1 // SPDX-License-Identifier: GPL-2.0 2 /* BPF JIT compiler for RV64G 3 * 4 * Copyright(c) 2019 Björn Töpel <bjorn.topel@gmail.com> 5 * 6 */ 7 8 #include <linux/bitfield.h> 9 #include <linux/bpf.h> 10 #include <linux/filter.h> 11 #include <linux/memory.h> 12 #include <linux/stop_machine.h> 13 #include <asm/text-patching.h> 14 #include <asm/cfi.h> 15 #include <asm/percpu.h> 16 #include "bpf_jit.h" 17 18 #define RV_MAX_REG_ARGS 8 19 #define RV_FENTRY_NINSNS 2 20 #define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4) 21 /* imm that allows emit_imm to emit max count insns */ 22 #define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF 23 /* fentry and TCC init insns will be skipped on tailcall */ 24 #define RV_TAILCALL_OFFSET ((RV_FENTRY_NINSNS + 1) * 4) 25 26 #define RV_REG_TCC RV_REG_A6 27 #define RV_REG_ARENA RV_REG_S7 /* For storing arena_vm_start */ 28 29 static const int regmap[] = { 30 [BPF_REG_0] = RV_REG_A5, 31 [BPF_REG_1] = RV_REG_A0, 32 [BPF_REG_2] = RV_REG_A1, 33 [BPF_REG_3] = RV_REG_A2, 34 [BPF_REG_4] = RV_REG_A3, 35 [BPF_REG_5] = RV_REG_A4, 36 [BPF_REG_6] = RV_REG_S1, 37 [BPF_REG_7] = RV_REG_S2, 38 [BPF_REG_8] = RV_REG_S3, 39 [BPF_REG_9] = RV_REG_S4, 40 [BPF_REG_FP] = RV_REG_S5, 41 [BPF_REG_AX] = RV_REG_T0, 42 }; 43 44 static const int pt_regmap[] = { 45 [RV_REG_A0] = offsetof(struct pt_regs, a0), 46 [RV_REG_A1] = offsetof(struct pt_regs, a1), 47 [RV_REG_A2] = offsetof(struct pt_regs, a2), 48 [RV_REG_A3] = offsetof(struct pt_regs, a3), 49 [RV_REG_A4] = offsetof(struct pt_regs, a4), 50 [RV_REG_A5] = offsetof(struct pt_regs, a5), 51 [RV_REG_S1] = offsetof(struct pt_regs, s1), 52 [RV_REG_S2] = offsetof(struct pt_regs, s2), 53 [RV_REG_S3] = offsetof(struct pt_regs, s3), 54 [RV_REG_S4] = offsetof(struct pt_regs, s4), 55 [RV_REG_S5] = offsetof(struct pt_regs, s5), 56 [RV_REG_T0] = offsetof(struct pt_regs, t0), 57 }; 58 59 enum { 60 RV_CTX_F_SEEN_CALL = RV_REG_RA, 61 RV_CTX_F_SEEN_S1 = RV_REG_S1, 62 RV_CTX_F_SEEN_S2 = RV_REG_S2, 63 RV_CTX_F_SEEN_S3 = RV_REG_S3, 64 RV_CTX_F_SEEN_S4 = RV_REG_S4, 65 RV_CTX_F_SEEN_S5 = RV_REG_S5, 66 }; 67 68 static u8 bpf_to_rv_reg(int bpf_reg, struct rv_jit_context *ctx) 69 { 70 u8 reg = regmap[bpf_reg]; 71 72 switch (reg) { 73 case RV_CTX_F_SEEN_S1: 74 case RV_CTX_F_SEEN_S2: 75 case RV_CTX_F_SEEN_S3: 76 case RV_CTX_F_SEEN_S4: 77 case RV_CTX_F_SEEN_S5: 78 __set_bit(reg, &ctx->flags); 79 } 80 return reg; 81 }; 82 83 static bool seen_reg(int reg, struct rv_jit_context *ctx) 84 { 85 switch (reg) { 86 case RV_CTX_F_SEEN_CALL: 87 case RV_CTX_F_SEEN_S1: 88 case RV_CTX_F_SEEN_S2: 89 case RV_CTX_F_SEEN_S3: 90 case RV_CTX_F_SEEN_S4: 91 case RV_CTX_F_SEEN_S5: 92 return test_bit(reg, &ctx->flags); 93 } 94 return false; 95 } 96 97 static void mark_fp(struct rv_jit_context *ctx) 98 { 99 __set_bit(RV_CTX_F_SEEN_S5, &ctx->flags); 100 } 101 102 static void mark_call(struct rv_jit_context *ctx) 103 { 104 __set_bit(RV_CTX_F_SEEN_CALL, &ctx->flags); 105 } 106 107 static bool is_32b_int(s64 val) 108 { 109 return -(1L << 31) <= val && val < (1L << 31); 110 } 111 112 static bool in_auipc_jalr_range(s64 val) 113 { 114 /* 115 * auipc+jalr can reach any signed PC-relative offset in the range 116 * [-2^31 - 2^11, 2^31 - 2^11). 117 */ 118 return (-(1L << 31) - (1L << 11)) <= val && 119 val < ((1L << 31) - (1L << 11)); 120 } 121 122 /* Modify rd pointer to alternate reg to avoid corrupting original reg */ 123 static void emit_sextw_alt(u8 *rd, u8 ra, struct rv_jit_context *ctx) 124 { 125 emit_sextw(ra, *rd, ctx); 126 *rd = ra; 127 } 128 129 static void emit_zextw_alt(u8 *rd, u8 ra, struct rv_jit_context *ctx) 130 { 131 emit_zextw(ra, *rd, ctx); 132 *rd = ra; 133 } 134 135 /* Emit fixed-length instructions for address */ 136 static int emit_addr(u8 rd, u64 addr, bool extra_pass, struct rv_jit_context *ctx) 137 { 138 /* 139 * Use the ro_insns(RX) to calculate the offset as the BPF program will 140 * finally run from this memory region. 141 */ 142 u64 ip = (u64)(ctx->ro_insns + ctx->ninsns); 143 s64 off = addr - ip; 144 s64 upper = (off + (1 << 11)) >> 12; 145 s64 lower = off & 0xfff; 146 147 if (extra_pass && !in_auipc_jalr_range(off)) { 148 pr_err("bpf-jit: target offset 0x%llx is out of range\n", off); 149 return -ERANGE; 150 } 151 152 emit(rv_auipc(rd, upper), ctx); 153 emit(rv_addi(rd, rd, lower), ctx); 154 return 0; 155 } 156 157 /* Emit variable-length instructions for 32-bit and 64-bit imm */ 158 static void emit_imm(u8 rd, s64 val, struct rv_jit_context *ctx) 159 { 160 /* Note that the immediate from the add is sign-extended, 161 * which means that we need to compensate this by adding 2^12, 162 * when the 12th bit is set. A simpler way of doing this, and 163 * getting rid of the check, is to just add 2**11 before the 164 * shift. The "Loading a 32-Bit constant" example from the 165 * "Computer Organization and Design, RISC-V edition" book by 166 * Patterson/Hennessy highlights this fact. 167 * 168 * This also means that we need to process LSB to MSB. 169 */ 170 s64 upper = (val + (1 << 11)) >> 12; 171 /* Sign-extend lower 12 bits to 64 bits since immediates for li, addiw, 172 * and addi are signed and RVC checks will perform signed comparisons. 173 */ 174 s64 lower = ((val & 0xfff) << 52) >> 52; 175 int shift; 176 177 if (is_32b_int(val)) { 178 if (upper) 179 emit_lui(rd, upper, ctx); 180 181 if (!upper) { 182 emit_li(rd, lower, ctx); 183 return; 184 } 185 186 emit_addiw(rd, rd, lower, ctx); 187 return; 188 } 189 190 shift = __ffs(upper); 191 upper >>= shift; 192 shift += 12; 193 194 emit_imm(rd, upper, ctx); 195 196 emit_slli(rd, rd, shift, ctx); 197 if (lower) 198 emit_addi(rd, rd, lower, ctx); 199 } 200 201 static void __build_epilogue(bool is_tail_call, struct rv_jit_context *ctx) 202 { 203 int stack_adjust = ctx->stack_size, store_offset = stack_adjust - 8; 204 205 if (seen_reg(RV_REG_RA, ctx)) { 206 emit_ld(RV_REG_RA, store_offset, RV_REG_SP, ctx); 207 store_offset -= 8; 208 } 209 emit_ld(RV_REG_FP, store_offset, RV_REG_SP, ctx); 210 store_offset -= 8; 211 if (seen_reg(RV_REG_S1, ctx)) { 212 emit_ld(RV_REG_S1, store_offset, RV_REG_SP, ctx); 213 store_offset -= 8; 214 } 215 if (seen_reg(RV_REG_S2, ctx)) { 216 emit_ld(RV_REG_S2, store_offset, RV_REG_SP, ctx); 217 store_offset -= 8; 218 } 219 if (seen_reg(RV_REG_S3, ctx)) { 