arch/s390/net/bpf_jit_comp.c

   1 /*
   2  * BPF Jit compiler for s390.
   3  *
   4  * Copyright IBM Corp. 2012
   5  *
   6  * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
   7  */
   8 #include <linux/moduleloader.h>
   9 #include <linux/netdevice.h>
  10 #include <linux/if_vlan.h>
  11 #include <linux/filter.h>
  12 #include <linux/random.h>
  13 #include <linux/init.h>
  14 #include <asm/cacheflush.h>
  15 #include <asm/facility.h>
  16 #include <asm/dis.h>
  17
  18 /*
  19  * Conventions:
  20  *   %r2 = skb pointer
  21  *   %r3 = offset parameter
  22  *   %r4 = scratch register / length parameter
  23  *   %r5 = BPF A accumulator
  24  *   %r8 = return address
  25  *   %r9 = save register for skb pointer
  26  *   %r10 = skb->data
  27  *   %r11 = skb->len - skb->data_len (headlen)
  28  *   %r12 = BPF X accumulator
  29  *   %r13 = literal pool pointer
  30  *   0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS
  31  */
  32 int bpf_jit_enable __read_mostly;
  33
  34 /*
  35  * assembly code in arch/x86/net/bpf_jit.S
  36  */
  37 extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
  38 extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[];
  39
  40 struct bpf_jit {
  41         unsigned int seen;
  42         u8 *start;
  43         u8 *prg;
  44         u8 *mid;
  45         u8 *lit;
  46         u8 *end;
  47         u8 *base_ip;
  48         u8 *ret0_ip;
  49         u8 *exit_ip;
  50         unsigned int off_load_word;
  51         unsigned int off_load_half;
  52         unsigned int off_load_byte;
  53         unsigned int off_load_bmsh;
  54         unsigned int off_load_iword;
  55         unsigned int off_load_ihalf;
  56         unsigned int off_load_ibyte;
  57 };
  58
  59 #define BPF_SIZE_MAX    4096    /* Max size for program */
  60
  61 #define SEEN_DATAREF    1       /* might call external helpers */
  62 #define SEEN_XREG       2       /* ebx is used */
  63 #define SEEN_MEM        4       /* use mem[] for temporary storage */
  64 #define SEEN_RET0       8       /* pc_ret0 points to a valid return 0 */
  65 #define SEEN_LITERAL    16      /* code uses literals */
  66 #define SEEN_LOAD_WORD  32      /* code uses sk_load_word */
  67 #define SEEN_LOAD_HALF  64      /* code uses sk_load_half */
  68 #define SEEN_LOAD_BYTE  128     /* code uses sk_load_byte */
  69 #define SEEN_LOAD_BMSH  256     /* code uses sk_load_byte_msh */
  70 #define SEEN_LOAD_IWORD 512     /* code uses sk_load_word_ind */
  71 #define SEEN_LOAD_IHALF 1024    /* code uses sk_load_half_ind */
  72 #define SEEN_LOAD_IBYTE 2048    /* code uses sk_load_byte_ind */
  73
  74 #define EMIT2(op)                                       \
  75 ({                                                      \
  76         if (jit->prg + 2 <= jit->mid)                   \
  77                 *(u16 *) jit->prg = op;                 \
  78         jit->prg += 2;                                  \
  79 })
  80
  81 #define EMIT4(op)                                       \
  82 ({                                                      \
  83         if (jit->prg + 4 <= jit->mid)                   \
  84                 *(u32 *) jit->prg = op;                 \
  85         jit->prg += 4;                                  \
  86 })
  87
  88 #define EMIT4_DISP(op, disp)                            \
  89 ({                                                      \
  90         unsigned int __disp = (disp) & 0xfff;           \
  91         EMIT4(op | __disp);                             \
  92 })
  93
  94 #define EMIT4_IMM(op, imm)                              \
  95 ({                                                      \
  96         unsigned int __imm = (imm) & 0xffff;            \
  97         EMIT4(op | __imm);                              \
  98 })
  99
 100 #define EMIT4_PCREL(op, pcrel)                          \
 101 ({                                                      \
 102         long __pcrel = ((pcrel) >> 1) & 0xffff;         \
 103         EMIT4(op | __pcrel);                            \
 104 })
 105
 106 #define EMIT6(op1, op2)                                 \
 107 ({                                                      \
 108         if (jit->prg + 6 <= jit->mid) {                 \
 109                 *(u32 *) jit->prg = op1;                \
 110                 *(u16 *) (jit->prg + 4) = op2;          \
 111         }                                               \
 112         jit->prg += 6;                                  \
 113 })
 114
 115 #define EMIT6_DISP(op1, op2, disp)                      \
 116 ({                                                      \
 117         unsigned int __disp = (disp) & 0xfff;           \
 118         EMIT6(op1 | __disp, op2);                       \
 119 })
 120
 121 #define EMIT6_IMM(op, imm)                              \
 122 ({                                                      \
