1 // SPDX-License-Identifier: GPL-2.0 2 /* BPF JIT compiler for RV64G 3 * 4 * Copyright(c) 2019 Björn Töpel <bjorn.topel@gmail.com> 5 * 6 */ 7 8 #include <linux/bitfield.h> 9 #include <linux/bpf.h> 10 #include <linux/filter.h> 11 #include <linux/memory.h> 12 #include <linux/stop_machine.h> 13 #include <asm/text-patching.h> 14 #include <asm/cfi.h> 15 #include <asm/percpu.h> 16 #include "bpf_jit.h" 17 18 #define RV_MAX_REG_ARGS 8 19 #define RV_FENTRY_NINSNS 2 20 #define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4) 21 /* imm that allows emit_imm to emit max count insns */ 22 #define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF 23 /* fentry and TCC init insns will be skipped on tailcall */ 24 #define RV_TAILCALL_OFFSET ((RV_FENTRY_NINSNS + 1) * 4) 25 26 #define RV_REG_TCC RV_REG_A6 27 #define RV_REG_ARENA RV_REG_S7 /* For storing arena_vm_start */ 28 29 static const int regmap[] = { 30 [BPF_REG_0] = RV_REG_A5, 31 [BPF_REG_1] = RV_REG_A0, 32 [BPF_REG_2] = RV_REG_A1, 33 [BPF_REG_3] = RV_REG_A2, 34 [BPF_REG_4] = RV_REG_A3, 35 [BPF_REG_5] = RV_REG_A4, 36 [BPF_REG_6] = RV_REG_S1, 37 [BPF_REG_7] = RV_REG_S2, 38 [BPF_REG_8] = RV_REG_S3, 39 [BPF_REG_9] = RV_REG_S4, 40 [BPF_REG_FP] = RV_REG_S5, 41 [BPF_REG_AX] = RV_REG_T0, 42 }; 43 44 static const int pt_regmap[] = { 45 [RV_REG_A0] = offsetof(struct pt_regs, a0), 46 [RV_REG_A1] = offsetof(struct pt_regs, a1), 47 [RV_REG_A2] = offsetof(struct pt_regs, a2), 48 [RV_REG_A3] = offsetof(struct pt_regs, a3), 49 [RV_REG_A4] = offsetof(struct pt_regs, a4), 50 [RV_REG_A5] = offsetof(struct pt_regs, a5), 51 [RV_REG_S1] = offsetof(struct pt_regs, s1), 52 [RV_REG_S2] = offsetof(struct pt_regs, s2), 53 [RV_REG_S3] = offsetof(struct pt_regs, s3), 54 [RV_REG_S4] = offsetof(struct pt_regs, s4), 55 [RV_REG_S5] = offsetof(struct pt_regs, s5), 56 [RV_REG_T0] = offsetof(struct pt_regs, t0), 57 }; 58 59 enum { 60 RV_CTX_F_SEEN_CALL = RV_REG_RA, 61 RV_CTX_F_SEEN_S1 = RV_REG_S1, 62 RV_CTX_F_SEEN_S2 = RV_REG_S2, 63 RV_CTX_F_SEEN_S3 = RV_REG_S3, 64 RV_CTX_F_SEEN_S4 = RV_REG_S4, 65 RV_CTX_F_SEEN_S5 = RV_REG_S5, 66 }; 67 68 static u8 bpf_to_rv_reg(int bpf_reg, struct rv_jit_context *ctx) 69 { 70 u8 reg = regmap[bpf_reg]; 71 72 switch (reg) { 73 case RV_CTX_F_SEEN_S1: 74 case RV_CTX_F_SEEN_S2: 75 case RV_CTX_F_SEEN_S3: 76 case RV_CTX_F_SEEN_S4: 77 case RV_CTX_F_SEEN_S5: 78 __set_bit(reg, &ctx->flags); 79 } 80 return reg; 81 }; 82 83 static bool seen_reg(int reg, struct rv_jit_context *ctx) 84 { 85 switch (reg) { 86 case RV_CTX_F_SEEN_CALL: 87 case RV_CTX_F_SEEN_S1: 88 case RV_CTX_F_SEEN_S2: 89 case RV_CTX_F_SEEN_S3: 90 case RV_CTX_F_SEEN_S4: 91 case RV_CTX_F_SEEN_S5: 92 return test_bit(reg, &ctx->flags); 93 } 94 return false; 95 } 96 97 static void mark_fp(struct rv_jit_context *ctx) 98 { 99 __set_bit(RV_CTX_F_SEEN_S5, &ctx->flags); 100 } 101 102 static void mark_call(struct rv_jit_context *ctx) 103 { 104 __set_bit(RV_CTX_F_SEEN_CALL, &ctx->flags); 105 } 106 107 static bool is_32b_int(s64 val) 108 { 109 return -(1L << 31) <= val && val < (1L << 31); 110 } 111 112 static bool in_auipc_jalr_range(s64 val) 113 { 114 /* 115 * auipc+jalr can reach any signed PC-relative offset in the range 116 * [-2^31 - 2^11, 2^31 - 2^11). 117 */ 118 return (-(1L << 31) - (1L << 11)) <= val && 119 val < ((1L << 31) - (1L << 11)); 120 } 121 122 /* Modify rd pointer to alternate reg to avoid corrupting original reg */ 123 static void emit_sextw_alt(u8 *rd, u8 ra, struct rv_jit_context *ctx) 124 { 125 emit_sextw(ra, *rd, ctx); 126 *rd = ra; 127 } 128 129 static void emit_zextw_alt(u8 *rd, u8 ra, struct rv_jit_context *ctx) 130 { 131 emit_zextw(ra, *rd, ctx); 132 *rd = ra; 133 } 134 135 /* Emit fixed-length instructions for address */ 136 static int emit_addr(u8 rd, u64 addr, bool extra_pass, struct rv_jit_context *ctx) 137 { 138 /* 139 * Use the ro_insns(RX) to calculate the offset as the BPF program will 140 * finally run from this memory region. 141 */ 142 u64 ip = (u64)(ctx->ro_insns + ctx->ninsns); 143 s64 off = addr - ip; 144 s64 upper = (off + (1 << 11)) >> 12; 145 s64 lower = off & 0xfff; 146 147 if (extra_pass && !in_auipc_jalr_range(off)) { 148 pr_err("bpf-jit: target offset 0x%llx is out of range\n", off); 149 return -ERANGE; 150 } 151 152 emit(rv_auipc(rd, upper), ctx); 153 emit(rv_addi(rd, rd, lower), ctx); 154 return 0; 155 } 156 157 /* Emit variable-length instructions for 32-bit and 64-bit imm */ 158 static void emit_imm(u8 rd, s64 val, struct rv_jit_context *ctx) 159 { 160 /* Note that the immediate from the add is sign-extended, 161 * which means that we need to compensate this by adding 2^12, 162 * when the 12th bit is set. A simpler way of doing this, and 163 * getting rid of the check, is to just add 2**11 before the 164 * shift. The "Loading a 32-Bit constant" example from the 165 * "Computer Organization and Design, RISC-V edition" book by 166 * Patterson/Hennessy highlights this fact. 167 * 168 * This also means that we need to process LSB to MSB. 169 */ 170 s64 upper = (val + (1 << 11)) >> 12; 171 /* Sign-extend lower 12 bits to 64 bits since immediates for li, addiw, 172 * and addi are signed and RVC checks will perform signed comparisons. 173 */ 174 s64 lower = ((val & 0xfff) << 52) >> 52; 175 int shift; 176 177 if (is_32b_int(val)) { 178 if (upper) 179 emit_lui(rd, upper, ctx); 180 181 if (!upper) { 182 emit_li(rd, lower, ctx); 183 return; 184 } 185 186 emit_addiw(rd, rd, lower, ctx); 187 return; 188 } 189 190 shift = __ffs(upper); 191 upper >>= shift; 192 shift += 12; 193 194 emit_imm(rd, upper, ctx); 195 196 emit_slli(rd, rd, shift, ctx); 197 if (lower) 198 emit_addi(rd, rd, lower, ctx); 199 } 200 201 static void __build_epilogue(bool is_tail_call, struct rv_jit_context *ctx) 202 { 203 int stack_adjust = ctx->stack_size, store_offset = stack_adjust - 8; 204 205 if (seen_reg(RV_REG_RA, ctx)) { 206 emit_ld(RV_REG_RA, store_offset, RV_REG_SP, ctx); 207 store_offset -= 8; 208 } 209 emit_ld(RV_REG_FP, store_offset, RV_REG_SP, ctx); 210 store_offset -= 8; 211 if (seen_reg(RV_REG_S1, ctx)) { 212 emit_ld(RV_REG_S1, store_offset, RV_REG_SP, ctx); 213 store_offset -= 8; 214 } 215 if (seen_reg(RV_REG_S2, ctx)) { 216 emit_ld(RV_REG_S2, store_offset, RV_REG_SP, ctx); 217 store_offset -= 8; 218 } 219 if (seen_reg(RV_REG_S3, ctx)) { 220 emit_ld(RV_REG_S3, store_offset, RV_REG_SP, ctx); 221 store_offset -= 8; 222 } 223 if (seen_reg(RV_REG_S4, ctx)) { 224 emit_ld(RV_REG_S4, store_offset, RV_REG_SP, ctx); 225 store_offset -= 8; 226 } 227 if (seen_reg(RV_REG_S5, ctx)) { 228 emit_ld(RV_REG_S5, store_offset, RV_REG_SP, ctx); 229 store_offset -= 8; 230 } 231 if (ctx->arena_vm_start) { 232 emit_ld(RV_REG_ARENA, store_offset, RV_REG_SP, ctx); 233 store_offset -= 8; 234 } 235 236 /* restore TCC from stack to RV_REG_TCC */ 237 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 238 239 emit_addi(RV_REG_SP, RV_REG_SP, stack_adjust, ctx); 240 /* Set return value. */ 241 if (!is_tail_call) 242 emit_addiw(RV_REG_A0, RV_REG_A5, 0, ctx); 243 emit_jalr(RV_REG_ZERO, is_tail_call ? RV_REG_T3 : RV_REG_RA, 244 is_tail_call ? RV_TAILCALL_OFFSET : 0, ctx); 245 } 246 247 static void emit_bcc(u8 cond, u8 rd, u8 rs, int rvoff, 248 struct rv_jit_context *ctx) 249 { 250 switch (cond) { 251 case BPF_JEQ: 252 emit(rv_beq(rd, rs, rvoff >> 1), ctx); 253 return; 254 case BPF_JGT: 255 emit(rv_bltu(rs, rd, rvoff >> 1), ctx); 256 return; 257 case BPF_JLT: 258 emit(rv_bltu(rd, rs, rvoff >> 1), ctx); 259 return; 260 case BPF_JGE: 261 emit(rv_bgeu(rd, rs, rvoff >> 1), ctx); 262 return; 263 case BPF_JLE: 264 emit(rv_bgeu(rs, rd, rvoff >> 1), ctx); 265 return; 266 case BPF_JNE: 267 emit(rv_bne(rd, rs, rvoff >> 1), ctx); 268 return; 269 case BPF_JSGT: 270 emit(rv_blt(rs, rd, rvoff >> 1), ctx); 271 return; 272 case BPF_JSLT: 273 emit(rv_blt(rd, rs, rvoff >> 1), ctx); 274 return; 275 case BPF_JSGE: 276 emit(rv_bge(rd, rs, rvoff >> 1), ctx); 277 return; 278 case BPF_JSLE: 279 emit(rv_bge(rs, rd, rvoff >> 1), ctx); 280 } 281 } 282 283 static void emit_branch(u8 cond, u8 rd, u8 rs, int rvoff, 284 struct rv_jit_context *ctx) 285 { 286 s64 upper, lower; 287 288 if (is_13b_int(rvoff)) { 289 emit_bcc(cond, rd, rs, rvoff, ctx); 290 return; 291 } 292 293 /* Adjust for jal */ 294 rvoff -= 4; 295 296 /* Transform, e.g.: 297 * bne rd,rs,foo 298 * to 299 * beq rd,rs,<.L1> 300 * (auipc foo) 301 * jal(r) foo 302 * .L1 303 */ 304 cond = invert_bpf_cond(cond); 305 if (is_21b_int(rvoff)) { 306 emit_bcc(cond, rd, rs, 8, ctx); 307 emit(rv_jal(RV_REG_ZERO, rvoff >> 1), ctx); 308 return; 309 } 310 311 /* 32b No need for an additional rvoff adjustment, since we 312 * get that from the auipc at PC', where PC = PC' + 4. 