Loading...
Note: File does not exist in v6.2.
1#include <linux/moduleloader.h>
2#include <linux/workqueue.h>
3#include <linux/netdevice.h>
4#include <linux/filter.h>
5#include <linux/cache.h>
6
7#include <asm/cacheflush.h>
8#include <asm/ptrace.h>
9
10#include "bpf_jit.h"
11
12int bpf_jit_enable __read_mostly;
13
14static inline bool is_simm13(unsigned int value)
15{
16 return value + 0x1000 < 0x2000;
17}
18
19static void bpf_flush_icache(void *start_, void *end_)
20{
21#ifdef CONFIG_SPARC64
22 /* Cheetah's I-cache is fully coherent. */
23 if (tlb_type == spitfire) {
24 unsigned long start = (unsigned long) start_;
25 unsigned long end = (unsigned long) end_;
26
27 start &= ~7UL;
28 end = (end + 7UL) & ~7UL;
29 while (start < end) {
30 flushi(start);
31 start += 32;
32 }
33 }
34#endif
35}
36
37#define SEEN_DATAREF 1 /* might call external helpers */
38#define SEEN_XREG 2 /* ebx is used */
39#define SEEN_MEM 4 /* use mem[] for temporary storage */
40
41#define S13(X) ((X) & 0x1fff)
42#define IMMED 0x00002000
43#define RD(X) ((X) << 25)
44#define RS1(X) ((X) << 14)
45#define RS2(X) ((X))
46#define OP(X) ((X) << 30)
47#define OP2(X) ((X) << 22)
48#define OP3(X) ((X) << 19)
49#define COND(X) ((X) << 25)
50#define F1(X) OP(X)
51#define F2(X, Y) (OP(X) | OP2(Y))
52#define F3(X, Y) (OP(X) | OP3(Y))
53
54#define CONDN COND(0x0)
55#define CONDE COND(0x1)
56#define CONDLE COND(0x2)
57#define CONDL COND(0x3)
58#define CONDLEU COND(0x4)
59#define CONDCS COND(0x5)
60#define CONDNEG COND(0x6)
61#define CONDVC COND(0x7)
62#define CONDA COND(0x8)
63#define CONDNE COND(0x9)
64#define CONDG COND(0xa)
65#define CONDGE COND(0xb)
66#define CONDGU COND(0xc)
67#define CONDCC COND(0xd)
68#define CONDPOS COND(0xe)
69#define CONDVS COND(0xf)
70
71#define CONDGEU CONDCC
72#define CONDLU CONDCS
73
74#define WDISP22(X) (((X) >> 2) & 0x3fffff)
75
76#define BA (F2(0, 2) | CONDA)
77#define BGU (F2(0, 2) | CONDGU)
78#define BLEU (F2(0, 2) | CONDLEU)
79#define BGEU (F2(0, 2) | CONDGEU)
80#define BLU (F2(0, 2) | CONDLU)
81#define BE (F2(0, 2) | CONDE)
82#define BNE (F2(0, 2) | CONDNE)
83
84#ifdef CONFIG_SPARC64
85#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20))
86#else
87#define BNE_PTR BNE
88#endif
89
90#define SETHI(K, REG) \
91 (F2(0, 0x4) | RD(REG) | (((K) >> 10) & 0x3fffff))
92#define OR_LO(K, REG) \
93 (F3(2, 0x02) | IMMED | RS1(REG) | ((K) & 0x3ff) | RD(REG))
94
95#define ADD F3(2, 0x00)
96#define AND F3(2, 0x01)
97#define ANDCC F3(2, 0x11)
98#define OR F3(2, 0x02)
99#define SUB F3(2, 0x04)
100#define SUBCC F3(2, 0x14)
101#define MUL F3(2, 0x0a) /* umul */
102#define DIV F3(2, 0x0e) /* udiv */
103#define SLL F3(2, 0x25)
104#define SRL F3(2, 0x26)
105#define JMPL F3(2, 0x38)
106#define CALL F1(1)
107#define BR F2(0, 0x01)
108#define RD_Y F3(2, 0x28)
109#define WR_Y F3(2, 0x30)
110
111#define LD32 F3(3, 0x00)
112#define LD8 F3(3, 0x01)
113#define LD16 F3(3, 0x02)
114#define LD64 F3(3, 0x0b)
115#define ST32 F3(3, 0x04)
116
117#ifdef CONFIG_SPARC64
118#define LDPTR LD64
119#define BASE_STACKFRAME 176
120#else
121#define LDPTR LD32