 123         unsigned int __imm = (imm);                     \
 124         EMIT6(op | (__imm >> 16), __imm & 0xffff);      \
 125 })
 126
 127 #define EMIT_CONST(val)                                 \
 128 ({                                                      \
 129         unsigned int ret;                               \
 130         ret = (unsigned int) (jit->lit - jit->base_ip); \
 131         jit->seen |= SEEN_LITERAL;                      \
 132         if (jit->lit + 4 <= jit->end)                   \
 133                 *(u32 *) jit->lit = val;                \
 134         jit->lit += 4;                                  \
 135         ret;                                            \
 136 })
 137
 138 #define EMIT_FN_CONST(bit, fn)                          \
 139 ({                                                      \
 140         unsigned int ret;                               \
 141         ret = (unsigned int) (jit->lit - jit->base_ip); \
 142         if (jit->seen & bit) {                          \
 143                 jit->seen |= SEEN_LITERAL;              \
 144                 if (jit->lit + 8 <= jit->end)           \
 145                         *(void **) jit->lit = fn;       \
 146                 jit->lit += 8;                          \
 147         }                                               \
 148         ret;                                            \
 149 })
 150
 151 static void bpf_jit_prologue(struct bpf_jit *jit)
 152 {
 153         /* Save registers and create stack frame if necessary */
 154         if (jit->seen & SEEN_DATAREF) {
 155                 /* stmg %r8,%r15,88(%r15) */
 156                 EMIT6(0xeb8ff058, 0x0024);
 157                 /* lgr %r14,%r15 */
 158                 EMIT4(0xb90400ef);
 159                 /* aghi %r15,<offset> */
 160                 EMIT4_IMM(0xa7fb0000, (jit->seen & SEEN_MEM) ? -112 : -80);
 161                 /* stg %r14,152(%r15) */
 162                 EMIT6(0xe3e0f098, 0x0024);
 163         } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
 164                 /* stmg %r12,%r13,120(%r15) */
 165                 EMIT6(0xebcdf078, 0x0024);
 166         else if (jit->seen & SEEN_XREG)
 167                 /* stg %r12,120(%r15) */
 168                 EMIT6(0xe3c0f078, 0x0024);
 169         else if (jit->seen & SEEN_LITERAL)
 170                 /* stg %r13,128(%r15) */
 171                 EMIT6(0xe3d0f080, 0x0024);
 172
 173         /* Setup literal pool */
 174         if (jit->seen & SEEN_LITERAL) {
 175                 /* basr %r13,0 */
 176                 EMIT2(0x0dd0);
 177                 jit->base_ip = jit->prg;
 178         }
 179         jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word);
 180         jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half);
 181         jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte);
 182         jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh);
 183         jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind);
 184         jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind);
 185         jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind);
 186
 187         /* Filter needs to access skb data */
 188         if (jit->seen & SEEN_DATAREF) {
 189                 /* l %r11,<len>(%r2) */
 190                 EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len));
 191                 /* s %r11,<data_len>(%r2) */
 192                 EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len));
 193                 /* lg %r10,<data>(%r2) */
 194                 EMIT6_DISP(0xe3a02000, 0x0004,
 195                            offsetof(struct sk_buff, data));
 196         }
 197 }
 198
 199 static void bpf_jit_epilogue(struct bpf_jit *jit)
 200 {
 201         /* Return 0 */
 202         if (jit->seen & SEEN_RET0) {
 203                 jit->ret0_ip = jit->prg;
 204                 /* lghi %r2,0 */
 205                 EMIT4(0xa7290000);
 206         }
 207         jit->exit_ip = jit->prg;
 208         /* Restore registers */
 209         if (jit->seen & SEEN_DATAREF)
 210                 /* lmg %r8,%r15,<offset>(%r15) */
 211                 EMIT6_DISP(0xeb8ff000, 0x0004,
 212                            (jit->seen & SEEN_MEM) ? 200 : 168);
 213         else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL))
 214                 /* lmg %r12,%r13,120(%r15) */
 215                 EMIT6(0xebcdf078, 0x0004);
 216         else if (jit->seen & SEEN_XREG)
 217                 /* lg %r12,120(%r15) */
 218                 EMIT6(0xe3c0f078, 0x0004);
 219         else if (jit->seen & SEEN_LITERAL)
 220                 /* lg %r13,128(%r15) */
 221                 EMIT6(0xe3d0f080, 0x0004);
 222         /* br %r14 */
 223         EMIT2(0x07fe);
 224 }
 225
 226 /* Helper to find the offset of pkt_type in sk_buff
 227  * Make sure its still a 3bit field starting at the MSBs within a byte.
