12 */
 552                        EMIT2(0x144c);
 553                }
 554                goto branch;
 555        case BPF_S_LD_W_ABS: /* A = *(u32 *) (skb->data+K) */
 556                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD;
 557                offset = jit->off_load_word;
 558                goto load_abs;
 559        case BPF_S_LD_H_ABS: /* A = *(u16 *) (skb->data+K) */
 560                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF;
 561                offset = jit->off_load_half;
 562                goto load_abs;
 563        case BPF_S_LD_B_ABS: /* A = *(u8 *) (skb->data+K) */
 564                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE;
 565                offset = jit->off_load_byte;
 566load_abs:       if ((int) K < 0)
 567                        goto out;
 568call_fn:        /* lg %r1,<d(function)>(%r13) */
 569                EMIT6_DISP(0xe310d000, 0x0004, offset);
 570                /* l %r3,<d(K)>(%r13) */
 571                EMIT4_DISP(0x5830d000, EMIT_CONST(K));
 572                /* basr %r8,%r1 */
 573                EMIT2(0x0d81);
 574                /* jnz <ret0> */
 575                EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg));
 576                break;
 577        case BPF_S_LD_W_IND: /* A = *(u32 *) (skb->data+K+X) */
 578                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD;
 579                offset = jit->off_load_iword;
 580                goto call_fn;
 581        case BPF_S_LD_H_IND: /* A = *(u16 *) (skb->data+K+X) */
 582                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF;
 583                offset = jit->off_load_ihalf;
 584                goto call_fn;
 585        case BPF_S_LD_B_IND: /* A = *(u8 *) (skb->data+K+X) */
 586                jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE;
 587                offset = jit->off_load_ibyte;
 588                goto call_fn;
 589        case BPF_S_LDX_B_MSH:
 590                /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */
 591                jit->seen |= SEEN_RET0;
 592                if ((int) K < 0) {
 593                        /* j <ret0> */
 594                        EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg));
 595                        break;
 596                }
 597                jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH;
 598                offset = jit->off_load_bmsh;
 599                goto call_fn;
 600        case BPF_S_LD_W_LEN: /* A = skb->len; */
 601                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
 602                /* l %r5,<d(len)>(%r2) */
 603                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len));
 604                break;
 605        case BPF_S_LDX_W_LEN: /* X = skb->len; */
 606                jit->seen |= SEEN_XREG;
 607                /* l %r12,<d(len)>(%r2) */
 608                EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len));
 609                break;
 610        case BPF_S_LD_IMM: /* A = K */
 611                if (K <= 16383)
 612                        /* lhi %r5,K */
 613                        EMIT4_IMM(0xa7580000, K);
 614                else if (test_facility(21))
 615                        /* llilf %r5,<K> */
 616                        EMIT6_IMM(0xc05f0000, K);
 617                else
 618                        /* l %r5,<d(K)>(%r13) */
 619                        EMIT4_DISP(0x5850d000, EMIT_CONST(K));
 620                break;
 621        case BPF_S_LDX_IMM: /* X = K */
 622                jit->seen |= SEEN_XREG;
 623                if (K <= 16383)
 624                        /* lhi %r12,<K> */
 625                        EMIT4_IMM(0xa7c80000, K);
 626                else if (test_facility(21))
 627                        /* llilf %r12,<K> */
 628                        EMIT6_IMM(0xc0cf0000, K);
 629                else
 630                        /* l %r12,<d(K)>(%r13) */
 631                        EMIT4_DISP(0x58c0d000, EMIT_CONST(K));
 632                break;
 633        case BPF_S_LD_MEM: /* A = mem[K] */
 634                jit->seen |= SEEN_MEM;
 635                /* l %r5,<K>(%r15) */
 636                EMIT4_DISP(0x5850f000,
 637                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 638                break;
 639        case BPF_S_LDX_MEM: /* X = mem[K] */
 640                jit->seen |= SEEN_XREG | SEEN_MEM;
 641                /* l %r12,<K>(%r15) */
 642                EMIT4_DISP(0x58c0f000,
 643                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 644                break;
 645        case BPF_S_MISC_TAX: /* X = A */
 646                jit->seen |= SEEN_XREG;
 647                /* lr %r12,%r5 */
 648                EMIT2(0x18c5);
 649                break;
 650        case BPF_S_MISC_TXA: /* A = X */
 651                jit->seen |= SEEN_XREG;
 652                /* lr %r5,%r12 */
 653                EMIT2(0x185c);
 654                break;
 655        case BPF_S_RET_K:
 656                if (K == 0) {
 657                        jit->seen |= SEEN_RET0;
 658                        if (last)
 659                                break;
 660                        /* j <ret0> */
 661                        EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg);
 662                } else {
 663                        if (K <= 16383)
 664                                /* lghi %r2,K */
 665                                EMIT4_IMM(0xa7290000, K);
 666                        else
 667                                /* llgf %r2,<K>(%r13) */
 668                                EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K));
 669                        /* j <exit> */
 670                        if (last && !(jit->seen & SEEN_RET0))
 671                                break;