313 */ 314 upper = (rvoff + (1 << 11)) >> 12; 315 lower = rvoff & 0xfff; 316 317 emit_bcc(cond, rd, rs, 12, ctx); 318 emit(rv_auipc(RV_REG_T1, upper), ctx); 319 emit(rv_jalr(RV_REG_ZERO, RV_REG_T1, lower), ctx); 320 } 321 322 static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx) 323 { 324 int tc_ninsn, off, start_insn = ctx->ninsns; 325 326 /* a0: &ctx 327 * a1: &array 328 * a2: index 329 * 330 * if (index >= array->map.max_entries) 331 * goto out; 332 */ 333 tc_ninsn = insn ? ctx->offset[insn] - ctx->offset[insn - 1] : 334 ctx->offset[0]; 335 emit_zextw(RV_REG_A2, RV_REG_A2, ctx); 336 337 off = offsetof(struct bpf_array, map.max_entries); 338 if (is_12b_check(off, insn)) 339 return -1; 340 emit(rv_lwu(RV_REG_T1, off, RV_REG_A1), ctx); 341 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 342 emit_branch(BPF_JGE, RV_REG_A2, RV_REG_T1, off, ctx); 343 344 /* if (--TCC < 0) 345 * goto out; 346 */ 347 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 348 emit_addi(RV_REG_TCC, RV_REG_TCC, -1, ctx); 349 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 350 emit_branch(BPF_JSLT, RV_REG_TCC, RV_REG_ZERO, off, ctx); 351 352 /* prog = array->ptrs[index]; 353 * if (!prog) 354 * goto out; 355 */ 356 emit_sh3add(RV_REG_T2, RV_REG_A2, RV_REG_A1, ctx); 357 off = offsetof(struct bpf_array, ptrs); 358 if (is_12b_check(off, insn)) 359 return -1; 360 emit_ld(RV_REG_T2, off, RV_REG_T2, ctx); 361 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 362 emit_branch(BPF_JEQ, RV_REG_T2, RV_REG_ZERO, off, ctx); 363 364 /* store updated TCC back to stack */ 365 emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx); 366 367 /* goto *(prog->bpf_func + RV_TAILCALL_OFFSET); */ 368 off = offsetof(struct bpf_prog, bpf_func); 369 if (is_12b_check(off, insn)) 370 return -1; 371 emit_ld(RV_REG_T3, off, RV_REG_T2, ctx); 372 __build_epilogue(true, ctx); 373 return 0; 374 } 375 376 static void init_regs(u8 *rd, u8 *rs, const struct bpf_insn *insn, 377 struct rv_jit_context *ctx) 378 { 379 u8 code = insn->code; 380 381 switch (code) { 382 case BPF_JMP | BPF_JA: 383 case BPF_JMP | BPF_CALL: 384 case BPF_JMP | BPF_EXIT: 385 case BPF_JMP | BPF_TAIL_CALL: 386 break; 387 default: 388 *rd = bpf_to_rv_reg(insn->dst_reg, ctx); 389 } 390 391 if (code & (BPF_ALU | BPF_X) || code & (BPF_ALU64 | BPF_X) || 392 code & (BPF_JMP | BPF_X) || code & (BPF_JMP32 | BPF_X) || 393 code & BPF_LDX || code & BPF_STX) 394 *rs = bpf_to_rv_reg(insn->src_reg, ctx); 395 } 396 397 static int emit_jump_and_link(u8 rd, s64 rvoff, bool fixed_addr, 398 struct rv_jit_context *ctx) 399 { 400 s64 upper, lower; 401 402 if (rvoff && fixed_addr && is_21b_int(rvoff)) { 403 emit(rv_jal(rd, rvoff >> 1), ctx); 404 return 0; 405 } else if (in_auipc_jalr_range(rvoff)) { 406 upper = (rvoff + (1 << 11)) >> 12; 407 lower = rvoff & 0xfff; 408 emit(rv_auipc(RV_REG_T1, upper), ctx); 409 emit(rv_jalr(rd, RV_REG_T1, lower), ctx); 410 return 0; 411 } 412 413 pr_err("bpf-jit: target offset 0x%llx is out of range\n", rvoff); 414 return -ERANGE; 415 } 416 417 static bool is_signed_bpf_cond(u8 cond) 418 { 419 return cond == BPF_JSGT || cond == BPF_JSLT || 420 cond == BPF_JSGE || cond == BPF_JSLE; 421 } 422 423 static int emit_call(u64 addr, bool fixed_addr, struct rv_jit_context *ctx) 424 { 425 s64 off = 0; 426 u64 ip; 427 428 if (addr && ctx->insns && ctx->ro_insns) { 429 /* 430 * Use the ro_insns(RX) to calculate the offset as the BPF 431 * program will finally run from this memory region. 432 */ 433 ip = (u64)(long)(ctx->ro_insns + ctx->ninsns); 434 off = addr - ip; 435 } 436 437 return emit_jump_and_link(RV_REG_RA, off, fixed_addr, ctx); 438 } 439 440 static inline void emit_kcfi(u32 hash, struct rv_jit_context *ctx) 441 { 442 if (IS_ENABLED(CONFIG_CFI)) 443 emit(hash, ctx); 444 } 445 446 static void emit_ldx_insn(u8 rd, s16 off, u8 rs, u8 size, bool sign_ext, 447 struct rv_jit_context *ctx) 448 { 449 switch (size) { 450 case BPF_B: 451 emit(sign_ext ? rv_lb(rd, off, rs) : rv_lbu(rd, off, rs), ctx); 452 break; 453 case BPF_H: 454 emit(sign_ext ? rv_lh(rd, off, rs) : rv_lhu(rd, off, rs), ctx); 455 break; 456 case BPF_W: 457 emit(sign_ext ? rv_lw(rd, off, rs) : rv_lwu(rd, off, rs), ctx); 458 break; 459 case BPF_DW: 460 emit_ld(rd, off, rs, ctx); 461 break; 462 } 463 464 } 465 466 static void emit_stx_insn(u8 rd, s16 off, u8 rs, u8 size, struct rv_jit_context *ctx) 467 { 468 switch (size) { 469 case BPF_B: 470 emit(rv_sb(rd, off, rs), ctx); 471 break; 472 case BPF_H: 473 emit(rv_sh(rd, off, rs), ctx); 474 break; 475 case BPF_W: 476 emit_sw(rd, off, rs, ctx); 477 break; 478 case BPF_DW: 479 emit_sd(rd, off, rs, ctx); 480 break; 481 } 482 } 483 484 static void emit_ldx(u8 rd, s16 off, u8 rs, u8 size, bool sign_ext, 485 struct rv_jit_context *ctx) 486 { 487 if (is_12b_int(off)) { 488 ctx->ex_insn_off = ctx->ninsns; 489 emit_ldx_insn(rd, off, rs, size, sign_ext, ctx); 490 ctx->ex_jmp_off = ctx->ninsns; 491 return; 492 } 493 494 emit_imm(RV_REG_T1, off, ctx); 495 emit_add(RV_REG_T1, RV_REG_T1, rs, ctx); 496 ctx->ex_insn_off = ctx->ninsns; 497 emit_ldx_insn(rd, 0, RV_REG_T1, size, sign_ext, ctx); 498 ctx->ex_jmp_off = ctx->ninsns; 499 } 500 501 static void emit_st(u8 rd, s16 off, s32 imm, u8 size, struct rv_jit_context *ctx) 502 { 503 emit_imm(RV_REG_T1, imm, ctx); 504 if (is_12b_int(off)) { 505 ctx->ex_insn_off = ctx->ninsns; 506 emit_stx_insn(rd, off, RV_REG_T1, size, ctx); 507 ctx->ex_jmp_off = ctx->ninsns; 508 return; 509 } 510 511 emit_imm(RV_REG_T2, off, ctx); 512 emit_add(RV_REG_T2, RV_REG_T2, rd, ctx); 513 ctx->ex_insn_off = ctx->ninsns; 514 emit_stx_insn(RV_REG_T2, 0, RV_REG_T1, size, ctx); 515 ctx->ex_jmp_off = ctx->ninsns; 516 } 517 518 static void emit_stx(u8 rd, s16 off, u8 rs, u8 size, struct rv_jit_context *ctx) 519 { 520 if (is_12b_int(off)) { 521 ctx->ex_insn_off = ctx->ninsns; 522 emit_stx_insn(rd, off, rs, size, ctx); 523 ctx->ex_jmp_off = ctx->ninsns; 524 return; 525 } 526 527 emit_imm(RV_REG_T1, off, ctx); 528 emit_add(RV_REG_T1, RV_REG_T1, rd, ctx); 529 ctx->ex_insn_off = ctx->ninsns; 530 emit_stx_insn(RV_REG_T1, 0, rs, size, ctx); 531 ctx->ex_jmp_off = ctx->ninsns; 532 } 533 534 static int emit_atomic_ld_st(u8 rd, u8 rs, const struct bpf_insn *insn, 535 struct rv_jit_context *ctx) 536 { 537 u8 code = insn->code; 538 s32 imm = insn->imm; 539 s16 off = insn->off; 540 541 switch (imm) { 542 /* dst_reg = load_acquire(src_reg + off16) */ 543 case BPF_LOAD_ACQ: 544 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 545 emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx); 546 rs = RV_REG_T2; 547 } 548 549 emit_ldx(rd, off, rs, BPF_SIZE(code), false, ctx); 550 emit_fence_r_rw(ctx); 551 552 /* If our next insn is a redundant zext, return 1 to tell 553 * build_body() to skip it. 554 */ 555 if (BPF_SIZE(code) != BPF_DW && insn_is_zext(&insn[1])) 556 return 1; 557 break; 558 /* store_release(dst_reg + off16, src_reg) */ 559 case BPF_STORE_REL: 560 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 561 emit_add(RV_REG_T2, rd, RV_REG_ARENA, ctx); 562 rd = RV_REG_T2; 563 } 564 565 emit_fence_rw_w(ctx); 566 emit_stx(rd, off, rs, BPF_SIZE(code), ctx); 567 break; 568 default: 569 pr_err_once("bpf-jit: invalid atomic load/store opcode %02x\n", imm); 570 return -EINVAL; 571 } 572 573 return 0; 574 } 575 576 static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn, 577 struct rv_jit_context *ctx) 578 { 579 u8 code = insn->code; 580 s16 off = insn->off; 581 s32 imm = insn->imm; 582 bool is64 = BPF_SIZE(code) == BPF_DW; 583 584 if (BPF_SIZE(code) != BPF_W && BPF_SIZE(code) != BPF_DW) { 585 pr_err_once("bpf-jit: 1- and 2-byte RMW atomics are not supported\n"); 586 return -EINVAL; 587 } 588 589 if (off) { 590 if (is_12b_int(off)) { 591 emit_addi(RV_REG_T1, rd, off, ctx); 592 } else { 593 emit_imm(RV_REG_T1, off, ctx); 594 emit_add(RV_REG_T1, RV_REG_T1, rd, ctx); 595 } 596 