 228  */
 229 #define PKT_TYPE_MAX 0xe0
 230 static int pkt_type_offset;
 231
 232 static int __init bpf_pkt_type_offset_init(void)
 233 {
 234         struct sk_buff skb_probe = {
 235                 .pkt_type = ~0,
 236         };
 237         char *ct = (char *)&skb_probe;
 238         int off;
 239
 240         pkt_type_offset = -1;
 241         for (off = 0; off < sizeof(struct sk_buff); off++) {
 242                 if (!ct[off])
 243                         continue;
 244                 if (ct[off] == PKT_TYPE_MAX)
 245                         pkt_type_offset = off;
 246                 else {
 247                         /* Found non matching bit pattern, fix needed. */
 248                         WARN_ON_ONCE(1);
 249                         pkt_type_offset = -1;
 250                         return -1;
 251                 }
 252         }
 253         return 0;
 254 }
 255 device_initcall(bpf_pkt_type_offset_init);
 256
 257 /*
 258  * make sure we dont leak kernel information to user
 259  */
 260 static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter)
 261 {
 262         /* Clear temporary memory if (seen & SEEN_MEM) */
 263         if (jit->seen & SEEN_MEM)
 264                 /* xc 0(64,%r15),0(%r15) */
 265                 EMIT6(0xd73ff000, 0xf000);
 266         /* Clear X if (seen & SEEN_XREG) */
 267         if (jit->seen & SEEN_XREG)
 268                 /* lhi %r12,0 */
 269                 EMIT4(0xa7c80000);
 270         /* Clear A if the first register does not set it. */
 271         switch (filter[0].code) {
 272         case BPF_LD | BPF_W | BPF_ABS:
 273         case BPF_LD | BPF_H | BPF_ABS:
 274         case BPF_LD | BPF_B | BPF_ABS:
 275         case BPF_LD | BPF_W | BPF_LEN:
 276         case BPF_LD | BPF_W | BPF_IND:
 277         case BPF_LD | BPF_H | BPF_IND:
 278         case BPF_LD | BPF_B | BPF_IND:
 279         case BPF_LD | BPF_IMM:
 280         case BPF_LD | BPF_MEM:
 281         case BPF_MISC | BPF_TXA:
 282         case BPF_RET | BPF_K:
 283                 /* first instruction sets A register */
 284                 break;
 285         default: /* A = 0 */
 286                 /* lhi %r5,0 */
 287                 EMIT4(0xa7580000);
 288         }
 289 }
 290
 291 static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
 292                         unsigned int *addrs, int i, int last)
 293 {
 294         unsigned int K;
 295         int offset;
 296         unsigned int mask;
 297         u16 code;
 298
 299         K = filter->k;
 300         code = bpf_anc_helper(filter);
 301
 302         switch (code) {
 303         case BPF_ALU | BPF_ADD | BPF_X: /* A += X */
 304                 jit->seen |= SEEN_XREG;
 305                 /* ar %r5,%r12 */
 306                 EMIT2(0x1a5c);
 307                 break;
 308         case BPF_ALU | BPF_ADD | BPF_K: /* A += K */
 309                 if (!K)
 310                         break;
 311                 if (K <= 16383)
 312                         /* ahi %r5,<K> */
 313                         EMIT4_IMM(0xa75a0000, K);
 314                 else if (test_facility(21))
 315                         /* alfi %r5,<K> */
 316                         EMIT6_IMM(0xc25b0000, K);
 317                 else
 318                         /* a %r5,<d(K)>(%r13) */
 319                         EMIT4_DISP(0x5a50d000, EMIT_CONST(K));
 320                 break;
 321         case BPF_ALU | BPF_SUB | BPF_X: /* A -= X */
 322                 jit->seen |= SEEN_XREG;
 323                 /* sr %r5,%r12 */
 324                 EMIT2(0x1b5c);
 325                 break;
 326         case BPF_ALU | BPF_SUB | BPF_K: /* A -= K */
 327                 if (!K)
 328                         break;
 329                 if (K <= 16384)
 330                         /* ahi %r5,-K */
 331                         EMIT4_IMM(0xa75a0000, -K);
 332                 else if (test_facility(21))
 333                         /* alfi %r5,-K */
 334                         EMIT6_IMM(0xc25b0000, -K);
 335                 else
 336                         /* s %r5,<d(K)>(%r13) */
 337                         EMIT4_DISP(0x5b50d000, EMIT_CONST(K));
 338                 break;
 339         case BPF_ALU | BPF_MUL | BPF_X: /* A *= X */
 340                 jit->seen |= SEEN_XREG;
 341                 /* msr %r5,%r12 */
 342                 EMIT4(0xb252005c);
 343                 break;
 344         case BPF_ALU | BPF_MUL | BPF_K: /* A *= K */
 345                 if (K <= 16383)
 346                         /* mhi %r5,K */
 347                         EMIT4_IMM(0xa75c0000, K);
 348                 else if (test_facility(34))
 349                         /* msfi %r5,<K> */
 350                         EMIT6_IMM(0xc2510000, K);
 351                 else
 352                         /* ms %r5,<d(K)>(%r13) */
 353                         EMIT4_DISP(0x7150d000, EMIT_CONST(K));
 354                 break;
 355         case BPF_ALU | BPF_DIV | BPF_X: /* A /= X */
 356                 jit->seen |= SEEN_XREG | SEEN_RET0;
 357                 /* ltr %r12,%r12 */
 358                 EMIT2(0x12cc);
 359                 /* jz <ret0> */
 360                 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