 672                        EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
 673                }
 674                break;
 675        case BPF_S_RET_A:
 676                /* llgfr %r2,%r5 */
 677                EMIT4(0xb9160025);
 678                /* j <exit> */
 679                EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
 680                break;
 681        case BPF_S_ST: /* mem[K] = A */
 682                jit->seen |= SEEN_MEM;
 683                /* st %r5,<K>(%r15) */
 684                EMIT4_DISP(0x5050f000,
 685                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 686                break;
 687        case BPF_S_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */
 688                jit->seen |= SEEN_XREG | SEEN_MEM;
 689                /* st %r12,<K>(%r15) */
 690                EMIT4_DISP(0x50c0f000,
 691                           (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 692                break;
 693        case BPF_S_ANC_PROTOCOL: /* A = ntohs(skb->protocol); */
 694                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2);
 695                /* lhi %r5,0 */
 696                EMIT4(0xa7580000);
 697                /* icm  %r5,3,<d(protocol)>(%r2) */
 698                EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol));
 699                break;
 700        case BPF_S_ANC_IFINDEX: /* if (!skb->dev) return 0;
 701                                 * A = skb->dev->ifindex */
 702                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
 703                jit->seen |= SEEN_RET0;
 704                /* lg %r1,<d(dev)>(%r2) */
 705                EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
 706                /* ltgr %r1,%r1 */
 707                EMIT4(0xb9020011);
 708                /* jz <ret0> */
 709                EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
 710                /* l %r5,<d(ifindex)>(%r1) */
 711                EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex));
 712                break;
 713        case BPF_S_ANC_MARK: /* A = skb->mark */
 714                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
 715                /* l %r5,<d(mark)>(%r2) */
 716                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark));
 717                break;
 718        case BPF_S_ANC_QUEUE: /* A = skb->queue_mapping */
 719                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2);
 720                /* lhi %r5,0 */
 721                EMIT4(0xa7580000);
 722                /* icm  %r5,3,<d(queue_mapping)>(%r2) */
 723                EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping));
 724                break;
 725        case BPF_S_ANC_HATYPE:  /* if (!skb->dev) return 0;
 726                                 * A = skb->dev->type */
 727                BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2);
 728                jit->seen |= SEEN_RET0;
 729                /* lg %r1,<d(dev)>(%r2) */
 730                EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
 731                /* ltgr %r1,%r1 */
 732                EMIT4(0xb9020011);
 733                /* jz <ret0> */
 734                EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
 735                /* lhi %r5,0 */
 736                EMIT4(0xa7580000);
 737                /* icm  %r5,3,<d(type)>(%r1) */
 738                EMIT4_DISP(0xbf531000, offsetof(struct net_device, type));
 739                break;
 740        case BPF_S_ANC_RXHASH: /* A = skb->rxhash */
 741                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, rxhash) != 4);
 742                /* l %r5,<d(rxhash)>(%r2) */
 743                EMIT4_DISP(0x58502000, offsetof(struct sk_buff, rxhash));
 744                break;
 745        case BPF_S_ANC_VLAN_TAG:
 746        case BPF_S_ANC_VLAN_TAG_PRESENT:
 747                BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, vlan_tci) != 2);
 748                BUILD_BUG_ON(VLAN_TAG_PRESENT != 0x1000);
 749                /* lhi %r5,0 */
 750                EMIT4(0xa7580000);
 751                /* icm  %r5,3,<d(vlan_tci)>(%r2) */
 752                EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, vlan_tci));
 753                if (filter->code == BPF_S_ANC_VLAN_TAG) {
 754                        /* nill %r5,0xefff */
 755                        EMIT4_IMM(0xa5570000, ~VLAN_TAG_PRESENT);
 756                } else {
 757                        /* nill %r5,0x1000 */
 758                        EMIT4_IMM(0xa5570000, VLAN_TAG_PRESENT);
 759                        /* srl %r5,12 */
 760                        EMIT4_DISP(0x88500000, 12);
 761                }
 762                break;
 763        case BPF_S_ANC_PKTTYPE:
 764                if (pkt_type_offset < 0)
 765                        goto out;
 766                /* lhi %r5,0 */
 767                EMIT4(0xa7580000);
 768                /* ic %r5,<d(pkt_type_offset)>(%r2) */
 769                EMIT4_DISP(0x43502000, pkt_type_offset);
 770                /* srl %r5,5 */
 771                EMIT4_DISP(0x88500000, 5);
 772                break;
 773        case BPF_S_ANC_CPU: /* A = smp_processor_id() */
 774#ifdef CONFIG_SMP
 775                /* l %r5,<d(cpu_nr)> */
 776                EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr));
 777#else
 778                /* lhi %r5,0 */
 779                EMIT4(0xa7580000);
 780#endif
 781                break;
 782        default: /* too complex, give up */
 783                goto out;
 784        }
 785        addrs[i] = jit->prg - jit->start;
 786        return 0;
 787out:
 788        return -1;
 789}
 790
 791/*
 792 * Note: for security reasons, bpf code will follow a randomly
 793 *       sized amount of illegal instructions.