rd = RV_REG_T1; 597 } 598 599 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 600 emit_add(RV_REG_T1, rd, RV_REG_ARENA, ctx); 601 rd = RV_REG_T1; 602 } 603 604 switch (imm) { 605 /* lock *(u32/u64 *)(dst_reg + off16) <op>= src_reg */ 606 case BPF_ADD: 607 ctx->ex_insn_off = ctx->ninsns; 608 emit(is64 ? rv_amoadd_d(RV_REG_ZERO, rs, rd, 0, 0) : 609 rv_amoadd_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 610 ctx->ex_jmp_off = ctx->ninsns; 611 break; 612 case BPF_AND: 613 ctx->ex_insn_off = ctx->ninsns; 614 emit(is64 ? rv_amoand_d(RV_REG_ZERO, rs, rd, 0, 0) : 615 rv_amoand_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 616 ctx->ex_jmp_off = ctx->ninsns; 617 break; 618 case BPF_OR: 619 ctx->ex_insn_off = ctx->ninsns; 620 emit(is64 ? rv_amoor_d(RV_REG_ZERO, rs, rd, 0, 0) : 621 rv_amoor_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 622 ctx->ex_jmp_off = ctx->ninsns; 623 break; 624 case BPF_XOR: 625 ctx->ex_insn_off = ctx->ninsns; 626 emit(is64 ? rv_amoxor_d(RV_REG_ZERO, rs, rd, 0, 0) : 627 rv_amoxor_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 628 ctx->ex_jmp_off = ctx->ninsns; 629 break; 630 /* src_reg = atomic_fetch_<op>(dst_reg + off16, src_reg) */ 631 case BPF_ADD | BPF_FETCH: 632 ctx->ex_insn_off = ctx->ninsns; 633 emit(is64 ? rv_amoadd_d(rs, rs, rd, 1, 1) : 634 rv_amoadd_w(rs, rs, rd, 1, 1), ctx); 635 ctx->ex_jmp_off = ctx->ninsns; 636 if (!is64) 637 emit_zextw(rs, rs, ctx); 638 break; 639 case BPF_AND | BPF_FETCH: 640 ctx->ex_insn_off = ctx->ninsns; 641 emit(is64 ? rv_amoand_d(rs, rs, rd, 1, 1) : 642 rv_amoand_w(rs, rs, rd, 1, 1), ctx); 643 ctx->ex_jmp_off = ctx->ninsns; 644 if (!is64) 645 emit_zextw(rs, rs, ctx); 646 break; 647 case BPF_OR | BPF_FETCH: 648 ctx->ex_insn_off = ctx->ninsns; 649 emit(is64 ? rv_amoor_d(rs, rs, rd, 1, 1) : 650 rv_amoor_w(rs, rs, rd, 1, 1), ctx); 651 ctx->ex_jmp_off = ctx->ninsns; 652 if (!is64) 653 emit_zextw(rs, rs, ctx); 654 break; 655 case BPF_XOR | BPF_FETCH: 656 ctx->ex_insn_off = ctx->ninsns; 657 emit(is64 ? rv_amoxor_d(rs, rs, rd, 1, 1) : 658 rv_amoxor_w(rs, rs, rd, 1, 1), ctx); 659 ctx->ex_jmp_off = ctx->ninsns; 660 if (!is64) 661 emit_zextw(rs, rs, ctx); 662 break; 663 /* src_reg = atomic_xchg(dst_reg + off16, src_reg); */ 664 case BPF_XCHG: 665 ctx->ex_insn_off = ctx->ninsns; 666 emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) : 667 rv_amoswap_w(rs, rs, rd, 1, 1), ctx); 668 ctx->ex_jmp_off = ctx->ninsns; 669 if (!is64) 670 emit_zextw(rs, rs, ctx); 671 break; 672 /* r0 = atomic_cmpxchg(dst_reg + off16, r0, src_reg); */ 673 case BPF_CMPXCHG: 674 emit_cmpxchg(rd, rs, regmap[BPF_REG_0], is64, ctx); 675 break; 676 default: 677 pr_err_once("bpf-jit: invalid atomic RMW opcode %02x\n", imm); 678 return -EINVAL; 679 } 680 681 return 0; 682 } 683 684 /* 685 * Sign-extend the register if necessary 686 */ 687 static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) 688 { 689 if (!sign && (sz == 1 || sz == 2)) { 690 if (rd != rs) 691 emit_mv(rd, rs, ctx); 692 return 0; 693 } 694 695 switch (sz) { 696 case 1: 697 emit_sextb(rd, rs, ctx); 698 break; 699 case 2: 700 emit_sexth(rd, rs, ctx); 701 break; 702 case 4: 703 emit_sextw(rd, rs, ctx); 704 break; 705 case 8: 706 if (rd != rs) 707 emit_mv(rd, rs, ctx); 708 break; 709 default: 710 pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); 711 return -EINVAL; 712 } 713 714 return 0; 715 } 716 717 #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) 718 #define BPF_FIXUP_REG_MASK GENMASK(31, 27) 719 #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */ 720 721 bool ex_handler_bpf(const struct exception_table_entry *ex, 722 struct pt_regs *regs) 723 { 724 off_t offset = FIELD_GET(BPF_FIXUP_OFFSET_MASK, ex->fixup); 725 int regs_offset = FIELD_GET(BPF_FIXUP_REG_MASK, ex->fixup); 726 727 if (regs_offset != REG_DONT_CLEAR_MARKER) 728 *(unsigned long *)((void *)regs + pt_regmap[regs_offset]) = 0; 729 regs->epc = (unsigned long)&ex->fixup - offset; 730 731 return true; 732 } 733 734 /* For accesses to BTF pointers, add an entry to the exception table */ 735 static int add_exception_handler(const struct bpf_insn *insn, int dst_reg, 736 struct rv_jit_context *ctx) 737 { 738 struct exception_table_entry *ex; 739 unsigned long pc; 740 off_t ins_offset; 741 off_t fixup_offset; 742 743 if (!ctx->insns || !ctx->ro_insns || !ctx->prog->aux->extable || 744 ctx->ex_insn_off <= 0 || ctx->ex_jmp_off <= 0) 745 return 0; 746 747 if (BPF_MODE(insn->code) != BPF_PROBE_MEM && 748 BPF_MODE(insn->code) != BPF_PROBE_MEMSX && 749 BPF_MODE(insn->code) != BPF_PROBE_MEM32 && 750 BPF_MODE(insn->code) != BPF_PROBE_ATOMIC) 751 return 0; 752 753 if (WARN_ON_ONCE(ctx->nexentries >= ctx->prog->aux->num_exentries)) 754 return -EINVAL; 755 756 if (WARN_ON_ONCE(ctx->ex_insn_off > ctx->ninsns || ctx->ex_jmp_off > ctx->ninsns)) 757 return -EINVAL; 758 759 ex = &ctx->prog->aux->extable[ctx->nexentries]; 760 pc = (unsigned long)&ctx->ro_insns[ctx->ex_insn_off]; 761 762 /* 763 * This is the relative offset of the instruction that may fault from 764 * the exception table itself. This will be written to the exception 765 * table and if this instruction faults, the destination register will 766 * be set to '0' and the execution will jump to the next instruction. 767 */ 768 ins_offset = pc - (long)&ex->insn; 769 if (WARN_ON_ONCE(ins_offset >= 0 || ins_offset < INT_MIN)) 770 return -ERANGE; 771 772 /* 773 * Since the extable follows the program, the fixup offset is always 774 * negative and limited to BPF_JIT_REGION_SIZE. Store a positive value 775 * to keep things simple, and put the destination register in the upper 776 * bits. We don't need to worry about buildtime or runtime sort 777 * modifying the upper bits because the table is already sorted, and 778 * isn't part of the main exception table. 779 * 780 * The fixup_offset is set to the next instruction from the instruction 781 * that may fault. The execution will jump to this after handling the 782 * fault. 783 */ 784 fixup_offset = (long)&ex->fixup - (long)&ctx->ro_insns[ctx->ex_jmp_off]; 785 if (!FIELD_FIT(BPF_FIXUP_OFFSET_MASK, fixup_offset)) 786 return -ERANGE; 787 788 /* 789 * The offsets above have been calculated using the RO buffer but we 790 * need to use the R/W buffer for writes. 791 * switch ex to rw buffer for writing. 792 */ 793 ex = (void *)ctx->insns + ((void *)ex - (void *)ctx->ro_insns); 794 795 ex->insn = ins_offset; 796 797 ex->fixup = FIELD_PREP(BPF_FIXUP_OFFSET_MASK, fixup_offset) | 798 FIELD_PREP(BPF_FIXUP_REG_MASK, dst_reg); 799 ex->type = EX_TYPE_BPF; 800 801 ctx->ex_insn_off = 0; 802 ctx->ex_jmp_off = 0; 803 ctx->nexentries++; 804 return 0; 805 } 806 807 static int gen_jump_or_nops(void *target, void *ip, u32 *insns, bool is_call) 808 { 809 s64 rvoff; 810 struct rv_jit_context ctx; 811 812 ctx.ninsns = 0; 813 ctx.insns = (u16 *)insns; 814 815 if (!target) { 816 emit(rv_nop(), &ctx); 817 emit(rv_nop(), &ctx); 818 return 0; 819 } 820 821 rvoff = (s64)(target - ip); 822 return emit_jump_and_link(is_call ? RV_REG_T0 : RV_REG_ZERO, rvoff, false, &ctx); 823 } 824 825 int arch_bpf_trampoline_skip(void *nop, void *target) 826 { 827 u32 old_insn = rv_nop(); 828 u32 new_insn = rv_jal(RV_REG_ZERO, (target - nop) >> 1); 829 int ret; 830 831 if (memcmp(nop, &old_insn, sizeof(old_insn))) 832 return -EFAULT; 833 834 cpus_read_lock(); 835 mutex_lock(&text_mutex); 836 ret = patch_text(nop, &new_insn, sizeof(new_insn)); 837 mutex_unlock(&text_mutex); 838 cpus_read_unlock(); 839 840 return ret; 841 } 842 843 int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t, 844 enum bpf_text_poke_type new_t, void *old_addr, 845 void *new_addr) 846 { 847 u32 old_insns[RV_FENTRY_NINSNS], new_insns[RV_FENTRY_NINSNS]; 848 bool is_call; 849 int ret; 850 851 if (!is_kernel_text((unsigned long)ip) && 852 !is_bpf_text_address((unsigned long)ip)) 853 return -ENOTSUPP; 854 855 is_call = old_t == BPF_MOD_CALL; 856 ret = gen_jump_or_nops(old_addr, ip, old_insns, is_call); 857 if (ret) 858 return ret; 859 860 if (memcmp(ip, old_insns, RV_FENTRY_NBYTES)) 861 return -EFAULT; 862 863 is_call = new_t == BPF_MOD_CALL; 864 ret = gen_jump_or_nops(new_addr, ip, new_insns, is_call); 865 if (ret) 866 return ret; 867 868 cpus_read_lock(); 869 mutex_lock(&text_mutex); 870 if (memcmp(ip, new_insns, RV_FENTRY_NBYTES)) 871 ret = patch_text(ip, new_insns, RV_FENTRY_NBYTES); 872 mutex_unlock(&text_mutex); 873 cpus_read_unlock(); 874 875 return ret; 876 } 877 878 static void store_args(int nr_arg_slots, int args_off, struct rv_jit_context *ctx) 879 { 880 int i; 881 882 for (i = 0; i < nr_arg_slots; i++) { 883 if (i < RV_MAX_REG_ARGS) { 884 emit_sd(RV_REG_FP, -args_off, RV_REG_A0 + i, ctx); 885 } else { 886 /* skip slots for T0 and FP of traced function */ 887 emit_ld(RV_REG_T1, 16 + (i - RV_MAX_REG_ARGS) * 8, RV_REG_FP, ctx); 888 emit_sd(RV_REG_FP, -args_off, RV_REG_T1, ctx); 889 } 890 args_off -= 8; 891 } 892 } 893 894 static void restore_args(int nr_reg_args, int args_off, struct rv_jit_context *ctx) 895 { 896 int i; 897 898 for (i = 0; i < nr_reg_args; i++) { 899 emit_ld(RV_REG_A0 + i, -args_off, RV_REG_FP, ctx); 900 args_off -= 8; 901 } 902 } 903 904 static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off, 905 struct rv_jit_context *ctx) 906 { 907 int i; 908 909 for (i = 0; i < nr_stack_args; i++) { 910 emit_ld(RV_REG_T1, -(args_off - RV_MAX_REG_ARGS * 8), RV_REG_FP, ctx); 911 emit_sd(RV_REG_FP, -stk_arg_off, RV_REG_T1, ctx); 912 args_off -= 8; 913 stk_arg_off -= 8; 914 } 915 } 916 917 static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64, 918 struct rv_jit_context *ctx) 919 { 920 /* Load imm64 into reg and store it at [FP + stack_off]. */ 921 emit_imm(reg, (s64)imm64, ctx); 922 emit_sd(RV_REG_FP, stack_off, reg, ctx); 923 } 924 925 static int invoke_bpf_prog(struct bpf_tramp_image *im, struct bpf_tramp_node *node, 926 int args_off, int retval_off, int run_ctx_off, bool save_ret, 927 struct rv_jit_context *ctx) 928 { 929 int ret, branch_off; 930 struct bpf_prog *p = node->link->prog; 931 int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie); 932 void *skip = ctx->ro_insns + ctx->ninsns; 933 934 /* nop, patched to a jal over this prog when it is detached */ 935 emit(rv_nop(), ctx); 936 937 if (node->cookie) 938 emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, node->cookie, ctx); 939 else 940 emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx); 941 942 /* arg1: prog */ 943 emit_imm(RV_REG_A0, (const s64)p, ctx); 944 /* arg2: &run_ctx */ 945 emit_addi(RV_REG_A1, RV_REG_FP, -run_ctx_off, ctx); 946 ret = emit_call((const u64)bpf_trampoline_enter(p), true, ctx); 947 if (ret) 948 return ret; 949 950 /* store prog start time */ 951 emit_mv(RV_REG_S1, RV_REG_A0, ctx); 952 953 /* if (__bpf_prog_enter(prog) == 0) 954 * goto skip_exec_of_prog; 955 */ 956 branch_off = ctx->ninsns; 957 /* nop reserved for conditional jump */ 958 emit(rv_nop(), ctx); 959 960 /* arg1: &args_off */ 961 emit_addi(RV_REG_A0, RV_REG_FP, -args_off, ctx); 962 if (!p->jited) 963 /* arg2: progs[i]->insnsi for interpreter */ 964 emit_imm(RV_REG_A1, (const s64)p->insnsi, ctx); 965 ret = emit_call((const u64)p->bpf_func, true, ctx); 966 if (ret) 967 return ret; 968 969 if (save_ret) { 970 emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx); 971 emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx); 972 } 973 974 /* update branch with beqz */ 975 if (ctx->insns) { 976 int offset = ninsns_rvoff(ctx->ninsns - branch_off); 977 u32 insn = rv_beq(RV_REG_A0, RV_REG_ZERO, offset >> 1); 978 *(u32 *)(ctx->insns + branch_off) = insn; 979 } 980 981 /* arg1: prog */ 982 emit_imm(RV_REG_A0, (const s64)p, ctx); 983 /* arg2: prog start time */ 984 emit_mv(RV_REG_A1, RV_REG_S1, ctx); 985 /* arg3: &run_ctx */ 986 emit_addi(RV_REG_A2, RV_REG_FP, -run_ctx_off, ctx); 987 ret = emit_call((const u64)bpf_trampoline_exit(p), true, ctx); 988 if (ret) 989 return ret; 990 991 bpf_tramp_image_add_skip(im, p, skip, ctx->ro_insns + ctx->ninsns); 992 return 0; 993 } 994 995 static int invoke_bpf(struct bpf_tramp_image *im, struct bpf_tramp_nodes *tn, 996 int args_off, int retval_off, int run_ctx_off, int func_meta_off, 997 bool save_ret, u64 func_meta, int cookie_off, 998 struct rv_jit_context *ctx) 999 { 1000 int i, cur_cookie = (cookie_off - args_off) / 8; 1001 1002 for (i = 0; i < tn->nr_nodes; i++) { 1003 int err; 1004 1005 if (bpf_prog_calls_session_cookie(tn->nodes[i])) { 1006 u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT); 1007 1008 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx); 1009 cur_cookie--; 1010 } 1011 err = invoke_bpf_prog(im, tn->nodes[i], args_off, retval_off, 1012 run_ctx_off, save_ret, ctx); 1013 if (err) 1014 return err; 1015 } 1016 return 0; 1017 } 1018 1019 static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 1020 const struct btf_func_model *m, 1021 struct bpf_tramp_nodes *tnodes, 1022 void *func_addr, u32 flags, 1023 struct rv_jit_context *ctx) 1024 { 1025 int i, ret, offset; 1026 int *branches_off = NULL; 1027 int stack_size = 0, nr_arg_slots = 0; 1028 int retval_off, args_off, func_meta_off, ip_off; 1029 int run_ctx_off, sreg_off, stk_arg_off, tcc_off; 1030 int cookie_off, cookie_cnt; 1031 struct bpf_tramp_nodes *fentry = &tnodes[BPF_TRAMP_FENTRY]; 1032 struct bpf_tramp_nodes *fexit = &tnodes[BPF_TRAMP_FEXIT]; 1033 struct bpf_tramp_nodes *fmod_ret = &tnodes[BPF_TRAMP_MODIFY_RETURN]; 1034 bool is_struct_ops = is_struct_ops_tramp(fentry); 1035 void *orig_call = func_addr; 1036 bool save_ret; 1037 u64 func_meta; 1038 u32 insn; 1039 1040 /* Two types of generated trampoline stack layout: 1041 * 1042 * 1. trampoline called from function entry 1043 * -------------------------------------- 1044 * FP + 8 [ RA to parent func ] return address to parent 1045 * function 1046 * FP + 0 [ FP of parent func ] frame pointer of parent 1047 * function 1048 * FP - 8 [ T0 to traced func ] return address of traced 1049 * function 1050 * FP - 16 [ FP of traced func ] frame pointer of traced 1051 * function 1052 * -------------------------------------- 1053 * 1054 * 2. trampoline called directly 1055 * -------------------------------------- 1056 * FP - 8 [ RA to caller func ] return address to caller 1057 * function 1058 * FP - 16 [ FP of caller func ] frame pointer of caller 1059 * function 1060 * -------------------------------------- 1061 * 1062 * FP - retval_off [ return value ] BPF_TRAMP_F_CALL_ORIG or 1063 * BPF_TRAMP_F_RET_FENTRY_RET 1064 * [ argN ] 1065 * [ ... ] 1066 * FP - args_off [ arg1 ] 1067 * 1068 * FP - func_meta_off [ regs count, etc ] 1069 * 1070 * FP - ip_off [ traced func ] BPF_TRAMP_F_IP_ARG 1071 * 1072 * [ stack cookie N ] 1073 * [ ... ] 1074 * FP - cookie_off [ stack cookie 1 ] 1075 * 1076 * FP - run_ctx_off [ bpf_tramp_run_ctx ] 1077 * 1078 * FP - sreg_off [ callee saved reg ] 1079 * 1080 * FP - tcc_off [ tail call count ] BPF_TRAMP_F_TAIL_CALL_CTX 1081 * 1082 * [ pads ] pads for 16 bytes alignment 1083 * 1084 * [ stack_argN ] 1085 * [ ... ] 1086 * FP - stk_arg_off [ stack_arg1 ] BPF_TRAMP_F_CALL_ORIG 1087 */ 1088 1089 if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY)) 1090 return -ENOTSUPP; 1091 1092 if (m->nr_args > MAX_BPF_FUNC_ARGS) 1093 return -ENOTSUPP; 1094 1095 for (i = 0; i < m->nr_args; i++) 1096 nr_arg_slots += round_up(m->arg_size[i], 8) / 8; 1097 1098 /* room of trampoline frame to store return address and frame pointer */ 1099 stack_size += 16; 1100 1101 save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET); 1102 if (save_ret) 1103 stack_size += 16; /* Save both A5 (BPF R0) and A0 */ 1104 retval_off = stack_size; 1105 1106 stack_size += nr_arg_slots * 8; 1107 args_off = stack_size; 1108 1109 /* function metadata, such as regs count */ 1110 stack_size += 8; 1111 func_meta_off = stack_size; 1112 1113 if (flags & BPF_TRAMP_F_IP_ARG) { 1114 stack_size += 8; 1115 ip_off = stack_size; 1116 } 1117 1118 cookie_cnt = bpf_fsession_cookie_cnt(tnodes); 1119 /* room for session cookies */ 1120 stack_size += cookie_cnt * 8; 1121 cookie_off = stack_size; 1122 1123 stack_size += round_up(sizeof(struct bpf_tramp_run_ctx), 8); 1124 run_ctx_off = stack_size; 1125 1126 stack_size += 8; 1127 sreg_off = stack_size; 1128 1129 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) { 1130 stack_size += 8; 1131 tcc_off = stack_size; 1132 } 1133 1134 if ((flags & BPF_TRAMP_F_CALL_ORIG) && (nr_arg_slots - RV_MAX_REG_ARGS > 0)) 1135 stack_size += (nr_arg_slots - RV_MAX_REG_ARGS) * 8; 1136 1137 stack_size = round_up(stack_size, STACK_ALIGN); 1138 1139 /* room for args on stack must be at the top of stack */ 1140 stk_arg_off = stack_size; 1141 1142 if (!is_struct_ops) { 1143 /* For the trampoline called from function entry, 1144 * the frame of traced function and the frame of 1145 * trampoline need to be considered. 