122#define BASE_STACKFRAME 96
123#endif
124
125#define LD32I (LD32 | IMMED)
126#define LD8I (LD8 | IMMED)
127#define LD16I (LD16 | IMMED)
128#define LD64I (LD64 | IMMED)
129#define LDPTRI (LDPTR | IMMED)
130#define ST32I (ST32 | IMMED)
131
132#define emit_nop() \
133do { \
134 *prog++ = SETHI(0, G0); \
135} while (0)
136
137#define emit_neg() \
138do { /* sub %g0, r_A, r_A */ \
139 *prog++ = SUB | RS1(G0) | RS2(r_A) | RD(r_A); \
140} while (0)
141
142#define emit_reg_move(FROM, TO) \
143do { /* or %g0, FROM, TO */ \
144 *prog++ = OR | RS1(G0) | RS2(FROM) | RD(TO); \
145} while (0)
146
147#define emit_clear(REG) \
148do { /* or %g0, %g0, REG */ \
149 *prog++ = OR | RS1(G0) | RS2(G0) | RD(REG); \
150} while (0)
151
152#define emit_set_const(K, REG) \
153do { /* sethi %hi(K), REG */ \
154 *prog++ = SETHI(K, REG); \
155 /* or REG, %lo(K), REG */ \
156 *prog++ = OR_LO(K, REG); \
157} while (0)
158
159 /* Emit
160 *
161 * OP r_A, r_X, r_A
162 */
163#define emit_alu_X(OPCODE) \
164do { \
165 seen |= SEEN_XREG; \
166 *prog++ = OPCODE | RS1(r_A) | RS2(r_X) | RD(r_A); \
167} while (0)
168
169 /* Emit either:
170 *
171 * OP r_A, K, r_A
172 *
173 * or
174 *
175 * sethi %hi(K), r_TMP
176 * or r_TMP, %lo(K), r_TMP
177 * OP r_A, r_TMP, r_A
178 *
179 * depending upon whether K fits in a signed 13-bit
180 * immediate instruction field. Emit nothing if K
181 * is zero.
182 */
183#define emit_alu_K(OPCODE, K) \
184do { \
185 if (K) { \
186 unsigned int _insn = OPCODE; \
187 _insn |= RS1(r_A) | RD(r_A); \
188 if (is_simm13(K)) { \
189 *prog++ = _insn | IMMED | S13(K); \
190 } else { \
191 emit_set_const(K, r_TMP); \
192 *prog++ = _insn | RS2(r_TMP); \
193 } \
194 } \
195} while (0)
196
197#define emit_loadimm(K, DEST) \
198do { \
199 if (is_simm13(K)) { \
200 /* or %g0, K, DEST */ \
201 *prog++ = OR | IMMED | RS1(G0) | S13(K) | RD(DEST); \
202 } else { \
203 emit_set_const(K, DEST); \
204 } \
205} while (0)
206
207#define emit_loadptr(BASE, STRUCT, FIELD, DEST) \
208do { unsigned int _off = offsetof(STRUCT, FIELD); \
209 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(void *)); \
210 *prog++ = LDPTRI | RS1(BASE) | S13(_off) | RD(DEST); \
211} while (0)
212
213#define emit_load32(BASE, STRUCT, FIELD, DEST) \
214do { unsigned int _off = offsetof(STRUCT, FIELD); \
215 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u32)); \
216 *prog++ = LD32I | RS1(BASE) | S13(_off) | RD(DEST); \
217} while (0)
218
219#define emit_load16(BASE, STRUCT, FIELD, DEST) \
220do { unsigned int _off = offsetof(STRUCT, FIELD); \
221 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u16)); \
222 *prog++ = LD16I | RS1(BASE) | S13(_off) | RD(DEST); \
223} while (0)
224
225#define __emit_load8(BASE, STRUCT, FIELD, DEST) \
226do { unsigned int _off = offsetof(STRUCT, FIELD); \
227 *prog++ = LD8I | RS1(BASE) | S13(_off) | RD(DEST); \
228} while (0)
229
230#define emit_load8(BASE, STRUCT, FIELD, DEST) \
231do { BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u8)); \
232 __emit_load8(BASE, STRUCT, FIELD, DEST); \
233} while (0)
234
235#define emit_ldmem(OFF, DEST) \