220 emit_ld(RV_REG_S3, store_offset, RV_REG_SP, ctx); 221 store_offset -= 8; 222 } 223 if (seen_reg(RV_REG_S4, ctx)) { 224 emit_ld(RV_REG_S4, store_offset, RV_REG_SP, ctx); 225 store_offset -= 8; 226 } 227 if (seen_reg(RV_REG_S5, ctx)) { 228 emit_ld(RV_REG_S5, store_offset, RV_REG_SP, ctx); 229 store_offset -= 8; 230 } 231 if (ctx->arena_vm_start) { 232 emit_ld(RV_REG_ARENA, store_offset, RV_REG_SP, ctx); 233 store_offset -= 8; 234 } 235 236 /* restore TCC from stack to RV_REG_TCC */ 237 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 238 239 emit_addi(RV_REG_SP, RV_REG_SP, stack_adjust, ctx); 240 /* Set return value. */ 241 if (!is_tail_call) 242 emit_addiw(RV_REG_A0, RV_REG_A5, 0, ctx); 243 emit_jalr(RV_REG_ZERO, is_tail_call ? RV_REG_T3 : RV_REG_RA, 244 is_tail_call ? RV_TAILCALL_OFFSET : 0, ctx); 245 } 246 247 static void emit_bcc(u8 cond, u8 rd, u8 rs, int rvoff, 248 struct rv_jit_context *ctx) 249 { 250 switch (cond) { 251 case BPF_JEQ: 252 emit(rv_beq(rd, rs, rvoff >> 1), ctx); 253 return; 254 case BPF_JGT: 255 emit(rv_bltu(rs, rd, rvoff >> 1), ctx); 256 return; 257 case BPF_JLT: 258 emit(rv_bltu(rd, rs, rvoff >> 1), ctx); 259 return; 260 case BPF_JGE: 261 emit(rv_bgeu(rd, rs, rvoff >> 1), ctx); 262 return; 263 case BPF_JLE: 264 emit(rv_bgeu(rs, rd, rvoff >> 1), ctx); 265 return; 266 case BPF_JNE: 267 emit(rv_bne(rd, rs, rvoff >> 1), ctx); 268 return; 269 case BPF_JSGT: 270 emit(rv_blt(rs, rd, rvoff >> 1), ctx); 271 return; 272 case BPF_JSLT: 273 emit(rv_blt(rd, rs, rvoff >> 1), ctx); 274 return; 275 case BPF_JSGE: 276 emit(rv_bge(rd, rs, rvoff >> 1), ctx); 277 return; 278 case BPF_JSLE: 279 emit(rv_bge(rs, rd, rvoff >> 1), ctx); 280 } 281 } 282 283 static void emit_branch(u8 cond, u8 rd, u8 rs, int rvoff, 284 struct rv_jit_context *ctx) 285 { 286 s64 upper, lower; 287 288 if (is_13b_int(rvoff)) { 289 emit_bcc(cond, rd, rs, rvoff, ctx); 290 return; 291 } 292 293 /* Adjust for jal */ 294 rvoff -= 4; 295 296 /* Transform, e.g.: 297 * bne rd,rs,foo 298 * to 299 * beq rd,rs,<.L1> 300 * (auipc foo) 301 * jal(r) foo 302 * .L1 303 */ 304 cond = invert_bpf_cond(cond); 305 if (is_21b_int(rvoff)) { 306 emit_bcc(cond, rd, rs, 8, ctx); 307 emit(rv_jal(RV_REG_ZERO, rvoff >> 1), ctx); 308 return; 309 } 310 311 /* 32b No need for an additional rvoff adjustment, since we 312 * get that from the auipc at PC', where PC = PC' + 4. 313 */ 314 upper = (rvoff + (1 << 11)) >> 12; 315 lower = rvoff & 0xfff; 316 317 emit_bcc(cond, rd, rs, 12, ctx); 318 emit(rv_auipc(RV_REG_T1, upper), ctx); 319 emit(rv_jalr(RV_REG_ZERO, RV_REG_T1, lower), ctx); 320 } 321 322 static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx) 323 { 324 int tc_ninsn, off, start_insn = ctx->ninsns; 325 326 /* a0: &ctx 327 * a1: &array 328 * a2: index 329 * 330 * if (index >= array->map.max_entries) 331 * goto out; 332 */ 333 tc_ninsn = insn ? ctx->offset[insn] - ctx->offset[insn - 1] : 334 ctx->offset[0]; 335 emit_zextw(RV_REG_A2, RV_REG_A2, ctx); 336 337 off = offsetof(struct bpf_array, map.max_entries); 338 if (is_12b_check(off, insn)) 339 return -1; 340 emit(rv_lwu(RV_REG_T1, off, RV_REG_A1), ctx); 341 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 342 emit_branch(BPF_JGE, RV_REG_A2, RV_REG_T1, off, ctx); 343 344 /* if (--TCC < 0) 345 * goto out; 346 */ 347 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 348 emit_addi(RV_REG_TCC, RV_REG_TCC, -1, ctx); 349 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 350 emit_branch(BPF_JSLT, RV_REG_TCC, RV_REG_ZERO, off, ctx); 351 352 /* prog = array->ptrs[index]; 353 * if (!prog) 354 * goto out; 355 */ 356 emit_sh3add(RV_REG_T2, RV_REG_A2, RV_REG_A1, ctx); 357 off = offsetof(struct bpf_array, ptrs); 358 if (is_12b_check(off, insn)) 359 return -1; 360 emit_ld(RV_REG_T2, off, RV_REG_T2, ctx); 361 off = ninsns_rvoff(tc_ninsn - (ctx->ninsns - start_insn)); 362 emit_branch(BPF_JEQ, RV_REG_T2, RV_REG_ZERO, off, ctx); 363 364 /* store updated TCC back to stack */ 365 emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx); 366 367 /* goto *(prog->bpf_func + RV_TAILCALL_OFFSET); */ 368 off = offsetof(struct bpf_prog, bpf_func); 369 if (is_12b_check(off, insn)) 370 return -1; 371 emit_ld(RV_REG_T3, off, RV_REG_T2, ctx); 372 __build_epilogue(true, ctx); 373 return 0; 374 } 375 376 static void init_regs(u8 *rd, u8 *rs, const struct bpf_insn *insn, 377 struct rv_jit_context *ctx) 378 { 379 u8 code = insn->code; 380 381 switch (code) { 382 case BPF_JMP | BPF_JA: 383 case BPF_JMP | BPF_CALL: 384 case BPF_JMP | BPF_EXIT: 385 case BPF_JMP | BPF_TAIL_CALL: 386 break; 387 default: 388 *rd = bpf_to_rv_reg(insn->dst_reg, ctx); 389 } 390 391 if (code & (BPF_ALU | BPF_X) || code & (BPF_ALU64 | BPF_X) || 392 code & (BPF_JMP | BPF_X) || code & (BPF_JMP32 | BPF_X) || 393 code & BPF_LDX || code & BPF_STX) 394 *rs = bpf_to_rv_reg(insn->src_reg, ctx); 395 } 396 397 static int emit_jump_and_link(u8 rd, s64 rvoff, bool fixed_addr, 398 struct rv_jit_context *ctx) 399 { 400 s64 upper, lower; 401 402 if (rvoff && fixed_addr && is_21b_int(rvoff)) { 403 emit(rv_jal(rd, rvoff >> 1), ctx); 404 return 0; 405 } else if (in_auipc_jalr_range(rvoff)) { 406 upper = (rvoff + (1 << 11)) >> 12; 407 lower = rvoff & 0xfff; 408 emit(rv_auipc(RV_REG_T1, upper), ctx); 409 emit(rv_jalr(rd, RV_REG_T1, lower), ctx); 410 return 0; 411 } 412 413 pr_err("bpf-jit: target offset 0x%llx is out of range\n", rvoff); 414 return -ERANGE; 415 } 416 417 static bool is_signed_bpf_cond(u8 cond) 418 { 419 return cond == BPF_JSGT || cond == BPF_JSLT || 420 cond == BPF_JSGE || cond == BPF_JSLE; 421 } 422 423 static int emit_call(u64 addr, bool fixed_addr, struct rv_jit_context *ctx) 424 { 425 s64 off = 0; 426 u64 ip; 427 428 if (addr && ctx->insns && ctx->ro_insns) { 429 /* 430 * Use the ro_insns(RX) to calculate the offset as the BPF 431 * program will finally run from this memory region. 