 361                 /* lhi %r4,0 */
 362                 EMIT4(0xa7480000);
 363                 /* dlr %r4,%r12 */
 364                 EMIT4(0xb997004c);
 365                 break;
 366         case BPF_ALU | BPF_DIV | BPF_K: /* A /= K */
 367                 if (K == 1)
 368                         break;
 369                 /* lhi %r4,0 */
 370                 EMIT4(0xa7480000);
 371                 /* dl %r4,<d(K)>(%r13) */
 372                 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
 373                 break;
 374         case BPF_ALU | BPF_MOD | BPF_X: /* A %= X */
 375                 jit->seen |= SEEN_XREG | SEEN_RET0;
 376                 /* ltr %r12,%r12 */
 377                 EMIT2(0x12cc);
 378                 /* jz <ret0> */
 379                 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
 380                 /* lhi %r4,0 */
 381                 EMIT4(0xa7480000);
 382                 /* dlr %r4,%r12 */
 383                 EMIT4(0xb997004c);
 384                 /* lr %r5,%r4 */
 385                 EMIT2(0x1854);
 386                 break;
 387         case BPF_ALU | BPF_MOD | BPF_K: /* A %= K */
 388                 if (K == 1) {
 389                         /* lhi %r5,0 */
 390                         EMIT4(0xa7580000);
 391                         break;
 392                 }
 393                 /* lhi %r4,0 */
 394                 EMIT4(0xa7480000);
 395                 /* dl %r4,<d(K)>(%r13) */
 396                 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
 397                 /* lr %r5,%r4 */
 398                 EMIT2(0x1854);
 399                 break;
 400         case BPF_ALU | BPF_AND | BPF_X: /* A &= X */
 401                 jit->seen |= SEEN_XREG;
 402                 /* nr %r5,%r12 */
 403                 EMIT2(0x145c);
 404                 break;
 405         case BPF_ALU | BPF_AND | BPF_K: /* A &= K */
 406                 if (test_facility(21))
 407                         /* nilf %r5,<K> */
 408                         EMIT6_IMM(0xc05b0000, K);
 409                 else
 410                         /* n %r5,<d(K)>(%r13) */
 411                         EMIT4_DISP(0x5450d000, EMIT_CONST(K));
 412                 break;
 413         case BPF_ALU | BPF_OR | BPF_X: /* A |= X */
 414                 jit->seen |= SEEN_XREG;
 415                 /* or %r5,%r12 */
 416                 EMIT2(0x165c);
 417                 break;
 418         case BPF_ALU | BPF_OR | BPF_K: /* A |= K */
 419                 if (test_facility(21))
 420                         /* oilf %r5,<K> */
 421                         EMIT6_IMM(0xc05d0000, K);
 422                 else
 423                         /* o %r5,<d(K)>(%r13) */
 424                         EMIT4_DISP(0x5650d000, EMIT_CONST(K));
 425                 break;
 426         case BPF_ANC | SKF_AD_ALU_XOR_X: /* A ^= X; */
 427         case BPF_ALU | BPF_XOR | BPF_X:
 428                 jit->seen |= SEEN_XREG;
 429                 /* xr %r5,%r12 */
 430                 EMIT2(0x175c);
 431                 break;
 432         case BPF_ALU | BPF_XOR | BPF_K: /* A ^= K */
 433                 if (!K)
 434                         break;
 435                 /* x %r5,<d(K)>(%r13) */
 436                 EMIT4_DISP(0x5750d000, EMIT_CONST(K));
 437                 break;
 438         case BPF_ALU | BPF_LSH | BPF_X: /* A <<= X; */
 439                 jit->seen |= SEEN_XREG;
 440                 /* sll %r5,0(%r12) */
 441                 EMIT4(0x8950c000);
 442                 break;
 443         case BPF_ALU | BPF_LSH | BPF_K: /* A <<= K */
 444                 if (K == 0)
 445                         break;
 446                 /* sll %r5,K */
 447                 EMIT4_DISP(0x89500000, K);
 448                 break;
 449         case BPF_ALU | BPF_RSH | BPF_X: /* A >>= X; */
 450                 jit->seen |= SEEN_XREG;
 451                 /* srl %r5,0(%r12) */
 452                 EMIT4(0x8850c000);
 453                 break;
 454         case BPF_ALU | BPF_RSH | BPF_K: /* A >>= K; */
 455                 if (K == 0)
 456                         break;
 457                 /* srl %r5,K */
 458                 EMIT4_DISP(0x88500000, K);
 459                 break;
 460         case BPF_ALU | BPF_NEG: /* A = -A */
 461                 /* lnr %r5,%r5 */
 462                 EMIT2(0x1155);
 463                 break;
 464         case BPF_JMP | BPF_JA: /* ip += K */
 465                 offset = addrs[i + K] + jit->start - jit->prg;
 466                 EMIT4_PCREL(0xa7f40000, offset);
 467                 break;
 468         case BPF_JMP | BPF_JGT | BPF_K: /* ip += (A > K) ? jt : jf */
 469                 mask = 0x200000; /* jh */
 470                 goto kbranch;
 471         case BPF_JMP | BPF_JGE | BPF_K: /* ip += (A >= K) ? jt : jf */
 472                 mask = 0xa00000; /* jhe */
 473                 goto kbranch;
 474         case BPF_JMP | BPF_JEQ | BPF_K: /* ip += (A == K) ? jt : jf */
 475                 mask = 0x800000; /* je */
 476 kbranch:        /* Emit compare if the branch targets are different */
 477                 if (filter->jt != filter->jf) {
 478                         if (K <= 16383)