 794 */
 795struct bpf_binary_header {
 796        unsigned int pages;
 797        u8 image[];
 798};
 799
 800static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
 801                                                  u8 **image_ptr)
 802{
 803        struct bpf_binary_header *header;
 804        unsigned int sz, hole;
 805
 806        /* Most BPF filters are really small, but if some of them fill a page,
 807         * allow at least 128 extra bytes for illegal instructions.
 808         */
 809        sz = round_up(bpfsize + sizeof(*header) + 128, PAGE_SIZE);
 810        header = module_alloc(sz);
 811        if (!header)
 812                return NULL;
 813        memset(header, 0, sz);
 814        header->pages = sz / PAGE_SIZE;
 815        hole = sz - (bpfsize + sizeof(*header));
 816        /* Insert random number of illegal instructions before BPF code
 817         * and make sure the first instruction starts at an even address.
 818         */
 819        *image_ptr = &header->image[(prandom_u32() % hole) & -2];
 820        return header;
 821}
 822
 823void bpf_jit_compile(struct sk_filter *fp)
 824{
 825        struct bpf_binary_header *header = NULL;
 826        unsigned long size, prg_len, lit_len;
 827        struct bpf_jit jit, cjit;
 828        unsigned int *addrs;
 829        int pass, i;
 830
 831        if (!bpf_jit_enable)
 832                return;
 833        addrs = kcalloc(fp->len, sizeof(*addrs), GFP_KERNEL);
 834        if (addrs == NULL)
 835                return;
 836        memset(&jit, 0, sizeof(cjit));
 837        memset(&cjit, 0, sizeof(cjit));
 838
 839        for (pass = 0; pass < 10; pass++) {
 840                jit.prg = jit.start;
 841                jit.lit = jit.mid;
 842
 843                bpf_jit_prologue(&jit);
 844                bpf_jit_noleaks(&jit, fp->insns);
 845                for (i = 0; i < fp->len; i++) {
 846                        if (bpf_jit_insn(&jit, fp->insns + i, addrs, i,
 847                                         i == fp->len - 1))
 848                                goto out;
 849                }
 850                bpf_jit_epilogue(&jit);
 851                if (jit.start) {
 852                        WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit);
 853                        if (memcmp(&jit, &cjit, sizeof(jit)) == 0)
 854                                break;
 855                } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) {
 856                        prg_len = jit.prg - jit.start;
 857                        lit_len = jit.lit - jit.mid;
 858                        size = prg_len + lit_len;
 859                        if (size >= BPF_SIZE_MAX)
 860                                goto out;
 861                        header = bpf_alloc_binary(size, &jit.start);
 862                        if (!header)
 863                                goto out;
 864                        jit.prg = jit.mid = jit.start + prg_len;
 865                        jit.lit = jit.end = jit.start + prg_len + lit_len;
 866                        jit.base_ip += (unsigned long) jit.start;
 867                        jit.exit_ip += (unsigned long) jit.start;
 868                        jit.ret0_ip += (unsigned long) jit.start;
 869                }
 870                cjit = jit;
 871        }
 872        if (bpf_jit_enable > 1) {
 873                bpf_jit_dump(fp->len, jit.end - jit.start, pass, jit.start);
 874                if (jit.start)
 875                        print_fn_code(jit.start, jit.mid - jit.start);
 876        }
 877        if (jit.start) {
 878                set_memory_ro((unsigned long)header, header->pages);
 879                fp->bpf_func = (void *) jit.start;
 880        }
 881out:
 882        kfree(addrs);
 883}
 884
 885void bpf_jit_free(struct sk_filter *fp)
 886{
 887        unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
 888        struct bpf_binary_header *header = (void *)addr;
 889
 890        if (fp->bpf_func == sk_run_filter)
 891                goto free_filter;
 892        set_memory_rw(addr, header->pages);
 893        module_free(NULL, header);
 894free_filter:
 895        kfree(fp);
 896}
 897