1146 */ 1147 emit_addi(RV_REG_SP, RV_REG_SP, -16, ctx); 1148 emit_sd(RV_REG_SP, 8, RV_REG_RA, ctx); 1149 emit_sd(RV_REG_SP, 0, RV_REG_FP, ctx); 1150 emit_addi(RV_REG_FP, RV_REG_SP, 16, ctx); 1151 1152 emit_addi(RV_REG_SP, RV_REG_SP, -stack_size, ctx); 1153 emit_sd(RV_REG_SP, stack_size - 8, RV_REG_T0, ctx); 1154 emit_sd(RV_REG_SP, stack_size - 16, RV_REG_FP, ctx); 1155 emit_addi(RV_REG_FP, RV_REG_SP, stack_size, ctx); 1156 } else { 1157 /* emit kcfi hash */ 1158 emit_kcfi(cfi_get_func_hash(func_addr), ctx); 1159 /* For the trampoline called directly, just handle 1160 * the frame of trampoline. 1161 */ 1162 emit_addi(RV_REG_SP, RV_REG_SP, -stack_size, ctx); 1163 emit_sd(RV_REG_SP, stack_size - 8, RV_REG_RA, ctx); 1164 emit_sd(RV_REG_SP, stack_size - 16, RV_REG_FP, ctx); 1165 emit_addi(RV_REG_FP, RV_REG_SP, stack_size, ctx); 1166 } 1167 1168 /* store tail call count */ 1169 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1170 emit_sd(RV_REG_FP, -tcc_off, RV_REG_TCC, ctx); 1171 1172 /* callee saved register S1 to pass start time */ 1173 emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx); 1174 1175 /* store ip address of the traced function */ 1176 if (flags & BPF_TRAMP_F_IP_ARG) 1177 emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx); 1178 1179 func_meta = nr_arg_slots; 1180 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx); 1181 1182 store_args(nr_arg_slots, args_off, ctx); 1183 1184 if (bpf_fsession_cnt(tnodes)) { 1185 /* clear all session cookies' value */ 1186 for (i = 0; i < cookie_cnt; i++) 1187 emit_sd(RV_REG_FP, -cookie_off + 8 * i, RV_REG_ZERO, ctx); 1188 /* clear return value to make sure fentry always get 0 */ 1189 emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx); 1190 } 1191 1192 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1193 emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); 1194 ret = emit_call((const u64)__bpf_tramp_enter, true, ctx); 1195 if (ret) 1196 return ret; 1197 } 1198 1199 if (fentry->nr_nodes) { 1200 ret = invoke_bpf(im, fentry, args_off, retval_off, run_ctx_off, func_meta_off, 1201 flags & BPF_TRAMP_F_RET_FENTRY_RET, func_meta, cookie_off, ctx); 1202 if (ret) 1203 return ret; 1204 } 1205 1206 if (fmod_ret->nr_nodes) { 1207 branches_off = kvzalloc_objs(int, fmod_ret->nr_nodes); 1208 if (!branches_off) 1209 return -ENOMEM; 1210 1211 /* cleanup to avoid garbage return value confusion */ 1212 emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx); 1213 for (i = 0; i < fmod_ret->nr_nodes; i++) { 1214 ret = invoke_bpf_prog(im, fmod_ret->nodes[i], args_off, retval_off, 1215 run_ctx_off, true, ctx); 1216 if (ret) 1217 goto out; 1218 emit_ld(RV_REG_T1, -retval_off, RV_REG_FP, ctx); 1219 branches_off[i] = ctx->ninsns; 1220 /* nop reserved for conditional jump */ 1221 emit(rv_nop(), ctx); 1222 } 1223 } 1224 1225 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1226 /* skip to actual body of traced function */ 1227 orig_call += RV_FENTRY_NINSNS * 4; 1228 restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); 1229 restore_stack_args(nr_arg_slots - RV_MAX_REG_ARGS, args_off, stk_arg_off, ctx); 1230 /* restore TCC to RV_REG_TCC before calling the orig bpf func */ 1231 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1232 emit_ld(RV_REG_TCC, -tcc_off, RV_REG_FP, ctx); 1233 ret = emit_call((const u64)orig_call, true, ctx); 1234 if (ret) 1235 goto out; 1236 /* store updated TCC back to stack after calling the orig bpf func */ 1237 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1238 emit_sd(RV_REG_FP, -tcc_off, RV_REG_TCC, ctx); 1239 emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx); 1240 emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx); 1241 } 1242 1243 /* update branches saved in invoke_bpf_mod_ret with bnez */ 1244 for (i = 0; ctx->insns && i < fmod_ret->nr_nodes; i++) { 1245 offset = ninsns_rvoff(ctx->ninsns - branches_off[i]); 1246 insn = rv_bne(RV_REG_T1, RV_REG_ZERO, offset >> 1); 1247 *(u32 *)(ctx->insns + branches_off[i]) = insn; 1248 } 1249 1250 /* set "is_return" flag for fsession */ 1251 func_meta |= (1ULL << BPF_TRAMP_IS_RETURN_SHIFT); 1252 if (bpf_fsession_cnt(tnodes)) 1253 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx); 1254 1255 if (fexit->nr_nodes) { 1256 ret = invoke_bpf(im, fexit, args_off, retval_off, run_ctx_off, func_meta_off, 1257 false, func_meta, cookie_off, ctx); 1258 if (ret) 1259 goto out; 1260 } 1261 1262 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1263 emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); 1264 ret = emit_call((const u64)__bpf_tramp_exit, true, ctx); 1265 if (ret) 1266 goto out; 1267 } 1268 1269 if (flags & BPF_TRAMP_F_RESTORE_REGS) 1270 restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); 1271 1272 if (save_ret) { 1273 emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); 1274 if (is_struct_ops) { 1275 ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, 1276 m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); 1277 if (ret) 1278 goto out; 1279 } else { 1280 emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); 1281 } 1282 } 1283 1284 emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); 1285 1286 /* restore TCC from stack to RV_REG_TCC */ 1287 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1288 emit_ld(RV_REG_TCC, -tcc_off, RV_REG_FP, ctx); 1289 1290 if (!is_struct_ops) { 1291 /* trampoline called from function entry */ 1292 emit_ld(RV_REG_T0, stack_size - 8, RV_REG_SP, ctx); 1293 emit_ld(RV_REG_FP, stack_size - 16, RV_REG_SP, ctx); 1294 emit_addi(RV_REG_SP, RV_REG_SP, stack_size, ctx); 1295 1296 emit_ld(RV_REG_RA, 8, RV_REG_SP, ctx); 1297 emit_ld(RV_REG_FP, 0, RV_REG_SP, ctx); 1298 emit_addi(RV_REG_SP, RV_REG_SP, 16, ctx); 1299 1300 if (flags & BPF_TRAMP_F_SKIP_FRAME) 1301 /* return to parent function */ 1302 emit_jalr(RV_REG_ZERO, RV_REG_RA, 0, ctx); 1303 else 1304 /* return to traced function */ 1305 emit_jalr(RV_REG_ZERO, RV_REG_T0, 0, ctx); 1306 } else { 1307 /* trampoline called directly */ 1308 emit_ld(RV_REG_RA, stack_size - 8, RV_REG_SP, ctx); 1309 emit_ld(RV_REG_FP, stack_size - 16, RV_REG_SP, ctx); 1310 emit_addi(RV_REG_SP, RV_REG_SP, stack_size, ctx); 1311 1312 emit_jalr(RV_REG_ZERO, RV_REG_RA, 0, ctx); 1313 } 1314 1315 ret = ctx->ninsns; 1316 out: 1317 kvfree(branches_off); 1318 return ret; 1319 } 1320 1321 int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags, 1322 struct bpf_tramp_nodes *tnodes, void *func_addr) 1323 { 1324 struct bpf_tramp_image im = {}; 1325 struct rv_jit_context ctx; 1326 int ret; 1327 1328 ctx.ninsns = 0; 1329 ctx.insns = NULL; 1330 ctx.ro_insns = NULL; 1331 ret = __arch_prepare_bpf_trampoline(&im, m, tnodes, func_addr, flags, &ctx); 1332 1333 return ret < 0 ? ret : ninsns_rvoff(ctx.ninsns); 1334 } 1335 1336 void *arch_alloc_bpf_trampoline(unsigned int size) 1337 { 1338 return bpf_prog_pack_alloc(size, bpf_fill_ill_insns, false); 1339 } 1340 1341 void arch_free_bpf_trampoline(void *image, unsigned int size) 1342 { 1343 bpf_prog_pack_free(image, size); 1344 } 1345 1346 int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *ro_image, 1347 void *ro_image_end, const struct btf_func_model *m, 1348 u32 flags, struct bpf_tramp_nodes *tnodes, 1349 void *func_addr) 1350 { 1351 int ret; 1352 void *image, *res; 1353 struct rv_jit_context ctx; 1354 u32 size = ro_image_end - ro_image; 1355 1356 image = kvmalloc(size, GFP_KERNEL); 1357 if (!image) 1358 return -ENOMEM; 1359 1360 ctx.ninsns = 0; 1361 ctx.insns = image; 1362 ctx.ro_insns = ro_image; 1363 ret = __arch_prepare_bpf_trampoline(im, m, tnodes, func_addr, flags, &ctx); 1364 if (ret < 0) 1365 goto out; 1366 1367 if (WARN_ON(size < ninsns_rvoff(ctx.ninsns))) { 1368 ret = -E2BIG; 1369 goto out; 1370 } 1371 1372 res = bpf_arch_text_copy(ro_image, image, size); 1373 if (IS_ERR(res)) { 1374 ret = PTR_ERR(res); 1375 goto out; 1376 } 1377 1378 out: 1379 kvfree(image); 1380 return ret < 0 ? ret : size; 1381 } 1382 1383 int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx, 