432 */ 433 ip = (u64)(long)(ctx->ro_insns + ctx->ninsns); 434 off = addr - ip; 435 } 436 437 return emit_jump_and_link(RV_REG_RA, off, fixed_addr, ctx); 438 } 439 440 static inline void emit_kcfi(u32 hash, struct rv_jit_context *ctx) 441 { 442 if (IS_ENABLED(CONFIG_CFI)) 443 emit(hash, ctx); 444 } 445 446 static void emit_ldx_insn(u8 rd, s16 off, u8 rs, u8 size, bool sign_ext, 447 struct rv_jit_context *ctx) 448 { 449 switch (size) { 450 case BPF_B: 451 emit(sign_ext ? rv_lb(rd, off, rs) : rv_lbu(rd, off, rs), ctx); 452 break; 453 case BPF_H: 454 emit(sign_ext ? rv_lh(rd, off, rs) : rv_lhu(rd, off, rs), ctx); 455 break; 456 case BPF_W: 457 emit(sign_ext ? rv_lw(rd, off, rs) : rv_lwu(rd, off, rs), ctx); 458 break; 459 case BPF_DW: 460 emit_ld(rd, off, rs, ctx); 461 break; 462 } 463 464 } 465 466 static void emit_stx_insn(u8 rd, s16 off, u8 rs, u8 size, struct rv_jit_context *ctx) 467 { 468 switch (size) { 469 case BPF_B: 470 emit(rv_sb(rd, off, rs), ctx); 471 break; 472 case BPF_H: 473 emit(rv_sh(rd, off, rs), ctx); 474 break; 475 case BPF_W: 476 emit_sw(rd, off, rs, ctx); 477 break; 478 case BPF_DW: 479 emit_sd(rd, off, rs, ctx); 480 break; 481 } 482 } 483 484 static void emit_ldx(u8 rd, s16 off, u8 rs, u8 size, bool sign_ext, 485 struct rv_jit_context *ctx) 486 { 487 if (is_12b_int(off)) { 488 ctx->ex_insn_off = ctx->ninsns; 489 emit_ldx_insn(rd, off, rs, size, sign_ext, ctx); 490 ctx->ex_jmp_off = ctx->ninsns; 491 return; 492 } 493 494 emit_imm(RV_REG_T1, off, ctx); 495 emit_add(RV_REG_T1, RV_REG_T1, rs, ctx); 496 ctx->ex_insn_off = ctx->ninsns; 497 emit_ldx_insn(rd, 0, RV_REG_T1, size, sign_ext, ctx); 498 ctx->ex_jmp_off = ctx->ninsns; 499 } 500 501 static void emit_st(u8 rd, s16 off, s32 imm, u8 size, struct rv_jit_context *ctx) 502 { 503 emit_imm(RV_REG_T1, imm, ctx); 504 if (is_12b_int(off)) { 505 ctx->ex_insn_off = ctx->ninsns; 506 emit_stx_insn(rd, off, RV_REG_T1, size, ctx); 507 ctx->ex_jmp_off = ctx->ninsns; 508 return; 509 } 510 511 emit_imm(RV_REG_T2, off, ctx); 512 emit_add(RV_REG_T2, RV_REG_T2, rd, ctx); 513 ctx->ex_insn_off = ctx->ninsns; 514 emit_stx_insn(RV_REG_T2, 0, RV_REG_T1, size, ctx); 515 ctx->ex_jmp_off = ctx->ninsns; 516 } 517 518 static void emit_stx(u8 rd, s16 off, u8 rs, u8 size, struct rv_jit_context *ctx) 519 { 520 if (is_12b_int(off)) { 521 ctx->ex_insn_off = ctx->ninsns; 522 emit_stx_insn(rd, off, rs, size, ctx); 523 ctx->ex_jmp_off = ctx->ninsns; 524 return; 525 } 526 527 emit_imm(RV_REG_T1, off, ctx); 528 emit_add(RV_REG_T1, RV_REG_T1, rd, ctx); 529 ctx->ex_insn_off = ctx->ninsns; 530 emit_stx_insn(RV_REG_T1, 0, rs, size, ctx); 531 ctx->ex_jmp_off = ctx->ninsns; 532 } 533 534 static int emit_atomic_ld_st(u8 rd, u8 rs, const struct bpf_insn *insn, 535 struct rv_jit_context *ctx) 536 { 537 u8 code = insn->code; 538 s32 imm = insn->imm; 539 s16 off = insn->off; 540 541 switch (imm) { 542 /* dst_reg = load_acquire(src_reg + off16) */ 543 case BPF_LOAD_ACQ: 544 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 545 emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx); 546 rs = RV_REG_T2; 547 } 548 549 emit_ldx(rd, off, rs, BPF_SIZE(code), false, ctx); 550 emit_fence_r_rw(ctx); 551 552 /* If our next insn is a redundant zext, return 1 to tell 553 * build_body() to skip it. 554 */ 555 if (BPF_SIZE(code) != BPF_DW && insn_is_zext(&insn[1])) 556 return 1; 557 break; 558 /* store_release(dst_reg + off16, src_reg) */ 559 case BPF_STORE_REL: 560 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 561 emit_add(RV_REG_T2, rd, RV_REG_ARENA, ctx); 562 rd = RV_REG_T2; 563 } 564 565 emit_fence_rw_w(ctx); 566 emit_stx(rd, off, rs, BPF_SIZE(code), ctx); 567 break; 568 default: 569 pr_err_once("bpf-jit: invalid atomic load/store opcode %02x\n", imm); 570 return -EINVAL; 571 } 572 573 return 0; 574 } 575 576 static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn, 577 struct rv_jit_context *ctx) 578 { 579 u8 code = insn->code; 580 s16 off = insn->off; 581 s32 imm = insn->imm; 582 bool is64 = BPF_SIZE(code) == BPF_DW; 583 584 if (BPF_SIZE(code) != BPF_W && BPF_SIZE(code) != BPF_DW) { 585 pr_err_once("bpf-jit: 1- and 2-byte RMW atomics are not supported\n"); 586 return -EINVAL; 587 } 588 589 if (off) { 590 if (is_12b_int(off)) { 591 emit_addi(RV_REG_T1, rd, off, ctx); 592 } else { 593 emit_imm(RV_REG_T1, off, ctx); 594 emit_add(RV_REG_T1, RV_REG_T1, rd, ctx); 595 } 596 rd = RV_REG_T1; 597 } 598 599 if (BPF_MODE(code) == BPF_PROBE_ATOMIC) { 600 emit_add(RV_REG_T1, rd, RV_REG_ARENA, ctx); 601 rd = RV_REG_T1; 602 } 603 604 switch (imm) { 605 /* lock *(u32/u64 *)(dst_reg + off16) <op>= src_reg */ 606 case BPF_ADD: 607 ctx->ex_insn_off = ctx->ninsns; 608 emit(is64 ? rv_amoadd_d(RV_REG_ZERO, rs, rd, 0, 0) : 609 rv_amoadd_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 610 ctx->ex_jmp_off = ctx->ninsns; 611 break; 612 case BPF_AND: 613 ctx->ex_insn_off = ctx->ninsns; 614 emit(is64 ? rv_amoand_d(RV_REG_ZERO, rs, rd, 0, 0) : 615 rv_amoand_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 616 ctx->ex_jmp_off = ctx->ninsns; 617 break; 618 case BPF_OR: 619 ctx->ex_insn_off = ctx->ninsns; 620 emit(is64 ? rv_amoor_d(RV_REG_ZERO, rs, rd, 0, 0) : 621 rv_amoor_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 622 ctx->ex_jmp_off = ctx->ninsns; 623 break; 624 case BPF_XOR: 625 ctx->ex_insn_off = ctx->ninsns; 626 emit(is64 ? rv_amoxor_d(RV_REG_ZERO, rs, rd, 0, 0) : 627 rv_amoxor_w(RV_REG_ZERO, rs, rd, 0, 0), ctx); 628 ctx->ex_jmp_off = ctx->ninsns; 629 break; 630 /* src_reg = atomic_fetch_<op>(dst_reg + off16, src_reg) */ 631 case BPF_ADD | BPF_FETCH: 632 ctx->ex_insn_off = ctx->ninsns; 633 emit(is64 ? rv_amoadd_d(rs, rs, rd, 1, 1) : 634 rv_amoadd_w(rs, rs, rd, 1, 1), ctx); 635 ctx->ex_jmp_off = ctx->ninsns; 636 if (!is64) 637 emit_zextw(rs, rs, ctx); 638 break; 639 case BPF_AND | BPF_FETCH: 640 ctx->ex_insn_off = ctx->ninsns; 641 emit(is64 ? rv_amoand_d(rs, rs, rd, 1, 1) : 642 rv_amoand_w(rs, rs, rd, 1, 1), ctx); 643 ctx->ex_jmp_off = ctx->ninsns; 644 if (!is64) 645 emit_zextw(rs, rs, ctx); 646 break; 647 case BPF_OR | BPF_FETCH: 648 ctx->ex_insn_off = ctx->ninsns; 649 emit(is64 ? rv_amoor_d(rs, rs, rd, 1, 1) : 650 rv_amoor_w(rs, rs, rd, 1, 1), ctx); 651 ctx->ex_jmp_off = ctx->ninsns; 652 if (!is64) 653 emit_zextw(rs, rs, ctx); 654 break; 655 case BPF_XOR | BPF_FETCH: 656 ctx->ex_insn_off = ctx->ninsns; 657 emit(is64 ? rv_amoxor_d(rs, rs, rd, 1, 1) : 658 rv_amoxor_w(rs, rs, rd, 1, 1), ctx); 659 ctx->ex_jmp_off = ctx->ninsns; 660 if (!is64) 661 emit_zextw(rs, rs, ctx); 662 break; 663 /* src_reg = atomic_xchg(dst_reg + off16, src_reg); */ 664 case BPF_XCHG: 665 ctx->ex_insn_off = ctx->ninsns; 666 emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) : 