 479                                 /* chi %r5,<K> */
 480                                 EMIT4_IMM(0xa75e0000, K);
 481                         else if (test_facility(21))
 482                                 /* clfi %r5,<K> */
 483                                 EMIT6_IMM(0xc25f0000, K);
 484                         else
 485                                 /* c %r5,<d(K)>(%r13) */
 486                                 EMIT4_DISP(0x5950d000, EMIT_CONST(K));
 487                 }
 488 branch:         if (filter->jt == filter->jf) {
 489                         if (filter->jt == 0)
 490                                 break;
 491                         /* j <jt> */
 492                         offset = addrs[i + filter->jt] + jit->start - jit->prg;
 493                         EMIT4_PCREL(0xa7f40000, offset);
 494                         break;
 495                 }
 496                 if (filter->jt != 0) {
 497                         /* brc  <mask>,<jt> */
 498                         offset = addrs[i + filter->jt] + jit->start - jit->prg;
 499                         EMIT4_PCREL(0xa7040000 | mask, offset);
 500                 }
 501                 if (filter->jf != 0) {
 502                         /* brc  <mask^15>,<jf> */
 503                         offset = addrs[i + filter->jf] + jit->start - jit->prg;
 504                         EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset);
 505                 }
 506                 break;
 507         case BPF_JMP | BPF_JSET | BPF_K: /* ip += (A & K) ? jt : jf */
 508                 mask = 0x700000; /* jnz */
 509                 /* Emit test if the branch targets are different */
 510                 if (filter->jt != filter->jf) {
 511                         if (K > 65535) {
 512                                 /* lr %r4,%r5 */
 513                                 EMIT2(0x1845);
 514                                 /* n %r4,<d(K)>(%r13) */
 515                                 EMIT4_DISP(0x5440d000, EMIT_CONST(K));
 516                         } else
 517                                 /* tmll %r5,K */
 518                                 EMIT4_IMM(0xa7510000, K);
 519                 }
 520                 goto branch;
 521         case BPF_JMP | BPF_JGT | BPF_X: /* ip += (A > X) ? jt : jf */
 522                 mask = 0x200000; /* jh */
 523                 goto xbranch;
 524         case BPF_JMP | BPF_JGE | BPF_X: /* ip += (A >= X) ? jt : jf */
 525                 mask = 0xa00000; /* jhe */
 526                 goto xbranch;
 527         case BPF_JMP | BPF_JEQ | BPF_X: /* ip += (A == X) ? jt : jf */
 528                 mask = 0x800000; /* je */
 529 xbranch:        /* Emit compare if the branch targets are different */
 530                 if (filter->jt != filter->jf) {
 531                         jit->seen |= SEEN_XREG;
 532                         /* cr %r5,%r12 */
 533                         EMIT2(0x195c);
 534                 }
 535                 goto branch;
 536         case BPF_JMP | BPF_JSET | BPF_X: /* ip += (A & X) ? jt : jf */
 537                 mask = 0x700000; /* jnz */
 538                 /* Emit test if the branch targets are different */
 539                 if (filter->jt != filter->jf) {
 540                         jit->seen |= SEEN_XREG;
 541                         /* lr %r4,%r5 */
 542                         EMIT2(0x1845);
 543                         /* nr %r4,%r12 */
 544                         EMIT2(0x144c);
 545                 }
 546                 goto branch;
 547         case BPF_LD | BPF_W | BPF_ABS: /* A = *(u32 *) (skb->data+K) */
 548                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD;
 549                 offset = jit->off_load_word;
 550                 goto load_abs;
 551         case BPF_LD | BPF_H | BPF_ABS: /* A = *(u16 *) (skb->data+K) */
 552                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF;
 553                 offset = jit->off_load_half;
 554                 goto load_abs;
 555         case BPF_LD | BPF_B | BPF_ABS: /* A = *(u8 *) (skb->data+K) */
 556                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE;
 557                 offset = jit->off_load_byte;
 558 load_abs:       if ((int) K < 0)
 559                         goto out;
 560 call_fn:        /* lg %r1,<d(function)>(%r13) */
 561                 EMIT6_DISP(0xe310d000, 0x0004, offset);
 562                 /* l %r3,<d(K)>(%r13) */
 563                 EMIT4_DISP(0x5830d000, EMIT_CONST(K));
 564                 /* basr %r8,%r1 */
 565                 EMIT2(0x0d81);
 566                 /* jnz <ret0> */
 567                 EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg));
 568                 break;
 569         case BPF_LD | BPF_W | BPF_IND: /* A = *(u32 *) (skb->data+K+X) */
 570                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD;
 571                 offset = jit->off_load_iword;
 572                 goto call_fn;
 573         case BPF_LD | BPF_H | BPF_IND: /* A = *(u16 *) (skb->data+K+X) */
 574                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF;
 575                 offset = jit->off_load_ihalf;
 576                 goto call_fn;