236do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(DEST); \
237} while (0)
238
239#define emit_stmem(OFF, SRC) \
240do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(SRC); \
241} while (0)
242
243#ifdef CONFIG_SMP
244#ifdef CONFIG_SPARC64
245#define emit_load_cpu(REG) \
246 emit_load16(G6, struct thread_info, cpu, REG)
247#else
248#define emit_load_cpu(REG) \
249 emit_load32(G6, struct thread_info, cpu, REG)
250#endif
251#else
252#define emit_load_cpu(REG) emit_clear(REG)
253#endif
254
255#define emit_skb_loadptr(FIELD, DEST) \
256 emit_loadptr(r_SKB, struct sk_buff, FIELD, DEST)
257#define emit_skb_load32(FIELD, DEST) \
258 emit_load32(r_SKB, struct sk_buff, FIELD, DEST)
259#define emit_skb_load16(FIELD, DEST) \
260 emit_load16(r_SKB, struct sk_buff, FIELD, DEST)
261#define __emit_skb_load8(FIELD, DEST) \
262 __emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
263#define emit_skb_load8(FIELD, DEST) \
264 emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
265
266#define emit_jmpl(BASE, IMM_OFF, LREG) \
267 *prog++ = (JMPL | IMMED | RS1(BASE) | S13(IMM_OFF) | RD(LREG))
268
269#define emit_call(FUNC) \
270do { void *_here = image + addrs[i] - 8; \
271 unsigned int _off = (void *)(FUNC) - _here; \
272 *prog++ = CALL | (((_off) >> 2) & 0x3fffffff); \
273 emit_nop(); \
274} while (0)
275
276#define emit_branch(BR_OPC, DEST) \
277do { unsigned int _here = addrs[i] - 8; \
278 *prog++ = BR_OPC | WDISP22((DEST) - _here); \
279} while (0)
280
281#define emit_branch_off(BR_OPC, OFF) \
282do { *prog++ = BR_OPC | WDISP22(OFF); \
283} while (0)
284
285#define emit_jump(DEST) emit_branch(BA, DEST)
286
287#define emit_read_y(REG) *prog++ = RD_Y | RD(REG)
288#define emit_write_y(REG) *prog++ = WR_Y | IMMED | RS1(REG) | S13(0)
289
290#define emit_cmp(R1, R2) \
291 *prog++ = (SUBCC | RS1(R1) | RS2(R2) | RD(G0))
292
293#define emit_cmpi(R1, IMM) \
294 *prog++ = (SUBCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
295
296#define emit_btst(R1, R2) \
297 *prog++ = (ANDCC | RS1(R1) | RS2(R2) | RD(G0))
298
299#define emit_btsti(R1, IMM) \
300 *prog++ = (ANDCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
301
302#define emit_sub(R1, R2, R3) \
303 *prog++ = (SUB | RS1(R1) | RS2(R2) | RD(R3))
304
305#define emit_subi(R1, IMM, R3) \
306 *prog++ = (SUB | IMMED | RS1(R1) | S13(IMM) | RD(R3))
307
308#define emit_add(R1, R2, R3) \
309 *prog++ = (ADD | RS1(R1) | RS2(R2) | RD(R3))
310
311#define emit_addi(R1, IMM, R3) \
312 *prog++ = (ADD | IMMED | RS1(R1) | S13(IMM) | RD(R3))
313
314#define emit_alloc_stack(SZ) \
315 *prog++ = (SUB | IMMED | RS1(SP) | S13(SZ) | RD(SP))
316
317#define emit_release_stack(SZ) \
318 *prog++ = (ADD | IMMED | RS1(SP) | S13(SZ) | RD(SP))
319
320/* A note about branch offset calculations. The addrs[] array,
321 * indexed by BPF instruction, records the address after all the
322 * sparc instructions emitted for that BPF instruction.
323 *
324 * The most common case is to emit a branch at the end of such
325 * a code sequence. So this would be two instructions, the
326 * branch and it's delay slot.