667 rv_amoswap_w(rs, rs, rd, 1, 1), ctx); 668 ctx->ex_jmp_off = ctx->ninsns; 669 if (!is64) 670 emit_zextw(rs, rs, ctx); 671 break; 672 /* r0 = atomic_cmpxchg(dst_reg + off16, r0, src_reg); */ 673 case BPF_CMPXCHG: 674 emit_cmpxchg(rd, rs, regmap[BPF_REG_0], is64, ctx); 675 break; 676 default: 677 pr_err_once("bpf-jit: invalid atomic RMW opcode %02x\n", imm); 678 return -EINVAL; 679 } 680 681 return 0; 682 } 683 684 /* 685 * Sign-extend the register if necessary 686 */ 687 static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) 688 { 689 if (!sign && (sz == 1 || sz == 2)) { 690 if (rd != rs) 691 emit_mv(rd, rs, ctx); 692 return 0; 693 } 694 695 switch (sz) { 696 case 1: 697 emit_sextb(rd, rs, ctx); 698 break; 699 case 2: 700 emit_sexth(rd, rs, ctx); 701 break; 702 case 4: 703 emit_sextw(rd, rs, ctx); 704 break; 705 case 8: 706 if (rd != rs) 707 emit_mv(rd, rs, ctx); 708 break; 709 default: 710 pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); 711 return -EINVAL; 712 } 713 714 return 0; 715 } 716 717 #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) 718 #define BPF_FIXUP_REG_MASK GENMASK(31, 27) 719 #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */ 720 721 bool ex_handler_bpf(const struct exception_table_entry *ex, 722 struct pt_regs *regs) 723 { 724 off_t offset = FIELD_GET(BPF_FIXUP_OFFSET_MASK, ex->fixup); 725 int regs_offset = FIELD_GET(BPF_FIXUP_REG_MASK, ex->fixup); 726 727 if (regs_offset != REG_DONT_CLEAR_MARKER) 728 *(unsigned long *)((void *)regs + pt_regmap[regs_offset]) = 0; 729 regs->epc = (unsigned long)&ex->fixup - offset; 730 731 return true; 732 } 733 734 /* For accesses to BTF pointers, add an entry to the exception table */ 735 static int add_exception_handler(const struct bpf_insn *insn, int dst_reg, 736 struct rv_jit_context *ctx) 737 { 738 struct exception_table_entry *ex; 739 unsigned long pc; 740 off_t ins_offset; 741 off_t fixup_offset; 742 743 if (!ctx->insns || !ctx->ro_insns || !ctx->prog->aux->extable || 744 ctx->ex_insn_off <= 0 || ctx->ex_jmp_off <= 0) 745 return 0; 746 747 if (BPF_MODE(insn->code) != BPF_PROBE_MEM && 748 BPF_MODE(insn->code) != BPF_PROBE_MEMSX && 749 BPF_MODE(insn->code) != BPF_PROBE_MEM32 && 750 BPF_MODE(insn->code) != BPF_PROBE_ATOMIC) 751 return 0; 752 753 if (WARN_ON_ONCE(ctx->nexentries >= ctx->prog->aux->num_exentries)) 754 return -EINVAL; 755 756 if (WARN_ON_ONCE(ctx->ex_insn_off > ctx->ninsns || ctx->ex_jmp_off > ctx->ninsns)) 757 return -EINVAL; 758 759 ex = &ctx->prog->aux->extable[ctx->nexentries]; 760 pc = (unsigned long)&ctx->ro_insns[ctx->ex_insn_off]; 761 762 /* 763 * This is the relative offset of the instruction that may fault from 764 * the exception table itself. This will be written to the exception 765 * table and if this instruction faults, the destination register will 766 * be set to '0' and the execution will jump to the next instruction. 767 */ 768 ins_offset = pc - (long)&ex->insn; 769 if (WARN_ON_ONCE(ins_offset >= 0 || ins_offset < INT_MIN)) 770 return -ERANGE; 771 772 /* 773 * Since the extable follows the program, the fixup offset is always 774 * negative and limited to BPF_JIT_REGION_SIZE. Store a positive value 775 * to keep things simple, and put the destination register in the upper 776 * bits. We don't need to worry about buildtime or runtime sort 777 * modifying the upper bits because the table is already sorted, and 778 * isn't part of the main exception table. 779 * 780 * The fixup_offset is set to the next instruction from the instruction 781 * that may fault. The execution will jump to this after handling the 782 * fault. 783 */ 784 fixup_offset = (long)&ex->fixup - (long)&ctx->ro_insns[ctx->ex_jmp_off]; 785 if (!FIELD_FIT(BPF_FIXUP_OFFSET_MASK, fixup_offset)) 786 return -ERANGE; 787 788 /* 789 * The offsets above have been calculated using the RO buffer but we 790 * need to use the R/W buffer for writes. 791 * switch ex to rw buffer for writing. 792 */ 793 ex = (void *)ctx->insns + ((void *)ex - (void *)ctx->ro_insns); 794 795 ex->insn = ins_offset; 796 797 ex->fixup = FIELD_PREP(BPF_FIXUP_OFFSET_MASK, fixup_offset) | 798 FIELD_PREP(BPF_FIXUP_REG_MASK, dst_reg); 799 ex->type = EX_TYPE_BPF; 800 801 ctx->ex_insn_off = 0; 802 ctx->ex_jmp_off = 0; 803 ctx->nexentries++; 804 return 0; 805 } 806 807 static int gen_jump_or_nops(void *target, void *ip, u32 *insns, bool is_call) 808 { 809 s64 rvoff; 810 struct rv_jit_context ctx; 811 812 ctx.ninsns = 0; 813 ctx.insns = (u16 *)insns; 814 815 if (!target) { 816 emit(rv_nop(), &ctx); 817 emit(rv_nop(), &ctx); 818 return 0; 819 } 820 821 rvoff = (s64)(target - ip); 822 return emit_jump_and_link(is_call ? RV_REG_T0 : RV_REG_ZERO, rvoff, false, &ctx); 823 } 824 825 int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t, 826 enum bpf_text_poke_type new_t, void *old_addr, 827 void *new_addr) 828 { 829 u32 old_insns[RV_FENTRY_NINSNS], new_insns[RV_FENTRY_NINSNS]; 830 bool is_call; 831 int ret; 832 833 if (!is_kernel_text((unsigned long)ip) && 834 !is_bpf_text_address((unsigned long)ip)) 835 return -ENOTSUPP; 836 837 is_call = old_t == BPF_MOD_CALL; 838 ret = gen_jump_or_nops(old_addr, ip, old_insns, is_call); 839 if (ret) 840 return ret; 841 842 if (memcmp(ip, old_insns, RV_FENTRY_NBYTES)) 843 return -EFAULT; 844 845 is_call = new_t == BPF_MOD_CALL; 846 ret = gen_jump_or_nops(new_addr, ip, new_insns, is_call); 847 if (ret) 848 return ret; 849 850 cpus_read_lock(); 851 mutex_lock(&text_mutex); 852 if (memcmp(ip, new_insns, RV_FENTRY_NBYTES)) 853 ret = patch_text(ip, new_insns, RV_FENTRY_NBYTES); 854 mutex_unlock(&text_mutex); 855 cpus_read_unlock(); 856 857 return ret; 858 } 859 860 static void store_args(int nr_arg_slots, int args_off, struct rv_jit_context *ctx) 861 { 862 int i; 863 864 for (i = 0; i < nr_arg_slots; i++) { 865 if (i < RV_MAX_REG_ARGS) { 866 emit_sd(RV_REG_FP, -args_off, RV_REG_A0 + i, ctx); 867 } else { 868 /* skip slots for T0 and FP of traced function */ 869 emit_ld(RV_REG_T1, 16 + (i - RV_MAX_REG_ARGS) * 8, RV_REG_FP, ctx); 870 emit_sd(RV_REG_FP, -args_off, RV_REG_T1, ctx); 871 } 872 args_off -= 8; 873 } 874 } 875 876 static void restore_args(int nr_reg_args, int args_off, struct rv_jit_context *ctx) 877 { 878 int i; 879 880 for (i = 0; i < nr_reg_args; i++) { 