 577         case BPF_LD | BPF_B | BPF_IND: /* A = *(u8 *) (skb->data+K+X) */
 578                 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE;
 579                 offset = jit->off_load_ibyte;
 580                 goto call_fn;
 581         case BPF_LDX | BPF_B | BPF_MSH:
 582                 /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */
 583                 jit->seen |= SEEN_RET0;
 584                 if ((int) K < 0) {
 585                         /* j <ret0> */
 586                         EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg));
 587                         break;
 588                 }
 589                 jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH;
 590                 offset = jit->off_load_bmsh;
 591                 goto call_fn;
 592         case BPF_LD | BPF_W | BPF_LEN: /*       A = skb->len; */
 593                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
 594                 /* l %r5,<d(len)>(%r2) */
 595                 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len));
 596                 break;
 597         case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */
 598                 jit->seen |= SEEN_XREG;
 599                 /* l %r12,<d(len)>(%r2) */
 600                 EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len));
 601                 break;
 602         case BPF_LD | BPF_IMM: /* A = K */
 603                 if (K <= 16383)
 604                         /* lhi %r5,K */
 605                         EMIT4_IMM(0xa7580000, K);
 606                 else if (test_facility(21))
 607                         /* llilf %r5,<K> */
 608                         EMIT6_IMM(0xc05f0000, K);
 609                 else
 610                         /* l %r5,<d(K)>(%r13) */
 611                         EMIT4_DISP(0x5850d000, EMIT_CONST(K));
 612                 break;
 613         case BPF_LDX | BPF_IMM: /* X = K */
 614                 jit->seen |= SEEN_XREG;
 615                 if (K <= 16383)
 616                         /* lhi %r12,<K> */
 617                         EMIT4_IMM(0xa7c80000, K);
 618                 else if (test_facility(21))
 619                         /* llilf %r12,<K> */
 620                         EMIT6_IMM(0xc0cf0000, K);
 621                 else
 622                         /* l %r12,<d(K)>(%r13) */
 623                         EMIT4_DISP(0x58c0d000, EMIT_CONST(K));
 624                 break;
 625         case BPF_LD | BPF_MEM: /* A = mem[K] */
 626                 jit->seen |= SEEN_MEM;
 627                 /* l %r5,<K>(%r15) */
 628                 EMIT4_DISP(0x5850f000,
 629                            (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 630                 break;
 631         case BPF_LDX | BPF_MEM: /* X = mem[K] */
 632                 jit->seen |= SEEN_XREG | SEEN_MEM;
 633                 /* l %r12,<K>(%r15) */
 634                 EMIT4_DISP(0x58c0f000,
 635                            (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 636                 break;
 637         case BPF_MISC | BPF_TAX: /* X = A */
 638                 jit->seen |= SEEN_XREG;
 639                 /* lr %r12,%r5 */
 640                 EMIT2(0x18c5);
 641                 break;
 642         case BPF_MISC | BPF_TXA: /* A = X */
 643                 jit->seen |= SEEN_XREG;
 644                 /* lr %r5,%r12 */
 645                 EMIT2(0x185c);
 646                 break;
 647         case BPF_RET | BPF_K:
 648                 if (K == 0) {
 649                         jit->seen |= SEEN_RET0;
 650                         if (last)
 651                                 break;
 652                         /* j <ret0> */
 653                         EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg);
 654                 } else {
 655                         if (K <= 16383)
 656                                 /* lghi %r2,K */
 657                                 EMIT4_IMM(0xa7290000, K);
 658                         else
 659                                 /* llgf %r2,<K>(%r13) */
 660                                 EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K));
 661                         /* j <exit> */
 662                         if (last && !(jit->seen & SEEN_RET0))
 663                                 break;
 664                         EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
 665                 }
 666                 break;
 667         case BPF_RET | BPF_A:
 668                 /* llgfr %r2,%r5 */
 669                 EMIT4(0xb9160025);
 670                 /* j <exit> */
 671                 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg);
 672                 break;
 673         case BPF_ST: /* mem[K] = A */
 674                 jit->seen |= SEEN_MEM;
 675                 /* st %r5,<K>(%r15) */
 676                 EMIT4_DISP(0x5050f000,
 677                            (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 678                 break;
 679         case BPF_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */
 680                 jit->seen |= SEEN_XREG | SEEN_MEM;
 681                 /* st %r12,<K>(%r15) */