327 *
328 * Therefore by default the branch emitters calculate the branch
329 * offset field as:
330 *
331 * destination - (addrs[i] - 8)
332 *
333 * This "addrs[i] - 8" is the address of the branch itself or
334 * what "." would be in assembler notation. The "8" part is
335 * how we take into consideration the branch and it's delay
336 * slot mentioned above.
337 *
338 * Sometimes we need to emit a branch earlier in the code
339 * sequence. And in these situations we adjust "destination"
340 * to accomodate this difference. For example, if we needed
341 * to emit a branch (and it's delay slot) right before the
342 * final instruction emitted for a BPF opcode, we'd use
343 * "destination + 4" instead of just plain "destination" above.
344 *
345 * This is why you see all of these funny emit_branch() and
346 * emit_jump() calls with adjusted offsets.
347 */
348
349void bpf_jit_compile(struct sk_filter *fp)
350{
351 unsigned int cleanup_addr, proglen, oldproglen = 0;
352 u32 temp[8], *prog, *func, seen = 0, pass;
353 const struct sock_filter *filter = fp->insns;
354 int i, flen = fp->len, pc_ret0 = -1;
355 unsigned int *addrs;
356 void *image;
357
358 if (!bpf_jit_enable)
359 return;
360
361 addrs = kmalloc(flen * sizeof(*addrs), GFP_KERNEL);
362 if (addrs == NULL)
363 return;
364
365 /* Before first pass, make a rough estimation of addrs[]
366 * each bpf instruction is translated to less than 64 bytes
367 */
368 for (proglen = 0, i = 0; i < flen; i++) {
369 proglen += 64;
370 addrs[i] = proglen;
371 }
372 cleanup_addr = proglen; /* epilogue address */
373 image = NULL;
374 for (pass = 0; pass < 10; pass++) {
375 u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
376
377 /* no prologue/epilogue for trivial filters (RET something) */
378 proglen = 0;
379 prog = temp;
380
381 /* Prologue */
382 if (seen_or_pass0) {
383 if (seen_or_pass0 & SEEN_MEM) {
384 unsigned int sz = BASE_STACKFRAME;
385 sz += BPF_MEMWORDS * sizeof(u32);
386 emit_alloc_stack(sz);
387 }
388
389 /* Make sure we dont leek kernel memory. */
390 if (seen_or_pass0 & SEEN_XREG)
391 emit_clear(r_X);
392
393 /* If this filter needs to access skb data,
394 * load %o4 and %o5 with:
395 * %o4 = skb->len - skb->data_len
396 * %o5 = skb->data
397 * And also back up %o7 into r_saved_O7 so we can
398 * invoke the stubs using 'call'.
399 */
400 if (seen_or_pass0 & SEEN_DATAREF) {
401 emit_load32(r_SKB, struct sk_buff, len, r_HEADLEN);
402 emit_load32(r_SKB, struct sk_buff, data_len, r_TMP);
403 emit_sub(r_HEADLEN, r_TMP, r_HEADLEN);
404 emit_loadptr(r_SKB, struct sk_buff, data, r_SKB_DATA);
405 }
406 }
407 emit_reg_move(O7, r_saved_O7);
408
409 switch (filter[0].code) {
410 case BPF_S_RET_K:
411 case BPF_S_LD_W_LEN:
412 case BPF_S_ANC_PROTOCOL:
413 case BPF_S_ANC_PKTTYPE:
414 case BPF_S_ANC_IFINDEX:
415 case BPF_S_ANC_MARK:
416 case BPF_S_ANC_RXHASH:
417 case BPF_S_ANC_CPU:
418 case BPF_S_ANC_QUEUE:
419 case BPF_S_LD_W_ABS:
420 case BPF_S_LD_H_ABS:
421 case BPF_S_LD_B_ABS:
422 /* The first instruction sets the A register (or is
423 * a "RET 'constant'")
424 */
425 break;
426 default:
427 /* Make sure we dont leak kernel information to the
428 * user.