881 emit_ld(RV_REG_A0 + i, -args_off, RV_REG_FP, ctx); 882 args_off -= 8; 883 } 884 } 885 886 static void restore_stack_args(int nr_stack_args, int args_off, int stk_arg_off, 887 struct rv_jit_context *ctx) 888 { 889 int i; 890 891 for (i = 0; i < nr_stack_args; i++) { 892 emit_ld(RV_REG_T1, -(args_off - RV_MAX_REG_ARGS * 8), RV_REG_FP, ctx); 893 emit_sd(RV_REG_FP, -stk_arg_off, RV_REG_T1, ctx); 894 args_off -= 8; 895 stk_arg_off -= 8; 896 } 897 } 898 899 static void emit_store_stack_imm64(u8 reg, int stack_off, u64 imm64, 900 struct rv_jit_context *ctx) 901 { 902 /* Load imm64 into reg and store it at [FP + stack_off]. */ 903 emit_imm(reg, (s64)imm64, ctx); 904 emit_sd(RV_REG_FP, stack_off, reg, ctx); 905 } 906 907 static int invoke_bpf_prog(struct bpf_tramp_node *node, int args_off, int retval_off, 908 int run_ctx_off, bool save_ret, struct rv_jit_context *ctx) 909 { 910 int ret, branch_off; 911 struct bpf_prog *p = node->link->prog; 912 int cookie_off = offsetof(struct bpf_tramp_run_ctx, bpf_cookie); 913 914 if (node->cookie) 915 emit_store_stack_imm64(RV_REG_T1, -run_ctx_off + cookie_off, node->cookie, ctx); 916 else 917 emit_sd(RV_REG_FP, -run_ctx_off + cookie_off, RV_REG_ZERO, ctx); 918 919 /* arg1: prog */ 920 emit_imm(RV_REG_A0, (const s64)p, ctx); 921 /* arg2: &run_ctx */ 922 emit_addi(RV_REG_A1, RV_REG_FP, -run_ctx_off, ctx); 923 ret = emit_call((const u64)bpf_trampoline_enter(p), true, ctx); 924 if (ret) 925 return ret; 926 927 /* store prog start time */ 928 emit_mv(RV_REG_S1, RV_REG_A0, ctx); 929 930 /* if (__bpf_prog_enter(prog) == 0) 931 * goto skip_exec_of_prog; 932 */ 933 branch_off = ctx->ninsns; 934 /* nop reserved for conditional jump */ 935 emit(rv_nop(), ctx); 936 937 /* arg1: &args_off */ 938 emit_addi(RV_REG_A0, RV_REG_FP, -args_off, ctx); 939 if (!p->jited) 940 /* arg2: progs[i]->insnsi for interpreter */ 941 emit_imm(RV_REG_A1, (const s64)p->insnsi, ctx); 942 ret = emit_call((const u64)p->bpf_func, true, ctx); 943 if (ret) 944 return ret; 945 946 if (save_ret) { 947 emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx); 948 emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx); 949 } 950 951 /* update branch with beqz */ 952 if (ctx->insns) { 953 int offset = ninsns_rvoff(ctx->ninsns - branch_off); 954 u32 insn = rv_beq(RV_REG_A0, RV_REG_ZERO, offset >> 1); 955 *(u32 *)(ctx->insns + branch_off) = insn; 956 } 957 958 /* arg1: prog */ 959 emit_imm(RV_REG_A0, (const s64)p, ctx); 960 /* arg2: prog start time */ 961 emit_mv(RV_REG_A1, RV_REG_S1, ctx); 962 /* arg3: &run_ctx */ 963 emit_addi(RV_REG_A2, RV_REG_FP, -run_ctx_off, ctx); 964 ret = emit_call((const u64)bpf_trampoline_exit(p), true, ctx); 965 966 return ret; 967 } 968 969 static int invoke_bpf(struct bpf_tramp_nodes *tn, int args_off, int retval_off, 970 int run_ctx_off, int func_meta_off, bool save_ret, u64 func_meta, 971 int cookie_off, struct rv_jit_context *ctx) 972 { 973 int i, cur_cookie = (cookie_off - args_off) / 8; 974 975 for (i = 0; i < tn->nr_nodes; i++) { 976 int err; 977 978 if (bpf_prog_calls_session_cookie(tn->nodes[i])) { 979 u64 meta = func_meta | ((u64)cur_cookie << BPF_TRAMP_COOKIE_INDEX_SHIFT); 980 981 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, meta, ctx); 982 cur_cookie--; 983 } 984 err = invoke_bpf_prog(tn->nodes[i], args_off, retval_off, run_ctx_off, 985 save_ret, ctx); 986 if (err) 987 return err; 988 } 989 return 0; 990 } 991 992 static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, 993 const struct btf_func_model *m, 994 struct bpf_tramp_nodes *tnodes, 995 void *func_addr, u32 flags, 996 struct rv_jit_context *ctx) 997 { 998 int i, ret, offset; 999 int *branches_off = NULL; 1000 int stack_size = 0, nr_arg_slots = 0; 1001 int retval_off, args_off, func_meta_off, ip_off; 1002 int run_ctx_off, sreg_off, stk_arg_off, tcc_off; 1003 int cookie_off, cookie_cnt; 1004 struct bpf_tramp_nodes *fentry = &tnodes[BPF_TRAMP_FENTRY]; 1005 struct bpf_tramp_nodes *fexit = &tnodes[BPF_TRAMP_FEXIT]; 1006 struct bpf_tramp_nodes *fmod_ret = &tnodes[BPF_TRAMP_MODIFY_RETURN]; 1007 bool is_struct_ops = is_struct_ops_tramp(fentry); 1008 void *orig_call = func_addr; 1009 bool save_ret; 1010 u64 func_meta; 1011 u32 insn; 1012 1013 /* Two types of generated trampoline stack layout: 1014 * 1015 * 1. trampoline called from function entry 1016 * -------------------------------------- 1017 * FP + 8 [ RA to parent func ] return address to parent 1018 * function 1019 * FP + 0 [ FP of parent func ] frame pointer of parent 1020 * function 1021 * FP - 8 [ T0 to traced func ] return address of traced 1022 * function 1023 * FP - 16 [ FP of traced func ] frame pointer of traced 1024 * function 1025 * -------------------------------------- 1026 * 1027 * 2. trampoline called directly 1028 * -------------------------------------- 1029 * FP - 8 [ RA to caller func ] return address to caller 1030 * function 1031 * FP - 16 [ FP of caller func ] frame pointer of caller 1032 * function 1033 * -------------------------------------- 1034 * 1035 * FP - retval_off [ return value ] BPF_TRAMP_F_CALL_ORIG or 1036 * BPF_TRAMP_F_RET_FENTRY_RET 1037 * [ argN ] 1038 * [ ... ] 1039 * FP - args_off [ arg1 ] 1040 * 1041 * FP - func_meta_off [ regs count, etc ] 1042 * 1043 * FP - ip_off [ traced func ] BPF_TRAMP_F_IP_ARG 1044 * 1045 * [ stack cookie N ] 1046 * [ ... ] 1047 * FP - cookie_off [ stack cookie 1 ] 1048 * 1049 * FP - run_ctx_off [ bpf_tramp_run_ctx ] 1050 * 1051 * FP - sreg_off [ callee saved reg ] 1052 * 1053 * FP - tcc_off [ tail call count ] BPF_TRAMP_F_TAIL_CALL_CTX 1054 * 1055 * [ pads ] pads for 16 bytes alignment 1056 * 1057 * [ stack_argN ] 1058 * [ ... ] 1059 * FP - stk_arg_off [ stack_arg1 ] BPF_TRAMP_F_CALL_ORIG 1060 */ 1061 1062 if (flags & (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY)) 1063 return -ENOTSUPP; 1064 1065 if (m->nr_args > MAX_BPF_FUNC_ARGS) 1066 return -ENOTSUPP; 1067 1068 for (i = 0; i < m->nr_args; i++) 1069 nr_arg_slots += round_up(m->arg_size[i], 8) / 8; 1070 1071 /* room of trampoline frame to store return address and frame pointer */ 1072 stack_size += 16; 1073 1074 save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET); 1075 if (save_ret) 1076 stack_size += 16; /* Save both A5 (BPF R0) and A0 */ 1077 retval_off = stack_size; 