 682                 EMIT4_DISP(0x50c0f000,
 683                            (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4);
 684                 break;
 685         case BPF_ANC | SKF_AD_PROTOCOL: /* A = ntohs(skb->protocol); */
 686                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2);
 687                 /* lhi %r5,0 */
 688                 EMIT4(0xa7580000);
 689                 /* icm  %r5,3,<d(protocol)>(%r2) */
 690                 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol));
 691                 break;
 692         case BPF_ANC | SKF_AD_IFINDEX:  /* if (!skb->dev) return 0;
 693                                          * A = skb->dev->ifindex */
 694                 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
 695                 jit->seen |= SEEN_RET0;
 696                 /* lg %r1,<d(dev)>(%r2) */
 697                 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
 698                 /* ltgr %r1,%r1 */
 699                 EMIT4(0xb9020011);
 700                 /* jz <ret0> */
 701                 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
 702                 /* l %r5,<d(ifindex)>(%r1) */
 703                 EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex));
 704                 break;
 705         case BPF_ANC | SKF_AD_MARK: /* A = skb->mark */
 706                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4);
 707                 /* l %r5,<d(mark)>(%r2) */
 708                 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark));
 709                 break;
 710         case BPF_ANC | SKF_AD_QUEUE: /* A = skb->queue_mapping */
 711                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2);
 712                 /* lhi %r5,0 */
 713                 EMIT4(0xa7580000);
 714                 /* icm  %r5,3,<d(queue_mapping)>(%r2) */
 715                 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping));
 716                 break;
 717         case BPF_ANC | SKF_AD_HATYPE:   /* if (!skb->dev) return 0;
 718                                          * A = skb->dev->type */
 719                 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2);
 720                 jit->seen |= SEEN_RET0;
 721                 /* lg %r1,<d(dev)>(%r2) */
 722                 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev));
 723                 /* ltgr %r1,%r1 */
 724                 EMIT4(0xb9020011);
 725                 /* jz <ret0> */
 726                 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg);
 727                 /* lhi %r5,0 */
 728                 EMIT4(0xa7580000);
 729                 /* icm  %r5,3,<d(type)>(%r1) */
 730                 EMIT4_DISP(0xbf531000, offsetof(struct net_device, type));
 731                 break;
 732         case BPF_ANC | SKF_AD_RXHASH: /* A = skb->hash */
 733                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4);
 734                 /* l %r5,<d(hash)>(%r2) */
 735                 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, hash));
 736                 break;
 737         case BPF_ANC | SKF_AD_VLAN_TAG:
 738         case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT:
 739                 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, vlan_tci) != 2);
 740                 BUILD_BUG_ON(VLAN_TAG_PRESENT != 0x1000);
 741                 /* lhi %r5,0 */
 742                 EMIT4(0xa7580000);
 743                 /* icm  %r5,3,<d(vlan_tci)>(%r2) */
 744                 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, vlan_tci));
 745                 if (code == (BPF_ANC | SKF_AD_VLAN_TAG)) {
 746                         /* nill %r5,0xefff */
 747                         EMIT4_IMM(0xa5570000, ~VLAN_TAG_PRESENT);
 748                 } else {
 749                         /* nill %r5,0x1000 */
 750                         EMIT4_IMM(0xa5570000, VLAN_TAG_PRESENT);
 751                         /* srl %r5,12 */
 752                         EMIT4_DISP(0x88500000, 12);
 753                 }
 754                 break;
 755         case BPF_ANC | SKF_AD_PKTTYPE:
 756                 if (pkt_type_offset < 0)
 757                         goto out;
 758                 /* lhi %r5,0 */
 759                 EMIT4(0xa7580000);
 760                 /* ic %r5,<d(pkt_type_offset)>(%r2) */
 761                 EMIT4_DISP(0x43502000, pkt_type_offset);
 762                 /* srl %r5,5 */
 763                 EMIT4_DISP(0x88500000, 5);
 764                 break;
 765         case BPF_ANC | SKF_AD_CPU: /* A = smp_processor_id() */
 766 #ifdef CONFIG_SMP
 767                 /* l %r5,<d(cpu_nr)> */
 768                 EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr));
 769 #else
 770                 /* lhi %r5,0 */
 771                 EMIT4(0xa7580000);
 772 #endif
 773                 break;
 774         default: /* too complex, give up */
 775                 goto out;
 776         }
 777         addrs[i] = jit->prg - jit->start;
 778         return 0;
 779 out:
 780         return -1;
 781 }
 782
 783 /*
 784  * Note: for security reasons, bpf code will follow a randomly
 785  *       sized amount of illegal instructions.