429 */
430 emit_clear(r_A); /* A = 0 */
431 }
432
433 for (i = 0; i < flen; i++) {
434 unsigned int K = filter[i].k;
435 unsigned int t_offset;
436 unsigned int f_offset;
437 u32 t_op, f_op;
438 int ilen;
439
440 switch (filter[i].code) {
441 case BPF_S_ALU_ADD_X: /* A += X; */
442 emit_alu_X(ADD);
443 break;
444 case BPF_S_ALU_ADD_K: /* A += K; */
445 emit_alu_K(ADD, K);
446 break;
447 case BPF_S_ALU_SUB_X: /* A -= X; */
448 emit_alu_X(SUB);
449 break;
450 case BPF_S_ALU_SUB_K: /* A -= K */
451 emit_alu_K(SUB, K);
452 break;
453 case BPF_S_ALU_AND_X: /* A &= X */
454 emit_alu_X(AND);
455 break;
456 case BPF_S_ALU_AND_K: /* A &= K */
457 emit_alu_K(AND, K);
458 break;
459 case BPF_S_ALU_OR_X: /* A |= X */
460 emit_alu_X(OR);
461 break;
462 case BPF_S_ALU_OR_K: /* A |= K */
463 emit_alu_K(OR, K);
464 break;
465 case BPF_S_ALU_LSH_X: /* A <<= X */
466 emit_alu_X(SLL);
467 break;
468 case BPF_S_ALU_LSH_K: /* A <<= K */
469 emit_alu_K(SLL, K);
470 break;
471 case BPF_S_ALU_RSH_X: /* A >>= X */
472 emit_alu_X(SRL);
473 break;
474 case BPF_S_ALU_RSH_K: /* A >>= K */
475 emit_alu_K(SRL, K);
476 break;
477 case BPF_S_ALU_MUL_X: /* A *= X; */
478 emit_alu_X(MUL);
479 break;
480 case BPF_S_ALU_MUL_K: /* A *= K */
481 emit_alu_K(MUL, K);
482 break;
483 case BPF_S_ALU_DIV_K: /* A /= K */
484 emit_alu_K(MUL, K);
485 emit_read_y(r_A);
486 break;
487 case BPF_S_ALU_DIV_X: /* A /= X; */
488 emit_cmpi(r_X, 0);
489 if (pc_ret0 > 0) {
490 t_offset = addrs[pc_ret0 - 1];
491#ifdef CONFIG_SPARC32
492 emit_branch(BE, t_offset + 20);
493#else
494 emit_branch(BE, t_offset + 8);
495#endif
496 emit_nop(); /* delay slot */
497 } else {
498 emit_branch_off(BNE, 16);
499 emit_nop();
500#ifdef CONFIG_SPARC32
501 emit_jump(cleanup_addr + 20);
502#else
503 emit_jump(cleanup_addr + 8);
504#endif
505 emit_clear(r_A);
506 }
507 emit_write_y(G0);
508#ifdef CONFIG_SPARC32
509 /* The Sparc v8 architecture requires
510 * three instructions between a %y
511 * register write and the first use.
512 */
513 emit_nop();
514 emit_nop();
515 emit_nop();
516#endif
517 emit_alu_X(DIV);
518 break;
519 case BPF_S_ALU_NEG:
520 emit_neg();
521 break;
522 case BPF_S_RET_K:
523 if (!K) {
524 if (pc_ret0 == -1)
525 pc_ret0 = i;
526 emit_clear(r_A);
527 } else {
528 emit_loadimm(K, r_A);
529 }
530 /* Fallthrough */
531 case BPF_S_RET_A:
532 if (seen_or_pass0) {
533 if (i != flen - 1) {
534 emit_jump(cleanup_addr);
535 emit_nop();
536 break;
537 }
538 if (seen_or_pass0 & SEEN_MEM) {
539 unsigned int sz = BASE_STACKFRAME;
540 sz += BPF_MEMWORDS * sizeof(u32);
541 emit_release_stack(sz);
542 }
543 }
544 /* jmpl %r_saved_O7 + 8, %g0 */
545 emit_jmpl(r_saved_O7, 8, G0);
546 emit_reg_move(r_A, O0); /* delay slot */
547 break;
548 case BPF_S_MISC_TAX:
549 seen |= SEEN_XREG;
550 emit_reg_move(r_A, r_X);
551 break;
552 case BPF_S_MISC_TXA:
553 seen |= SEEN_XREG;
554 emit_reg_move(r_X, r_A);
555 break;
556 case BPF_S_ANC_CPU:
557 emit_load_cpu(r_A);
558 break;
559 case BPF_S_ANC_PROTOCOL:
560 emit_skb_load16(protocol, r_A);
561 break;
562#if 0
563 /* GCC won't let us take the address of
564 * a bit field even though we very much
565 * know what we are doing here.