1078 1079 stack_size += nr_arg_slots * 8; 1080 args_off = stack_size; 1081 1082 /* function metadata, such as regs count */ 1083 stack_size += 8; 1084 func_meta_off = stack_size; 1085 1086 if (flags & BPF_TRAMP_F_IP_ARG) { 1087 stack_size += 8; 1088 ip_off = stack_size; 1089 } 1090 1091 cookie_cnt = bpf_fsession_cookie_cnt(tnodes); 1092 /* room for session cookies */ 1093 stack_size += cookie_cnt * 8; 1094 cookie_off = stack_size; 1095 1096 stack_size += round_up(sizeof(struct bpf_tramp_run_ctx), 8); 1097 run_ctx_off = stack_size; 1098 1099 stack_size += 8; 1100 sreg_off = stack_size; 1101 1102 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) { 1103 stack_size += 8; 1104 tcc_off = stack_size; 1105 } 1106 1107 if ((flags & BPF_TRAMP_F_CALL_ORIG) && (nr_arg_slots - RV_MAX_REG_ARGS > 0)) 1108 stack_size += (nr_arg_slots - RV_MAX_REG_ARGS) * 8; 1109 1110 stack_size = round_up(stack_size, STACK_ALIGN); 1111 1112 /* room for args on stack must be at the top of stack */ 1113 stk_arg_off = stack_size; 1114 1115 if (!is_struct_ops) { 1116 /* For the trampoline called from function entry, 1117 * the frame of traced function and the frame of 1118 * trampoline need to be considered. 1119 */ 1120 emit_addi(RV_REG_SP, RV_REG_SP, -16, ctx); 1121 emit_sd(RV_REG_SP, 8, RV_REG_RA, ctx); 1122 emit_sd(RV_REG_SP, 0, RV_REG_FP, ctx); 1123 emit_addi(RV_REG_FP, RV_REG_SP, 16, ctx); 1124 1125 emit_addi(RV_REG_SP, RV_REG_SP, -stack_size, ctx); 1126 emit_sd(RV_REG_SP, stack_size - 8, RV_REG_T0, ctx); 1127 emit_sd(RV_REG_SP, stack_size - 16, RV_REG_FP, ctx); 1128 emit_addi(RV_REG_FP, RV_REG_SP, stack_size, ctx); 1129 } else { 1130 /* emit kcfi hash */ 1131 emit_kcfi(cfi_get_func_hash(func_addr), ctx); 1132 /* For the trampoline called directly, just handle 1133 * the frame of trampoline. 1134 */ 1135 emit_addi(RV_REG_SP, RV_REG_SP, -stack_size, ctx); 1136 emit_sd(RV_REG_SP, stack_size - 8, RV_REG_RA, ctx); 1137 emit_sd(RV_REG_SP, stack_size - 16, RV_REG_FP, ctx); 1138 emit_addi(RV_REG_FP, RV_REG_SP, stack_size, ctx); 1139 } 1140 1141 /* store tail call count */ 1142 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1143 emit_sd(RV_REG_FP, -tcc_off, RV_REG_TCC, ctx); 1144 1145 /* callee saved register S1 to pass start time */ 1146 emit_sd(RV_REG_FP, -sreg_off, RV_REG_S1, ctx); 1147 1148 /* store ip address of the traced function */ 1149 if (flags & BPF_TRAMP_F_IP_ARG) 1150 emit_store_stack_imm64(RV_REG_T1, -ip_off, (u64)func_addr, ctx); 1151 1152 func_meta = nr_arg_slots; 1153 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx); 1154 1155 store_args(nr_arg_slots, args_off, ctx); 1156 1157 if (bpf_fsession_cnt(tnodes)) { 1158 /* clear all session cookies' value */ 1159 for (i = 0; i < cookie_cnt; i++) 1160 emit_sd(RV_REG_FP, -cookie_off + 8 * i, RV_REG_ZERO, ctx); 1161 /* clear return value to make sure fentry always get 0 */ 1162 emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx); 1163 } 1164 1165 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1166 emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); 1167 ret = emit_call((const u64)__bpf_tramp_enter, true, ctx); 1168 if (ret) 1169 return ret; 1170 } 1171 1172 if (fentry->nr_nodes) { 1173 ret = invoke_bpf(fentry, args_off, retval_off, run_ctx_off, func_meta_off, 1174 flags & BPF_TRAMP_F_RET_FENTRY_RET, func_meta, cookie_off, ctx); 1175 if (ret) 1176 return ret; 1177 } 1178 1179 if (fmod_ret->nr_nodes) { 1180 branches_off = kvzalloc_objs(int, fmod_ret->nr_nodes); 1181 if (!branches_off) 1182 return -ENOMEM; 1183 1184 /* cleanup to avoid garbage return value confusion */ 1185 emit_sd(RV_REG_FP, -retval_off, RV_REG_ZERO, ctx); 1186 for (i = 0; i < fmod_ret->nr_nodes; i++) { 1187 ret = invoke_bpf_prog(fmod_ret->nodes[i], args_off, retval_off, 1188 run_ctx_off, true, ctx); 1189 if (ret) 1190 goto out; 1191 emit_ld(RV_REG_T1, -retval_off, RV_REG_FP, ctx); 1192 branches_off[i] = ctx->ninsns; 1193 /* nop reserved for conditional jump */ 1194 emit(rv_nop(), ctx); 1195 } 1196 } 1197 1198 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1199 /* skip to actual body of traced function */ 1200 orig_call += RV_FENTRY_NINSNS * 4; 1201 restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); 1202 restore_stack_args(nr_arg_slots - RV_MAX_REG_ARGS, args_off, stk_arg_off, ctx); 1203 /* restore TCC to RV_REG_TCC before calling the orig bpf func */ 1204 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1205 emit_ld(RV_REG_TCC, -tcc_off, RV_REG_FP, ctx); 1206 ret = emit_call((const u64)orig_call, true, ctx); 1207 if (ret) 1208 goto out; 1209 /* store updated TCC back to stack after calling the orig bpf func */ 1210 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1211 emit_sd(RV_REG_FP, -tcc_off, RV_REG_TCC, ctx); 1212 emit_sd(RV_REG_FP, -retval_off, RV_REG_A0, ctx); 1213 emit_sd(RV_REG_FP, -(retval_off - 8), regmap[BPF_REG_0], ctx); 1214 im->ip_after_call = ctx->ro_insns + ctx->ninsns; 1215 /* 2 nops reserved for auipc+jalr pair */ 1216 emit(rv_nop(), ctx); 1217 emit(rv_nop(), ctx); 1218 } 1219 1220 /* update branches saved in invoke_bpf_mod_ret with bnez */ 1221 for (i = 0; ctx->insns && i < fmod_ret->nr_nodes; i++) { 1222 offset = ninsns_rvoff(ctx->ninsns - branches_off[i]); 1223 insn = rv_bne(RV_REG_T1, RV_REG_ZERO, offset >> 1); 1224 *(u32 *)(ctx->insns + branches_off[i]) = insn; 1225 } 1226 1227 /* set "is_return" flag for fsession */ 1228 func_meta |= (1ULL << BPF_TRAMP_IS_RETURN_SHIFT); 1229 if (bpf_fsession_cnt(tnodes)) 1230 emit_store_stack_imm64(RV_REG_T1, -func_meta_off, func_meta, ctx); 1231 1232 if (fexit->nr_nodes) { 1233 ret = invoke_bpf(fexit, args_off, retval_off, run_ctx_off, func_meta_off, 1234 false, func_meta, cookie_off, ctx); 1235 if (ret) 1236 goto out; 1237 } 1238 1239 if (flags & BPF_TRAMP_F_CALL_ORIG) { 1240 im->ip_epilogue = ctx->ro_insns + ctx->ninsns; 1241 emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); 1242 ret = emit_call((const u64)__bpf_tramp_exit, true, ctx); 1243 if (ret) 1244 goto out; 1245 } 1246 1247 if (flags & BPF_TRAMP_F_RESTORE_REGS) 1248 restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx); 1249 1250 if (save_ret) { 1251 emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); 1252 if (is_struct_ops) { 1253 ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, 