 786  */
 787 struct bpf_binary_header {
 788         unsigned int pages;
 789         u8 image[];
 790 };
 791
 792 static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
 793                                                   u8 **image_ptr)
 794 {
 795         struct bpf_binary_header *header;
 796         unsigned int sz, hole;
 797
 798         /* Most BPF filters are really small, but if some of them fill a page,
 799          * allow at least 128 extra bytes for illegal instructions.
 800          */
 801         sz = round_up(bpfsize + sizeof(*header) + 128, PAGE_SIZE);
 802         header = module_alloc(sz);
 803         if (!header)
 804                 return NULL;
 805         memset(header, 0, sz);
 806         header->pages = sz / PAGE_SIZE;
 807         hole = min(sz - (bpfsize + sizeof(*header)), PAGE_SIZE - sizeof(*header));
 808         /* Insert random number of illegal instructions before BPF code
 809          * and make sure the first instruction starts at an even address.
 810          */
 811         *image_ptr = &header->image[(prandom_u32() % hole) & -2];
 812         return header;
 813 }
 814
 815 void bpf_jit_compile(struct bpf_prog *fp)
 816 {
 817         struct bpf_binary_header *header = NULL;
 818         unsigned long size, prg_len, lit_len;
 819         struct bpf_jit jit, cjit;
 820         unsigned int *addrs;
 821         int pass, i;
 822
 823         if (!bpf_jit_enable)
 824                 return;
 825         addrs = kcalloc(fp->len, sizeof(*addrs), GFP_KERNEL);
 826         if (addrs == NULL)
 827                 return;
 828         memset(&jit, 0, sizeof(cjit));
 829         memset(&cjit, 0, sizeof(cjit));
 830
 831         for (pass = 0; pass < 10; pass++) {
 832                 jit.prg = jit.start;
 833                 jit.lit = jit.mid;
 834
 835                 bpf_jit_prologue(&jit);
 836                 bpf_jit_noleaks(&jit, fp->insns);
 837                 for (i = 0; i < fp->len; i++) {
 838                         if (bpf_jit_insn(&jit, fp->insns + i, addrs, i,
 839                                          i == fp->len - 1))
 840                                 goto out;
 841                 }
 842                 bpf_jit_epilogue(&jit);
 843                 if (jit.start) {
 844                         WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit);
 845                         if (memcmp(&jit, &cjit, sizeof(jit)) == 0)
 846                                 break;
 847                 } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) {
 848                         prg_len = jit.prg - jit.start;
 849                         lit_len = jit.lit - jit.mid;
 850                         size = prg_len + lit_len;
 851                         if (size >= BPF_SIZE_MAX)
 852                                 goto out;
 853                         header = bpf_alloc_binary(size, &jit.start);
 854                         if (!header)
 855                                 goto out;
 856                         jit.prg = jit.mid = jit.start + prg_len;
 857                         jit.lit = jit.end = jit.start + prg_len + lit_len;
 858                         jit.base_ip += (unsigned long) jit.start;
 859                         jit.exit_ip += (unsigned long) jit.start;
 860                         jit.ret0_ip += (unsigned long) jit.start;
 861                 }
 862                 cjit = jit;
 863         }
 864         if (bpf_jit_enable > 1) {
 865                 bpf_jit_dump(fp->len, jit.end - jit.start, pass, jit.start);
 866                 if (jit.start)
 867                         print_fn_code(jit.start, jit.mid - jit.start);
 868         }
 869         if (jit.start) {
 870                 set_memory_ro((unsigned long)header, header->pages);
 871                 fp->bpf_func = (void *) jit.start;
 872                 fp->jited = 1;
 873         }
 874 out:
 875         kfree(addrs);
 876 }
 877
 878 void bpf_jit_free(struct bpf_prog *fp)
 879 {
 880         unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
 881         struct bpf_binary_header *header = (void *)addr;
 882
 883         if (!fp->jited)
 884                 goto free_filter;
 885
 886         set_memory_rw(addr, header->pages);
 887         module_free(NULL, header);
 888
 889 free_filter:
 890         kfree(fp);
 891 }