566 */
567 case BPF_S_ANC_PKTTYPE:
568 __emit_skb_load8(pkt_type, r_A);
569 emit_alu_K(SRL, 5);
570 break;
571#endif
572 case BPF_S_ANC_IFINDEX:
573 emit_skb_loadptr(dev, r_A);
574 emit_cmpi(r_A, 0);
575 emit_branch(BNE_PTR, cleanup_addr + 4);
576 emit_nop();
577 emit_load32(r_A, struct net_device, ifindex, r_A);
578 break;
579 case BPF_S_ANC_MARK:
580 emit_skb_load32(mark, r_A);
581 break;
582 case BPF_S_ANC_QUEUE:
583 emit_skb_load16(queue_mapping, r_A);
584 break;
585 case BPF_S_ANC_HATYPE:
586 emit_skb_loadptr(dev, r_A);
587 emit_cmpi(r_A, 0);
588 emit_branch(BNE_PTR, cleanup_addr + 4);
589 emit_nop();
590 emit_load16(r_A, struct net_device, type, r_A);
591 break;
592 case BPF_S_ANC_RXHASH:
593 emit_skb_load32(rxhash, r_A);
594 break;
595
596 case BPF_S_LD_IMM:
597 emit_loadimm(K, r_A);
598 break;
599 case BPF_S_LDX_IMM:
600 emit_loadimm(K, r_X);
601 break;
602 case BPF_S_LD_MEM:
603 emit_ldmem(K * 4, r_A);
604 break;
605 case BPF_S_LDX_MEM:
606 emit_ldmem(K * 4, r_X);
607 break;
608 case BPF_S_ST:
609 emit_stmem(K * 4, r_A);
610 break;
611 case BPF_S_STX:
612 emit_stmem(K * 4, r_X);
613 break;
614
615#define CHOOSE_LOAD_FUNC(K, func) \
616 ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
617
618 case BPF_S_LD_W_ABS:
619 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_word);
620common_load: seen |= SEEN_DATAREF;
621 emit_loadimm(K, r_OFF);
622 emit_call(func);
623 break;
624 case BPF_S_LD_H_ABS:
625 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_half);
626 goto common_load;
627 case BPF_S_LD_B_ABS:
628 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte);
629 goto common_load;
630 case BPF_S_LDX_B_MSH:
631 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte_msh);
632 goto common_load;
633 case BPF_S_LD_W_IND:
634 func = bpf_jit_load_word;
635common_load_ind: seen |= SEEN_DATAREF | SEEN_XREG;
636 if (K) {
637 if (is_simm13(K)) {
638 emit_addi(r_X, K, r_OFF);
639 } else {
640 emit_loadimm(K, r_TMP);
641 emit_add(r_X, r_TMP, r_OFF);
642 }
643 } else {
644 emit_reg_move(r_X, r_OFF);
645 }
646 emit_call(func);
647 break;
648 case BPF_S_LD_H_IND:
649 func = bpf_jit_load_half;
650 goto common_load_ind;
651 case BPF_S_LD_B_IND:
652 func = bpf_jit_load_byte;
653 goto common_load_ind;
654 case BPF_S_JMP_JA:
655 emit_jump(addrs[i + K]);
656 emit_nop();
657 break;
658
659#define COND_SEL(CODE, TOP, FOP) \
660 case CODE: \
661 t_op = TOP; \
662 f_op = FOP; \
663 goto cond_branch
664
665 COND_SEL(BPF_S_JMP_JGT_K, BGU, BLEU);
666 COND_SEL(BPF_S_JMP_JGE_K, BGEU, BLU);
667 COND_SEL(BPF_S_JMP_JEQ_K, BE, BNE);
668 COND_SEL(BPF_S_JMP_JSET_K, BNE, BE);
669 COND_SEL(BPF_S_JMP_JGT_X, BGU, BLEU);
670 COND_SEL(BPF_S_JMP_JGE_X, BGEU, BLU);
671 COND_SEL(BPF_S_JMP_JEQ_X, BE, BNE);
672 COND_SEL(BPF_S_JMP_JSET_X, BNE, BE);
673
674cond_branch: f_offset = addrs[i + filter[i].jf];
675 t_offset = addrs[i + filter[i].jt];
676
677 /* same targets, can avoid doing the test :) */