1384 bool extra_pass) 1385 { 1386 bool is64 = BPF_CLASS(insn->code) == BPF_ALU64 || 1387 BPF_CLASS(insn->code) == BPF_JMP; 1388 int s, e, rvoff, ret, i = insn - ctx->prog->insnsi; 1389 struct bpf_prog_aux *aux = ctx->prog->aux; 1390 u8 rd = -1, rs = -1, code = insn->code; 1391 s16 off = insn->off; 1392 s32 imm = insn->imm; 1393 1394 init_regs(&rd, &rs, insn, ctx); 1395 1396 switch (code) { 1397 /* dst = src */ 1398 case BPF_ALU | BPF_MOV | BPF_X: 1399 case BPF_ALU64 | BPF_MOV | BPF_X: 1400 if (insn_is_cast_user(insn)) { 1401 emit_mv(RV_REG_T1, rs, ctx); 1402 emit_zextw(RV_REG_T1, RV_REG_T1, ctx); 1403 emit_imm(rd, (ctx->user_vm_start >> 32) << 32, ctx); 1404 emit(rv_beq(RV_REG_T1, RV_REG_ZERO, 4), ctx); 1405 emit_or(RV_REG_T1, rd, RV_REG_T1, ctx); 1406 emit_mv(rd, RV_REG_T1, ctx); 1407 break; 1408 } else if (insn_is_mov_percpu_addr(insn)) { 1409 if (rd != rs) 1410 emit_mv(rd, rs, ctx); 1411 #ifdef CONFIG_SMP 1412 /* Load current CPU number in T1 */ 1413 emit_lw(RV_REG_T1, offsetof(struct thread_info, cpu), 1414 RV_REG_TP, ctx); 1415 /* Load address of __per_cpu_offset array in T2 */ 1416 emit_addr(RV_REG_T2, (u64)&__per_cpu_offset, extra_pass, ctx); 1417 /* Get address of __per_cpu_offset[cpu] in T1 */ 1418 emit_sh3add(RV_REG_T1, RV_REG_T1, RV_REG_T2, ctx); 1419 /* Load __per_cpu_offset[cpu] in T1 */ 1420 emit_ld(RV_REG_T1, 0, RV_REG_T1, ctx); 1421 /* Add the offset to Rd */ 1422 emit_add(rd, rd, RV_REG_T1, ctx); 1423 #endif 1424 } 1425 if (imm == 1) { 1426 /* Special mov32 for zext */ 1427 emit_zextw(rd, rd, ctx); 1428 break; 1429 } 1430 switch (insn->off) { 1431 case 0: 1432 emit_mv(rd, rs, ctx); 1433 break; 1434 case 8: 1435 emit_sextb(rd, rs, ctx); 1436 break; 1437 case 16: 1438 emit_sexth(rd, rs, ctx); 1439 break; 1440 case 32: 1441 emit_sextw(rd, rs, ctx); 1442 break; 1443 } 1444 if (!is64 && !aux->verifier_zext) 1445 emit_zextw(rd, rd, ctx); 1446 break; 1447 1448 /* dst = dst OP src */ 1449 case BPF_ALU | BPF_ADD | BPF_X: 1450 case BPF_ALU64 | BPF_ADD | BPF_X: 1451 emit_add(rd, rd, rs, ctx); 1452 if (!is64 && !aux->verifier_zext) 1453 emit_zextw(rd, rd, ctx); 1454 break; 1455 case BPF_ALU | BPF_SUB | BPF_X: 1456 case BPF_ALU64 | BPF_SUB | BPF_X: 1457 if (is64) 1458 emit_sub(rd, rd, rs, ctx); 1459 else 1460 emit_subw(rd, rd, rs, ctx); 1461 1462 if (!is64 && !aux->verifier_zext) 1463 emit_zextw(rd, rd, ctx); 1464 break; 1465 case BPF_ALU | BPF_AND | BPF_X: 1466 case BPF_ALU64 | BPF_AND | BPF_X: 1467 emit_and(rd, rd, rs, ctx); 1468 if (!is64 && !aux->verifier_zext) 1469 emit_zextw(rd, rd, ctx); 1470 break; 1471 case BPF_ALU | BPF_OR | BPF_X: 1472 case BPF_ALU64 | BPF_OR | BPF_X: 1473 emit_or(rd, rd, rs, ctx); 1474 if (!is64 && !aux->verifier_zext) 1475 emit_zextw(rd, rd, ctx); 1476 break; 1477 case BPF_ALU | BPF_XOR | BPF_X: 1478 case BPF_ALU64 | BPF_XOR | BPF_X: 1479 emit_xor(rd, rd, rs, ctx); 1480 if (!is64 && !aux->verifier_zext) 1481 emit_zextw(rd, rd, ctx); 1482 break; 1483 case BPF_ALU | BPF_MUL | BPF_X: 1484 case BPF_ALU64 | BPF_MUL | BPF_X: 1485 emit(is64 ? rv_mul(rd, rd, rs) : rv_mulw(rd, rd, rs), ctx); 1486 if (!is64 && !aux->verifier_zext) 1487 emit_zextw(rd, rd, ctx); 1488 break; 1489 case BPF_ALU | BPF_DIV | BPF_X: 1490 case BPF_ALU64 | BPF_DIV | BPF_X: 1491 if (off) 1492 emit(is64 ? rv_div(rd, rd, rs) : rv_divw(rd, rd, rs), ctx); 1493 else 1494 emit(is64 ? rv_divu(rd, rd, rs) : rv_divuw(rd, rd, rs), ctx); 1495 if (!is64 && !aux->verifier_zext) 1496 emit_zextw(rd, rd, ctx); 1497 break; 1498 case BPF_ALU | BPF_MOD | BPF_X: 1499 case BPF_ALU64 | BPF_MOD | BPF_X: 1500 if (off) 1501 emit(is64 ? rv_rem(rd, rd, rs) : rv_remw(rd, rd, rs), ctx); 1502 else 1503 emit(is64 ? rv_remu(rd, rd, rs) : rv_remuw(rd, rd, rs), ctx); 1504 if (!is64 && !aux->verifier_zext) 1505 emit_zextw(rd, rd, ctx); 1506 break; 1507 case BPF_ALU | BPF_LSH | BPF_X: 1508 case BPF_ALU64 | BPF_LSH | BPF_X: 1509 emit(is64 ? rv_sll(rd, rd, rs) : rv_sllw(rd, rd, rs), ctx); 1510 if (!is64 && !aux->verifier_zext) 1511 emit_zextw(rd, rd, ctx); 1512 break; 1513 case BPF_ALU | BPF_RSH | BPF_X: 1514 case BPF_ALU64 | BPF_RSH | BPF_X: 1515 emit(is64 ? rv_srl(rd, rd, rs) : rv_srlw(rd, rd, rs), ctx); 1516 if (!is64 && !aux->verifier_zext) 1517 emit_zextw(rd, rd, ctx); 1518 break; 1519 case BPF_ALU | BPF_ARSH | BPF_X: 1520 case BPF_ALU64 | BPF_ARSH | BPF_X: 1521 emit(is64 ? rv_sra(rd, rd, rs) : rv_sraw(rd, rd, rs), ctx); 1522 if (!is64 && !aux->verifier_zext) 1523 emit_zextw(rd, rd, ctx); 1524 break; 1525 1526 /* dst = -dst */ 1527 case BPF_ALU | BPF_NEG: 1528 case BPF_ALU64 | BPF_NEG: 1529 emit_sub(rd, RV_REG_ZERO, rd, ctx); 1530 if (!is64 && !aux->verifier_zext) 1531 emit_zextw(rd, rd, ctx); 1532 break; 1533 1534 /* dst = BSWAP##imm(dst) */ 1535 case BPF_ALU | BPF_END | BPF_FROM_LE: 1536 switch (imm) { 1537 case 16: 1538 emit_zexth(rd, rd, ctx); 1539 break; 1540 case 32: 1541 if (!aux->verifier_zext) 1542 emit_zextw(rd, rd, ctx); 1543 break; 1544 case 64: 1545 /* Do nothing */ 1546 break; 1547 } 1548 break; 1549 case BPF_ALU | BPF_END | BPF_FROM_BE: 1550 case BPF_ALU64 | BPF_END | BPF_FROM_LE: 1551 emit_bswap(rd, imm, ctx); 1552 break; 1553 1554 /* dst = imm */ 1555 case BPF_ALU | BPF_MOV | BPF_K: 1556 case BPF_ALU64 | BPF_MOV | BPF_K: 1557 emit_imm(rd, imm, ctx); 1558 if (!is64 && !aux->verifier_zext) 1559 emit_zextw(rd, rd, ctx); 1560 break; 1561 1562 /* dst = dst OP imm */ 1563 case BPF_ALU | BPF_ADD | BPF_K: 1564 case BPF_ALU64 | BPF_ADD | BPF_K: 1565 if (is_12b_int(imm)) { 1566 emit_addi(rd, rd, imm, ctx); 1567 } else { 1568 emit_imm(RV_REG_T1, imm, ctx); 1569 emit_add(rd, rd, RV_REG_T1, ctx); 1570 } 1571 if (!is64 && !aux->verifier_zext) 1572 emit_zextw(rd, rd, ctx); 1573 break; 1574 case BPF_ALU | BPF_SUB | BPF_K: 1575 case BPF_ALU64 | BPF_SUB | BPF_K: 1576 if (is_12b_int(-imm)) { 1577 emit_addi(rd, rd, -imm, ctx); 1578 } else { 1579 emit_imm(RV_REG_T1, imm, ctx); 1580 emit_sub(rd, rd, RV_REG_T1, ctx); 1581 } 1582 if (!is64 && !aux->verifier_zext) 1583 emit_zextw(rd, rd, ctx); 1584 break; 1585 case BPF_ALU | BPF_AND | BPF_K: 1586 case BPF_ALU64 | BPF_AND | BPF_K: 1587 if (is_12b_int(imm)) { 1588 emit_andi(rd, rd, imm, ctx); 1589 } else { 1590 emit_imm(RV_REG_T1, imm, ctx); 1591 emit_and(rd, rd, RV_REG_T1, ctx); 1592 } 1593 if (!is64 && !aux->verifier_zext) 1594 emit_zextw(rd, rd, ctx); 1595 break; 1596 case BPF_ALU | BPF_OR | BPF_K: 1597 case BPF_ALU64 | BPF_OR | BPF_K: 1598 if (is_12b_int(imm)) { 1599 emit(rv_ori(rd, rd, imm), ctx); 1600 } else { 1601 emit_imm(RV_REG_T1, imm, ctx); 1602 emit_or(rd, rd, RV_REG_T1, ctx); 1603 } 1604 if (!is64 && !aux->verifier_zext) 1605 emit_zextw(rd, rd, ctx); 1606 break; 1607 case BPF_ALU | BPF_XOR | BPF_K: 1608 case BPF_ALU64 | BPF_XOR | BPF_K: 1609 if (is_12b_int(imm)) { 1610 emit(rv_xori(rd, rd, imm), ctx); 1611 } else { 1612 emit_imm(RV_REG_T1, imm, ctx); 1613 emit_xor(rd, rd, RV_REG_T1, ctx); 1614 } 1615 if (!is64 && !aux->verifier_zext) 1616 emit_zextw(rd, rd, ctx); 1617 break; 1618 case BPF_ALU | BPF_MUL | BPF_K: 1619 case BPF_ALU64 | BPF_MUL | BPF_K: 1620 emit_imm(RV_REG_T1, imm, ctx); 1621 emit(is64 ? rv_mul(rd, rd, RV_REG_T1) : 1622 rv_mulw(rd, rd, RV_REG_T1), ctx); 1623 if (!is64 && !aux->verifier_zext) 1624 emit_zextw(rd, rd, ctx); 1625 break; 1626 case BPF_ALU | BPF_DIV | BPF_K: 1627 case BPF_ALU64 | BPF_DIV | BPF_K: 1628 emit_imm(RV_REG_T1, imm, ctx); 1629 if (off) 1630 emit(is64 ? rv_div(rd, rd, RV_REG_T1) : 1631 rv_divw(rd, rd, RV_REG_T1), ctx); 1632 else 1633 emit(is64 ? rv_divu(rd, rd, RV_REG_T1) : 1634 rv_divuw(rd, rd, RV_REG_T1), ctx); 1635 if (!is64 && !aux->verifier_zext) 1636 emit_zextw(rd, rd, ctx); 1637 break; 1638 case BPF_ALU | BPF_MOD | BPF_K: 1639 case BPF_ALU64 | BPF_MOD | BPF_K: 1640 emit_imm(RV_REG_T1, imm, ctx); 1641 if (off) 1642 emit(is64 ? rv_rem(rd, rd, RV_REG_T1) : 1643 rv_remw(rd, rd, RV_REG_T1), ctx); 1644 else 1645 emit(is64 ? rv_remu(rd, rd, RV_REG_T1) : 1646 rv_remuw(rd, rd, RV_REG_T1), ctx); 1647 if (!is64 && !aux->verifier_zext) 1648 emit_zextw(rd, rd, ctx); 1649 break; 1650 case BPF_ALU | BPF_LSH | BPF_K: 1651 case BPF_ALU64 | BPF_LSH | BPF_K: 1652 emit_slli(rd, rd, imm, ctx); 1653 1654 if (!is64 && !aux->verifier_zext) 1655 emit_zextw(rd, rd, ctx); 1656 break; 1657 case BPF_ALU | BPF_RSH | BPF_K: 1658 case BPF_ALU64 | BPF_RSH | BPF_K: 1659 if (is64) 1660 emit_srli(rd, rd, imm, ctx); 1661 else 1662 emit(rv_srliw(rd, rd, imm), ctx); 1663 1664 if (!is64 && !aux->verifier_zext) 1665 emit_zextw(rd, rd, ctx); 1666 break; 1667 case BPF_ALU | BPF_ARSH | BPF_K: 1668 case BPF_ALU64 | BPF_ARSH | BPF_K: 1669 if (is64) 1670 emit_srai(rd, rd, imm, ctx); 1671 else 1672 emit(rv_sraiw(rd, rd, imm), ctx); 1673 1674 if (!is64 && !aux->verifier_zext) 1675 emit_zextw(rd, rd, ctx); 1676 break; 1677 1678 /* JUMP off */ 1679 case BPF_JMP | BPF_JA: 1680 case BPF_JMP32 | BPF_JA: 1681 if (BPF_CLASS(code) == BPF_JMP) 1682 rvoff = rv_offset(i, off, ctx); 1683 else 1684 rvoff = rv_offset(i, imm, ctx); 1685 ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx); 1686 if (ret) 1687 return ret; 1688 break; 1689 1690 /* IF (dst COND src) JUMP off */ 1691 case BPF_JMP | BPF_JEQ | BPF_X: 1692 case BPF_JMP32 | BPF_JEQ | BPF_X: 1693 case BPF_JMP | BPF_JGT | BPF_X: 1694 case BPF_JMP32 | BPF_JGT | BPF_X: 1695 case BPF_JMP | BPF_JLT | BPF_X: 1696 case BPF_JMP32 | BPF_JLT | BPF_X: 1697 case BPF_JMP | BPF_JGE | BPF_X: 1698 case BPF_JMP32 | BPF_JGE | BPF_X: 1699 case BPF_JMP | BPF_JLE | BPF_X: 1700 case BPF_JMP32 | BPF_JLE | BPF_X: 1701 case BPF_JMP | BPF_JNE | BPF_X: 1702 case BPF_JMP32 | BPF_JNE | BPF_X: 1703 case BPF_JMP | BPF_JSGT | BPF_X: 1704 case BPF_JMP32 | BPF_JSGT | BPF_X: 1705 case BPF_JMP | BPF_JSLT | BPF_X: 1706 case BPF_JMP32 | BPF_JSLT | BPF_X: 1707 case BPF_JMP | BPF_JSGE | BPF_X: 1708 case BPF_JMP32 | BPF_JSGE | BPF_X: 1709 case BPF_JMP | BPF_JSLE | BPF_X: 1710 case BPF_JMP32 | BPF_JSLE | BPF_X: 1711 case BPF_JMP | BPF_JSET | BPF_X: 1712 case BPF_JMP32 | BPF_JSET | BPF_X: 1713 rvoff = rv_offset(i, off, ctx); 1714 if (!is64) { 1715 s = ctx->ninsns; 1716 if (is_signed_bpf_cond(BPF_OP(code))) { 1717 emit_sextw_alt(&rs, RV_REG_T1, ctx); 1718 emit_sextw_alt(&rd, RV_REG_T2, ctx); 1719 } else { 1720 emit_zextw_alt(&rs, RV_REG_T1, ctx); 1721 emit_zextw_alt(&rd, RV_REG_T2, ctx); 1722 } 1723 e = ctx->ninsns; 1724 1725 /* Adjust for extra insns */ 1726 rvoff -= ninsns_rvoff(e - s); 1727 } 1728 1729 if (BPF_OP(code) == BPF_JSET) { 1730 /* Adjust for and */ 1731 rvoff -= 4; 1732 emit_and(RV_REG_T1, rd, rs, ctx); 1733 emit_branch(BPF_JNE, RV_REG_T1, RV_REG_ZERO, rvoff, ctx); 1734 } else { 1735 emit_branch(BPF_OP(code), rd, rs, rvoff, ctx); 1736 } 1737 break; 1738 1739 /* IF (dst COND imm) JUMP off */ 1740 case BPF_JMP | BPF_JEQ | BPF_K: 1741 case BPF_JMP32 | BPF_JEQ | BPF_K: 1742 case BPF_JMP | BPF_JGT | BPF_K: 1743 case BPF_JMP32 | BPF_JGT | BPF_K: 1744 case BPF_JMP | BPF_JLT | BPF_K: 1745 case BPF_JMP32 | BPF_JLT | BPF_K: 1746 case BPF_JMP | BPF_JGE | BPF_K: 1747 case BPF_JMP32 | BPF_JGE | BPF_K: 1748 case BPF_JMP | BPF_JLE | BPF_K: 1749 case BPF_JMP32 | BPF_JLE | BPF_K: 1750 case BPF_JMP | BPF_JNE | BPF_K: 1751 case BPF_JMP32 | BPF_JNE | BPF_K: 1752 case BPF_JMP | BPF_JSGT | BPF_K: 1753 case BPF_JMP32 | BPF_JSGT | BPF_K: 1754 case BPF_JMP | BPF_JSLT | BPF_K: 1755 case BPF_JMP32 | BPF_JSLT | BPF_K: 1756 case BPF_JMP | BPF_JSGE | BPF_K: 1757 case BPF_JMP32 | BPF_JSGE | BPF_K: 1758 case BPF_JMP | BPF_JSLE | BPF_K: 1759 case BPF_JMP32 | BPF_JSLE | BPF_K: 1760 rvoff = rv_offset(i, off, ctx); 1761 s = ctx->ninsns; 1762 if (imm) 1763 emit_imm(RV_REG_T1, imm, ctx); 1764 rs = imm ? RV_REG_T1 : RV_REG_ZERO; 1765 if (!is64) { 1766 if (is_signed_bpf_cond(BPF_OP(code))) { 1767 emit_sextw_alt(&rd, RV_REG_T2, ctx); 1768 /* rs has been sign extended */ 1769 } else { 1770 emit_zextw_alt(&rd, RV_REG_T2, ctx); 1771 if (imm) 1772 emit_zextw(rs, rs, ctx); 1773 } 1774 } 1775 e = ctx->ninsns; 1776 1777 /* Adjust for extra insns */ 1778 rvoff -= ninsns_rvoff(e - s); 1779 emit_branch(BPF_OP(code), rd, rs, rvoff, ctx); 1780 break; 1781 1782 case BPF_JMP | BPF_JSET | BPF_K: 1783 case BPF_JMP32 | BPF_JSET | BPF_K: 1784 rvoff = rv_offset(i, off, ctx); 1785 s = ctx->ninsns; 1786 if (is_12b_int(imm)) { 1787 emit_andi(RV_REG_T1, rd, imm, ctx); 1788 } else { 1789 emit_imm(RV_REG_T1, imm, ctx); 1790 emit_and(RV_REG_T1, rd, RV_REG_T1, ctx); 1791 } 1792 /* For jset32, we should clear the upper 32 bits of t1, but 1793 * sign-extension is sufficient here and saves one instruction, 1794 * as t1 is used only in comparison against zero. 1795 */ 1796 if (!is64 && imm < 0) 1797 emit_sextw(RV_REG_T1, RV_REG_T1, ctx); 1798 e = ctx->ninsns; 1799 rvoff -= ninsns_rvoff(e - s); 1800 emit_branch(BPF_JNE, RV_REG_T1, RV_REG_ZERO, rvoff, ctx); 1801 break; 1802 1803 /* function call */ 1804 case BPF_JMP | BPF_CALL: 1805 { 1806 bool fixed_addr; 1807 u64 addr; 1808 1809 /* Inline calls to bpf_get_smp_processor_id() 1810 * 1811 * RV_REG_TP holds the address of the current CPU's task_struct and thread_info is 1812 * at offset 0 in task_struct. 1813 * Load cpu from thread_info: 1814 * Set R0 to ((struct thread_info *)(RV_REG_TP))->cpu 1815 * 1816 * This replicates the implementation of raw_smp_processor_id() on RISCV 1817 */ 1818 if (insn->src_reg == 0 && insn->imm == BPF_FUNC_get_smp_processor_id) { 1819 /* Load current CPU number in R0 */ 1820 emit_lw(bpf_to_rv_reg(BPF_REG_0, ctx), offsetof(struct thread_info, cpu), 1821 RV_REG_TP, ctx); 1822 break; 1823 } 1824 1825 /* Implement helper call to bpf_get_current_task/_btf() inline */ 1826 if (insn->src_reg == 0 && (insn->imm == BPF_FUNC_get_current_task || 1827 insn->imm == BPF_FUNC_get_current_task_btf)) { 1828 emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_TP, ctx); 1829 break; 1830 } 1831 1832 mark_call(ctx); 1833 ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, 1834 &addr, &fixed_addr); 1835 if (ret < 0) 1836 return ret; 1837 1838 if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { 1839 const struct btf_func_model *fm; 1840 int idx; 1841 1842 fm = bpf_jit_find_kfunc_model(ctx->prog, insn); 1843 if (!fm) 1844 return -EINVAL; 1845 1846 for (idx = 0; idx < fm->nr_args; idx++) { 1847 u8 reg = bpf_to_rv_reg(BPF_REG_1 + idx, ctx); 1848 bool sign = fm->arg_flags[idx] & BTF_FMODEL_SIGNED_ARG; 1849 1850 if (sign_extend(reg, reg, fm->arg_size[idx], sign, ctx)) 1851 return -EINVAL; 1852 } 1853 } 1854 1855 /* restore TCC to RV_REG_TCC before bpf2bpf call */ 1856 if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL) 1857 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 1858 1859 ret = emit_call(addr, fixed_addr, ctx); 1860 if (ret) 1861 return ret; 1862 1863 /* store updated TCC back to stack after bpf2bpf call */ 1864 if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL) 1865 emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx); 1866 1867 /* 1868 * arch_bpf_timed_may_goto() is emitted by the verifier and 1869 * returns its result in BPF_REG_AX instead of BPF_REG_0, so 1870 * skip the normal "move return register into R0". 1871 */ 1872 if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto) 1873 emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx); 1874 break; 1875 } 1876 /* tail call */ 1877 case BPF_JMP | BPF_TAIL_CALL: 1878 if (emit_bpf_tail_call(i, ctx)) 1879 return -1; 1880 break; 1881 1882 /* function return */ 1883 case BPF_JMP | BPF_EXIT: 1884 if (i == ctx->prog->len - 1) 1885 break; 1886 1887 rvoff = epilogue_offset(ctx); 1888 ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx); 1889 if (ret) 1890 return ret; 1891 break; 1892 1893 /* dst = imm64 */ 1894 case BPF_LD | BPF_IMM | BPF_DW: 1895 { 1896 struct bpf_insn insn1 = insn[1]; 1897 u64 imm64; 1898 1899 imm64 = (u64)insn1.imm << 32 | (u32)imm; 1900 if (bpf_pseudo_func(insn)) { 1901 /* fixed-length insns for extra jit pass */ 1902 ret = emit_addr(rd, imm64, extra_pass, ctx); 1903 if (ret) 1904 return ret; 1905 } else { 1906 emit_imm(rd, imm64, ctx); 1907 } 1908 1909 return 1; 1910 } 1911 1912 /* LDX: dst = *(unsigned size *)(src + off) */ 1913 case BPF_LDX | BPF_MEM | BPF_B: 1914 case BPF_LDX | BPF_MEM | BPF_H: 1915 case BPF_LDX | BPF_MEM | BPF_W: 1916 case BPF_LDX | BPF_MEM | BPF_DW: 1917 case BPF_LDX | BPF_PROBE_MEM | BPF_B: 1918 case BPF_LDX | BPF_PROBE_MEM | BPF_H: 1919 case BPF_LDX | BPF_PROBE_MEM | BPF_W: 1920 case BPF_LDX | BPF_PROBE_MEM | BPF_DW: 1921 /* LDSX: dst = *(signed size *)(src + off) */ 1922 case BPF_LDX | BPF_MEMSX | BPF_B: 1923 case BPF_LDX | BPF_MEMSX | BPF_H: 1924 case BPF_LDX | BPF_MEMSX | BPF_W: 1925 case BPF_LDX | BPF_PROBE_MEMSX | BPF_B: 1926 case BPF_LDX | BPF_PROBE_MEMSX | BPF_H: 1927 case BPF_LDX | BPF_PROBE_MEMSX | BPF_W: 1928 /* LDX | PROBE_MEM32: dst = *(unsigned size *)(src + RV_REG_ARENA + off) */ 1929 case BPF_LDX | BPF_PROBE_MEM32 | BPF_B: 1930 case BPF_LDX | BPF_PROBE_MEM32 | BPF_H: 1931 case BPF_LDX | BPF_PROBE_MEM32 | BPF_W: 1932 case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW: 1933 { 1934 bool sign_ext; 1935 1936 sign_ext = BPF_MODE(insn->code) == BPF_MEMSX || 1937 BPF_MODE(insn->code) == BPF_PROBE_MEMSX; 1938 1939 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1940 emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx); 1941 rs = RV_REG_T2; 1942 } 1943 1944 emit_ldx(rd, off, rs, BPF_SIZE(code), sign_ext, ctx); 1945 1946 ret = add_exception_handler(insn, rd, ctx); 1947 if (ret) 1948 return ret; 1949 1950 if (BPF_SIZE(code) != BPF_DW && insn_is_zext(&insn[1])) 1951 return 1; 1952 break; 1953 } 1954 1955 /* speculation barrier */ 1956 case BPF_ST | BPF_NOSPEC: 1957 break; 1958 1959 /* ST: *(size *)(dst + off) = imm */ 1960 case BPF_ST | BPF_MEM | BPF_B: 1961 case BPF_ST | BPF_MEM | BPF_H: 1962 case BPF_ST | BPF_MEM | BPF_W: 1963 case BPF_ST | BPF_MEM | BPF_DW: 1964 /* ST | PROBE_MEM32: *(size *)(dst + RV_REG_ARENA + off) = imm */ 1965 case BPF_ST | BPF_PROBE_MEM32 | BPF_B: 1966 case BPF_ST | BPF_PROBE_MEM32 | BPF_H: 1967 case BPF_ST | BPF_PROBE_MEM32 | BPF_W: 1968 case BPF_ST | BPF_PROBE_MEM32 | BPF_DW: 1969 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1970 emit_add(RV_REG_T3, rd, RV_REG_ARENA, ctx); 1971 rd = RV_REG_T3; 1972 } 1973 1974 emit_st(rd, off, imm, BPF_SIZE(code), ctx); 1975 1976 ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx); 1977 if (ret) 1978 return ret; 1979 break; 1980 1981 /* STX: *(size *)(dst + off) = src */ 1982 case BPF_STX | BPF_MEM | BPF_B: 1983 case BPF_STX | BPF_MEM | BPF_H: 1984 case BPF_STX | BPF_MEM | BPF_W: 1985 case BPF_STX | BPF_MEM | BPF_DW: 1986 /* STX | PROBE_MEM32: *(size *)(dst + RV_REG_ARENA + off) = src */ 1987 case BPF_STX | BPF_PROBE_MEM32 | BPF_B: 1988 case BPF_STX | BPF_PROBE_MEM32 | BPF_H: 1989 case BPF_STX | BPF_PROBE_MEM32 | BPF_W: 1990 case BPF_STX | BPF_PROBE_MEM32 | BPF_DW: 1991 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1992 emit_add(RV_REG_T2, rd, RV_REG_ARENA, ctx); 1993 rd = RV_REG_T2; 1994 } 1995 1996 emit_stx(rd, off, rs, BPF_SIZE(code), ctx); 1997 1998 ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx); 1999 if (ret) 2000 return ret; 2001 break; 2002 2003 /* Atomics */ 2004 case BPF_STX | BPF_ATOMIC | BPF_B: 2005 case BPF_STX | BPF_ATOMIC | BPF_H: 2006 case BPF_STX | BPF_ATOMIC | BPF_W: 2007 case BPF_STX | BPF_ATOMIC | BPF_DW: 2008 case BPF_STX | BPF_PROBE_ATOMIC | BPF_B: 2009 case BPF_STX | BPF_PROBE_ATOMIC | BPF_H: 2010 case BPF_STX | BPF_PROBE_ATOMIC | BPF_W: 2011 case BPF_STX | BPF_PROBE_ATOMIC | BPF_DW: 2012 if (bpf_atomic_is_load_store(insn)) 2013 ret = emit_atomic_ld_st(rd, rs, insn, ctx); 2014 else 2015 ret = emit_atomic_rmw(rd, rs, insn, ctx); 2016 2017 /* ret can be 1 (skip-zext); extable entry still needs to be added */ 2018 if (ret >= 0) { 2019 /* 2020 * A load-acquire reads into dst_reg, and a read-modify-write 2021 * carrying BPF_FETCH reads the old value into src_reg, or into 2022 * r0 for a BPF_CMPXCHG. Clear that register on fault, the 2023 * remaining atomics have no destination register. 2024 */ 2025 int load_reg = bpf_atomic_load_reg(insn); 2026 2027 ret = add_exception_handler(insn, load_reg < 0 ? 2028 REG_DONT_CLEAR_MARKER : regmap[load_reg], 2029 ctx) ?: ret; 2030 } 2031 2032 if (ret) 2033 return ret; 2034 break; 2035 2036 default: 2037 pr_err("bpf-jit: unknown opcode %02x\n", code); 2038 return -EINVAL; 2039 } 2040 2041 return 0; 2042 } 2043 2044 void bpf_jit_build_prologue(struct rv_jit_context *ctx, bool is_subprog) 2045 { 2046 int i, stack_adjust = 0, store_offset, bpf_stack_adjust; 2047 2048 bpf_stack_adjust = round_up(ctx->prog->aux->stack_depth, STACK_ALIGN); 2049 if (bpf_stack_adjust) 2050 mark_fp(ctx); 2051 2052 if (seen_reg(RV_REG_RA, ctx)) 2053 stack_adjust += 8; 2054 stack_adjust += 8; /* RV_REG_FP */ 2055 if (seen_reg(RV_REG_S1, ctx)) 2056 stack_adjust += 8; 2057 if (seen_reg(RV_REG_S2, ctx)) 2058 stack_adjust += 8; 2059 if (seen_reg(RV_REG_S3, ctx)) 2060 stack_adjust += 8; 2061 if (seen_reg(RV_REG_S4, ctx)) 2062 stack_adjust += 8; 2063 if (seen_reg(RV_REG_S5, ctx)) 2064 stack_adjust += 8; 2065 if (ctx->arena_vm_start) 2066 stack_adjust += 8; 2067 stack_adjust += 8; /* RV_REG_TCC */ 2068 2069 stack_adjust = round_up(stack_adjust, STACK_ALIGN); 2070 stack_adjust += bpf_stack_adjust; 2071 2072 store_offset = stack_adjust - 8; 2073 2074 /* emit kcfi type preamble immediately before the first insn */ 2075 emit_kcfi(is_subprog ? cfi_bpf_subprog_hash : cfi_bpf_hash, ctx); 2076 2077 /* bpf prog starts here as kcfi skipped during prog->bpf_func setup */ 2078 2079 /* nops reserved for auipc+jalr pair */ 2080 for (i = 0; i < RV_FENTRY_NINSNS; i++) 2081 emit(rv_nop(), ctx); 2082 2083 if (!is_subprog) 2084 emit(rv_addi(RV_REG_TCC, RV_REG_ZERO, MAX_TAIL_CALL_CNT), ctx); 2085 2086 /* tailcall starts here, emit insn before it must be fixed */ 2087 2088 emit_addi(RV_REG_SP, RV_REG_SP, -stack_adjust, ctx); 2089 2090 if (seen_reg(RV_REG_RA, ctx)) { 2091 emit_sd(RV_REG_SP, store_offset, RV_REG_RA, ctx); 2092 store_offset -= 8; 2093 } 2094 emit_sd(RV_REG_SP, store_offset, RV_REG_FP, ctx); 2095 store_offset -= 8; 2096 if (seen_reg(RV_REG_S1, ctx)) { 2097 emit_sd(RV_REG_SP, store_offset, RV_REG_S1, ctx); 2098 store_offset -= 8; 2099 } 2100 if (seen_reg(RV_REG_S2, ctx)) { 2101 emit_sd(RV_REG_SP, store_offset, RV_REG_S2, ctx); 2102 store_offset -= 8; 2103 } 2104 if (seen_reg(RV_REG_S3, ctx)) { 2105 emit_sd(RV_REG_SP, store_offset, RV_REG_S3, ctx); 2106 store_offset -= 8; 2107 } 2108 if (seen_reg(RV_REG_S4, ctx)) { 2109 emit_sd(RV_REG_SP, store_offset, RV_REG_S4, ctx); 2110 store_offset -= 8; 2111 } 2112 if (seen_reg(RV_REG_S5, ctx)) { 2113 emit_sd(RV_REG_SP, store_offset, RV_REG_S5, ctx); 2114 store_offset -= 8; 2115 } 2116 if (ctx->arena_vm_start) { 2117 emit_sd(RV_REG_SP, store_offset, RV_REG_ARENA, ctx); 2118 store_offset -= 8; 2119 } 2120 2121 /* store TCC from RV_REG_TCC to stack */ 2122 emit_sd(RV_REG_SP, store_offset, RV_REG_TCC, ctx); 2123 ctx->tcc_offset = store_offset; 2124 2125 emit_addi(RV_REG_FP, RV_REG_SP, stack_adjust, ctx); 2126 2127 if (bpf_stack_adjust) 2128 emit_addi(RV_REG_S5, RV_REG_SP, bpf_stack_adjust, ctx); 2129 2130 ctx->stack_size = stack_adjust; 2131 2132 if (ctx->arena_vm_start) 2133 emit_imm(RV_REG_ARENA, ctx->arena_vm_start, ctx); 2134 } 2135 2136 void bpf_jit_build_epilogue(struct rv_jit_context *ctx) 2137 { 2138 __build_epilogue(false, ctx); 2139 } 2140 2141 bool bpf_jit_supports_kfunc_call(void) 2142 { 2143 return true; 2144 } 2145 2146 bool bpf_jit_supports_ptr_xchg(void) 2147 { 2148 return true; 2149 } 2150 2151 bool bpf_jit_supports_arena(void) 2152 { 2153 /* 2154 * The arena range tree uses kmalloc_nolock(), which needs 2155 * cmpxchg128, provided by ZACAS on riscv. 2156 */ 2157 #ifdef system_has_cmpxchg128 2158 return system_has_cmpxchg128(); 2159 #else 2160 return false; 2161 #endif 2162 } 2163 2164 bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena) 2165 { 2166 if (in_arena) { 2167 switch (insn->code) { 2168 case BPF_STX | BPF_ATOMIC | BPF_W: 2169 case BPF_STX | BPF_ATOMIC | BPF_DW: 2170 if (insn->imm == BPF_CMPXCHG) 2171 return rv_ext_enabled(ZACAS); 2172 break; 2173 case BPF_LDX | BPF_MEMSX | BPF_B: 2174 case BPF_LDX | BPF_MEMSX | BPF_H: 2175 case BPF_LDX | BPF_MEMSX | BPF_W: 2176 return false; 2177 } 2178 } 2179 2180 return true; 2181 } 2182 2183 bool bpf_jit_supports_percpu_insn(void) 2184 { 2185 return true; 2186 } 2187 2188 bool bpf_jit_inlines_helper_call(s32 imm) 2189 { 2190 switch (imm) { 2191 case BPF_FUNC_get_smp_processor_id: 2192 case BPF_FUNC_get_current_task: 2193 case BPF_FUNC_get_current_task_btf: 2194 return true; 2195 default: 2196 return false; 2197 } 2198 } 2199 2200 bool bpf_jit_supports_fsession(void) 2201 { 2202 return true; 2203 } 2204 2205 bool bpf_jit_supports_subprog_tailcalls(void) 2206 { 2207 return true; 2208 } 2209 2210 bool bpf_jit_supports_timed_may_goto(void) 2211 { 2212 return true; 2213 } 2214