678 if (filter[i].jt == filter[i].jf) {
679 emit_jump(t_offset);
680 emit_nop();
681 break;
682 }
683
684 switch (filter[i].code) {
685 case BPF_S_JMP_JGT_X:
686 case BPF_S_JMP_JGE_X:
687 case BPF_S_JMP_JEQ_X:
688 seen |= SEEN_XREG;
689 emit_cmp(r_A, r_X);
690 break;
691 case BPF_S_JMP_JSET_X:
692 seen |= SEEN_XREG;
693 emit_btst(r_A, r_X);
694 break;
695 case BPF_S_JMP_JEQ_K:
696 case BPF_S_JMP_JGT_K:
697 case BPF_S_JMP_JGE_K:
698 if (is_simm13(K)) {
699 emit_cmpi(r_A, K);
700 } else {
701 emit_loadimm(K, r_TMP);
702 emit_cmp(r_A, r_TMP);
703 }
704 break;
705 case BPF_S_JMP_JSET_K:
706 if (is_simm13(K)) {
707 emit_btsti(r_A, K);
708 } else {
709 emit_loadimm(K, r_TMP);
710 emit_btst(r_A, r_TMP);
711 }
712 break;
713 }
714 if (filter[i].jt != 0) {
715 if (filter[i].jf)
716 t_offset += 8;
717 emit_branch(t_op, t_offset);
718 emit_nop(); /* delay slot */
719 if (filter[i].jf) {
720 emit_jump(f_offset);
721 emit_nop();
722 }
723 break;
724 }
725 emit_branch(f_op, f_offset);
726 emit_nop(); /* delay slot */
727 break;
728
729 default:
730 /* hmm, too complex filter, give up with jit compiler */
731 goto out;
732 }
733 ilen = (void *) prog - (void *) temp;
734 if (image) {
735 if (unlikely(proglen + ilen > oldproglen)) {
736 pr_err("bpb_jit_compile fatal error\n");
737 kfree(addrs);
738 module_free(NULL, image);
739 return;
740 }
741 memcpy(image + proglen, temp, ilen);
742 }
743 proglen += ilen;
744 addrs[i] = proglen;
745 prog = temp;
746 }
747 /* last bpf instruction is always a RET :
748 * use it to give the cleanup instruction(s) addr
749 */
750 cleanup_addr = proglen - 8; /* jmpl; mov r_A,%o0; */
751 if (seen_or_pass0 & SEEN_MEM)
752 cleanup_addr -= 4; /* add %sp, X, %sp; */
753
754 if (image) {
755 if (proglen != oldproglen)
756 pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n",
757 proglen, oldproglen);
758 break;
759 }
760 if (proglen == oldproglen) {
761 image = module_alloc(max_t(unsigned int,
762 proglen,
763 sizeof(struct work_struct)));
764 if (!image)
765 goto out;
766 }
767 oldproglen = proglen;
768 }
769
770 if (bpf_jit_enable > 1)
771 pr_err("flen=%d proglen=%u pass=%d image=%p\n",
772 flen, proglen, pass, image);
773
774 if (image) {
775 if (bpf_jit_enable > 1)
776 print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_ADDRESS,
777 16, 1, image, proglen, false);
778 bpf_flush_icache(image, image + proglen);
779 fp->bpf_func = (void *)image;
780 }
781out:
782 kfree(addrs);
783 return;
784}
785
786static void jit_free_defer(struct work_struct *arg)
787{
788 module_free(NULL, arg);
789}
790
791/* run from softirq, we must use a work_struct to call
792 * module_free() from process context
793 */
794void bpf_jit_free(struct sk_filter *fp)
795{
796 if (fp->bpf_func != sk_run_filter) {
797 struct work_struct *work = (struct work_struct *)fp->bpf_func;
798
799 INIT_WORK(work, jit_free_defer);
800 schedule_work(work);
801 }
802}