1254 m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); 1255 if (ret) 1256 goto out; 1257 } else { 1258 emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); 1259 } 1260 } 1261 1262 emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); 1263 1264 /* restore TCC from stack to RV_REG_TCC */ 1265 if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) 1266 emit_ld(RV_REG_TCC, -tcc_off, RV_REG_FP, ctx); 1267 1268 if (!is_struct_ops) { 1269 /* trampoline called from function entry */ 1270 emit_ld(RV_REG_T0, stack_size - 8, RV_REG_SP, ctx); 1271 emit_ld(RV_REG_FP, stack_size - 16, RV_REG_SP, ctx); 1272 emit_addi(RV_REG_SP, RV_REG_SP, stack_size, ctx); 1273 1274 emit_ld(RV_REG_RA, 8, RV_REG_SP, ctx); 1275 emit_ld(RV_REG_FP, 0, RV_REG_SP, ctx); 1276 emit_addi(RV_REG_SP, RV_REG_SP, 16, ctx); 1277 1278 if (flags & BPF_TRAMP_F_SKIP_FRAME) 1279 /* return to parent function */ 1280 emit_jalr(RV_REG_ZERO, RV_REG_RA, 0, ctx); 1281 else 1282 /* return to traced function */ 1283 emit_jalr(RV_REG_ZERO, RV_REG_T0, 0, ctx); 1284 } else { 1285 /* trampoline called directly */ 1286 emit_ld(RV_REG_RA, stack_size - 8, RV_REG_SP, ctx); 1287 emit_ld(RV_REG_FP, stack_size - 16, RV_REG_SP, ctx); 1288 emit_addi(RV_REG_SP, RV_REG_SP, stack_size, ctx); 1289 1290 emit_jalr(RV_REG_ZERO, RV_REG_RA, 0, ctx); 1291 } 1292 1293 ret = ctx->ninsns; 1294 out: 1295 kvfree(branches_off); 1296 return ret; 1297 } 1298 1299 int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags, 1300 struct bpf_tramp_nodes *tnodes, void *func_addr) 1301 { 1302 struct bpf_tramp_image im; 1303 struct rv_jit_context ctx; 1304 int ret; 1305 1306 ctx.ninsns = 0; 1307 ctx.insns = NULL; 1308 ctx.ro_insns = NULL; 1309 ret = __arch_prepare_bpf_trampoline(&im, m, tnodes, func_addr, flags, &ctx); 1310 1311 return ret < 0 ? ret : ninsns_rvoff(ctx.ninsns); 1312 } 1313 1314 void *arch_alloc_bpf_trampoline(unsigned int size) 1315 { 1316 return bpf_prog_pack_alloc(size, bpf_fill_ill_insns, false); 1317 } 1318 1319 void arch_free_bpf_trampoline(void *image, unsigned int size) 1320 { 1321 bpf_prog_pack_free(image, size); 1322 } 1323 1324 int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *ro_image, 1325 void *ro_image_end, const struct btf_func_model *m, 1326 u32 flags, struct bpf_tramp_nodes *tnodes, 1327 void *func_addr) 1328 { 1329 int ret; 1330 void *image, *res; 1331 struct rv_jit_context ctx; 1332 u32 size = ro_image_end - ro_image; 1333 1334 image = kvmalloc(size, GFP_KERNEL); 1335 if (!image) 1336 return -ENOMEM; 1337 1338 ctx.ninsns = 0; 1339 ctx.insns = image; 1340 ctx.ro_insns = ro_image; 1341 ret = __arch_prepare_bpf_trampoline(im, m, tnodes, func_addr, flags, &ctx); 1342 if (ret < 0) 1343 goto out; 1344 1345 if (WARN_ON(size < ninsns_rvoff(ctx.ninsns))) { 1346 ret = -E2BIG; 1347 goto out; 1348 } 1349 1350 res = bpf_arch_text_copy(ro_image, image, size); 1351 if (IS_ERR(res)) { 1352 ret = PTR_ERR(res); 1353 goto out; 1354 } 1355 1356 out: 1357 kvfree(image); 1358 return ret < 0 ? ret : size; 1359 } 1360 1361 int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx, 1362 bool extra_pass) 1363 { 1364 bool is64 = BPF_CLASS(insn->code) == BPF_ALU64 || 1365 BPF_CLASS(insn->code) == BPF_JMP; 1366 int s, e, rvoff, ret, i = insn - ctx->prog->insnsi; 1367 struct bpf_prog_aux *aux = ctx->prog->aux; 1368 u8 rd = -1, rs = -1, code = insn->code; 1369 s16 off = insn->off; 1370 s32 imm = insn->imm; 1371 1372 init_regs(&rd, &rs, insn, ctx); 1373 1374 switch (code) { 1375 /* dst = src */ 1376 case BPF_ALU | BPF_MOV | BPF_X: 1377 case BPF_ALU64 | BPF_MOV | BPF_X: 1378 if (insn_is_cast_user(insn)) { 1379 emit_mv(RV_REG_T1, rs, ctx); 1380 emit_zextw(RV_REG_T1, RV_REG_T1, ctx); 1381 emit_imm(rd, (ctx->user_vm_start >> 32) << 32, ctx); 1382 emit(rv_beq(RV_REG_T1, RV_REG_ZERO, 4), ctx); 1383 emit_or(RV_REG_T1, rd, RV_REG_T1, ctx); 1384 emit_mv(rd, RV_REG_T1, ctx); 1385 break; 1386 } else if (insn_is_mov_percpu_addr(insn)) { 1387 if (rd != rs) 1388 emit_mv(rd, rs, ctx); 1389 #ifdef CONFIG_SMP 1390 /* Load current CPU number in T1 */ 1391 emit_lw(RV_REG_T1, offsetof(struct thread_info, cpu), 1392 RV_REG_TP, ctx); 1393 /* Load address of __per_cpu_offset array in T2 */ 1394 emit_addr(RV_REG_T2, (u64)&__per_cpu_offset, extra_pass, ctx); 1395 /* Get address of __per_cpu_offset[cpu] in T1 */ 1396 emit_sh3add(RV_REG_T1, RV_REG_T1, RV_REG_T2, ctx); 1397 /* Load __per_cpu_offset[cpu] in T1 */ 1398 emit_ld(RV_REG_T1, 0, RV_REG_T1, ctx); 1399 /* Add the offset to Rd */ 1400 emit_add(rd, rd, RV_REG_T1, ctx); 1401 #endif 1402 } 1403 if (imm == 1) { 1404 /* Special mov32 for zext */ 1405 emit_zextw(rd, rd, ctx); 1406 break; 1407 } 1408 switch (insn->off) { 1409 case 0: 1410 emit_mv(rd, rs, ctx); 1411 break; 1412 case 8: 1413 emit_sextb(rd, rs, ctx); 1414 break; 1415 case 16: 1416 emit_sexth(rd, rs, ctx); 1417 break; 1418 case 32: 1419 emit_sextw(rd, rs, ctx); 1420 break; 1421 } 1422 if (!is64 && !aux->verifier_zext) 1423 emit_zextw(rd, rd, ctx); 1424 break; 1425 1426 /* dst = dst OP src */ 1427 case BPF_ALU | BPF_ADD | BPF_X: 1428 case BPF_ALU64 | BPF_ADD | BPF_X: 1429 emit_add(rd, rd, rs, ctx); 1430 if (!is64 && !aux->verifier_zext) 1431 emit_zextw(rd, rd, ctx); 1432 break; 1433 case BPF_ALU | BPF_SUB | BPF_X: 1434 case BPF_ALU64 | BPF_SUB | BPF_X: 1435 if (is64) 1436 emit_sub(rd, rd, rs, ctx); 1437 else 1438 emit_subw(rd, rd, rs, ctx); 1439 1440 if (!is64 && !aux->verifier_zext) 1441 emit_zextw(rd, rd, ctx); 1442 break; 1443 case BPF_ALU | BPF_AND | BPF_X: 1444 case BPF_ALU64 | BPF_AND | BPF_X: 1445 emit_and(rd, rd, rs, ctx); 1446 if (!is64 && !aux->verifier_zext) 1447 emit_zextw(rd, rd, ctx); 1448 break; 1449 case BPF_ALU | BPF_OR | BPF_X: 1450 case BPF_ALU64 | BPF_OR | BPF_X: 1451 emit_or(rd, rd, rs, ctx); 1452 if (!is64 && !aux->verifier_zext) 1453 emit_zextw(rd, rd, ctx); 1454 break; 1455 case BPF_ALU | BPF_XOR | BPF_X: 1456 case BPF_ALU64 | BPF_XOR | BPF_X: 1457 emit_xor(rd, rd, rs, ctx); 1458 if (!is64 && !aux->verifier_zext) 1459 emit_zextw(rd, rd, ctx); 1460 break; 1461 case BPF_ALU | BPF_MUL | BPF_X: 1462 case BPF_ALU64 | BPF_MUL | BPF_X: 1463 emit(is64 ? rv_mul(rd, rd, rs) : rv_mulw(rd, rd, rs), ctx); 1464 if (!is64 && !aux->verifier_zext) 1465 emit_zextw(rd, rd, ctx); 1466 break; 1467 case BPF_ALU | BPF_DIV | BPF_X: 1468 case BPF_ALU64 | BPF_DIV | BPF_X: 1469 if (off) 1470 emit(is64 ? rv_div(rd, rd, rs) : rv_divw(rd, rd, rs), ctx); 1471 else 1472 emit(is64 ? rv_divu(rd, rd, rs) : rv_divuw(rd, rd, rs), ctx); 1473 if (!is64 && !aux->verifier_zext) 1474 emit_zextw(rd, rd, ctx); 1475 break; 1476 case BPF_ALU | BPF_MOD | BPF_X: 1477 case BPF_ALU64 | BPF_MOD | BPF_X: 1478 if (off) 1479 emit(is64 ? rv_rem(rd, rd, rs) : rv_remw(rd, rd, rs), ctx); 1480 else 1481 emit(is64 ? rv_remu(rd, rd, rs) : rv_remuw(rd, rd, rs), ctx); 1482 if (!is64 && !aux->verifier_zext) 1483 emit_zextw(rd, rd, ctx); 1484 break; 1485 case BPF_ALU | BPF_LSH | BPF_X: 1486 case BPF_ALU64 | BPF_LSH | BPF_X: 1487 emit(is64 ? rv_sll(rd, rd, rs) : rv_sllw(rd, rd, rs), ctx); 1488 if (!is64 && !aux->verifier_zext) 1489 emit_zextw(rd, rd, ctx); 1490 break; 1491 case BPF_ALU | BPF_RSH | BPF_X: 1492 case BPF_ALU64 | BPF_RSH | BPF_X: 1493 emit(is64 ? rv_srl(rd, rd, rs) : rv_srlw(rd, rd, rs), ctx); 1494 if (!is64 && !aux->verifier_zext) 1495 emit_zextw(rd, rd, ctx); 1496 break; 1497 case BPF_ALU | BPF_ARSH | BPF_X: 1498 case BPF_ALU64 | BPF_ARSH | BPF_X: 1499 emit(is64 ? rv_sra(rd, rd, rs) : rv_sraw(rd, rd, rs), ctx); 1500 if (!is64 && !aux->verifier_zext) 1501 emit_zextw(rd, rd, ctx); 1502 break; 1503 1504 /* dst = -dst */ 1505 case BPF_ALU | BPF_NEG: 1506 case BPF_ALU64 | BPF_NEG: 1507 emit_sub(rd, RV_REG_ZERO, rd, ctx); 1508 if (!is64 && !aux->verifier_zext) 1509 emit_zextw(rd, rd, ctx); 1510 break; 1511 1512 /* dst = BSWAP##imm(dst) */ 1513 case BPF_ALU | BPF_END | BPF_FROM_LE: 1514 switch (imm) { 1515 case 16: 1516 emit_zexth(rd, rd, ctx); 1517 break; 1518 case 32: 1519 if (!aux->verifier_zext) 1520 emit_zextw(rd, rd, ctx); 1521 break; 1522 case 64: 1523 /* Do nothing */ 1524 break; 1525 } 1526 break; 1527 case BPF_ALU | BPF_END | BPF_FROM_BE: 1528 case BPF_ALU64 | BPF_END | BPF_FROM_LE: 1529 emit_bswap(rd, imm, ctx); 1530 break; 1531 1532 /* dst = imm */ 1533 case BPF_ALU | BPF_MOV | BPF_K: 1534 case BPF_ALU64 | BPF_MOV | BPF_K: 1535 emit_imm(rd, imm, ctx); 1536 if (!is64 && !aux->verifier_zext) 1537 emit_zextw(rd, rd, ctx); 1538 break; 1539 1540 /* dst = dst OP imm */ 1541 case BPF_ALU | BPF_ADD | BPF_K: 1542 case BPF_ALU64 | BPF_ADD | BPF_K: 1543 if (is_12b_int(imm)) { 1544 emit_addi(rd, rd, imm, ctx); 1545 } else { 1546 emit_imm(RV_REG_T1, imm, ctx); 1547 emit_add(rd, rd, RV_REG_T1, ctx); 1548 } 1549 if (!is64 && !aux->verifier_zext) 1550 emit_zextw(rd, rd, ctx); 1551 break; 1552 case BPF_ALU | BPF_SUB | BPF_K: 1553 case BPF_ALU64 | BPF_SUB | BPF_K: 1554 if (is_12b_int(-imm)) { 1555 emit_addi(rd, rd, -imm, ctx); 1556 } else { 1557 emit_imm(RV_REG_T1, imm, ctx); 1558 emit_sub(rd, rd, RV_REG_T1, ctx); 1559 } 1560 if (!is64 && !aux->verifier_zext) 1561 emit_zextw(rd, rd, ctx); 1562 break; 1563 case BPF_ALU | BPF_AND | BPF_K: 1564 case BPF_ALU64 | BPF_AND | BPF_K: 1565 if (is_12b_int(imm)) { 1566 emit_andi(rd, rd, imm, ctx); 1567 } else { 1568 emit_imm(RV_REG_T1, imm, ctx); 1569 emit_and(rd, rd, RV_REG_T1, ctx); 1570 } 1571 if (!is64 && !aux->verifier_zext) 1572 emit_zextw(rd, rd, ctx); 1573 break; 1574 case BPF_ALU | BPF_OR | BPF_K: 1575 case BPF_ALU64 | BPF_OR | BPF_K: 1576 if (is_12b_int(imm)) { 1577 emit(rv_ori(rd, rd, imm), ctx); 1578 } else { 1579 emit_imm(RV_REG_T1, imm, ctx); 1580 emit_or(rd, rd, RV_REG_T1, ctx); 1581 } 1582 if (!is64 && !aux->verifier_zext) 1583 emit_zextw(rd, rd, ctx); 1584 break; 1585 case BPF_ALU | BPF_XOR | BPF_K: 1586 case BPF_ALU64 | BPF_XOR | BPF_K: 1587 if (is_12b_int(imm)) { 1588 emit(rv_xori(rd, rd, imm), ctx); 1589 } else { 1590 emit_imm(RV_REG_T1, imm, ctx); 1591 emit_xor(rd, rd, RV_REG_T1, ctx); 1592 } 1593 if (!is64 && !aux->verifier_zext) 1594 emit_zextw(rd, rd, ctx); 1595 break; 1596 case BPF_ALU | BPF_MUL | BPF_K: 1597 case BPF_ALU64 | BPF_MUL | BPF_K: 1598 emit_imm(RV_REG_T1, imm, ctx); 1599 emit(is64 ? rv_mul(rd, rd, RV_REG_T1) : 1600 rv_mulw(rd, rd, RV_REG_T1), ctx); 1601 if (!is64 && !aux->verifier_zext) 1602 emit_zextw(rd, rd, ctx); 1603 break; 1604 case BPF_ALU | BPF_DIV | BPF_K: 1605 case BPF_ALU64 | BPF_DIV | BPF_K: 1606 emit_imm(RV_REG_T1, imm, ctx); 1607 if (off) 1608 emit(is64 ? rv_div(rd, rd, RV_REG_T1) : 1609 rv_divw(rd, rd, RV_REG_T1), ctx); 1610 else 1611 emit(is64 ? rv_divu(rd, rd, RV_REG_T1) : 1612 rv_divuw(rd, rd, RV_REG_T1), ctx); 1613 if (!is64 && !aux->verifier_zext) 1614 emit_zextw(rd, rd, ctx); 1615 break; 1616 case BPF_ALU | BPF_MOD | BPF_K: 1617 case BPF_ALU64 | BPF_MOD | BPF_K: 1618 emit_imm(RV_REG_T1, imm, ctx); 1619 if (off) 1620 emit(is64 ? rv_rem(rd, rd, RV_REG_T1) : 1621 rv_remw(rd, rd, RV_REG_T1), ctx); 1622 else 1623 emit(is64 ? rv_remu(rd, rd, RV_REG_T1) : 1624 rv_remuw(rd, rd, RV_REG_T1), ctx); 1625 if (!is64 && !aux->verifier_zext) 1626 emit_zextw(rd, rd, ctx); 1627 break; 1628 case BPF_ALU | BPF_LSH | BPF_K: 1629 case BPF_ALU64 | BPF_LSH | BPF_K: 1630 emit_slli(rd, rd, imm, ctx); 1631 1632 if (!is64 && !aux->verifier_zext) 1633 emit_zextw(rd, rd, ctx); 1634 break; 1635 case BPF_ALU | BPF_RSH | BPF_K: 1636 case BPF_ALU64 | BPF_RSH | BPF_K: 1637 if (is64) 1638 emit_srli(rd, rd, imm, ctx); 1639 else 1640 emit(rv_srliw(rd, rd, imm), ctx); 1641 1642 if (!is64 && !aux->verifier_zext) 1643 emit_zextw(rd, rd, ctx); 1644 break; 1645 case BPF_ALU | BPF_ARSH | BPF_K: 1646 case BPF_ALU64 | BPF_ARSH | BPF_K: 1647 if (is64) 1648 emit_srai(rd, rd, imm, ctx); 1649 else 1650 emit(rv_sraiw(rd, rd, imm), ctx); 1651 1652 if (!is64 && !aux->verifier_zext) 1653 emit_zextw(rd, rd, ctx); 1654 break; 1655 1656 /* JUMP off */ 1657 case BPF_JMP | BPF_JA: 1658 case BPF_JMP32 | BPF_JA: 1659 if (BPF_CLASS(code) == BPF_JMP) 1660 rvoff = rv_offset(i, off, ctx); 1661 else 1662 rvoff = rv_offset(i, imm, ctx); 1663 ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx); 1664 if (ret) 1665 return ret; 1666 break; 1667 1668 /* IF (dst COND src) JUMP off */ 1669 case BPF_JMP | BPF_JEQ | BPF_X: 1670 case BPF_JMP32 | BPF_JEQ | BPF_X: 1671 case BPF_JMP | BPF_JGT | BPF_X: 1672 case BPF_JMP32 | BPF_JGT | BPF_X: 1673 case BPF_JMP | BPF_JLT | BPF_X: 1674 case BPF_JMP32 | BPF_JLT | BPF_X: 1675 case BPF_JMP | BPF_JGE | BPF_X: 1676 case BPF_JMP32 | BPF_JGE | BPF_X: 1677 case BPF_JMP | BPF_JLE | BPF_X: 1678 case BPF_JMP32 | BPF_JLE | BPF_X: 1679 case BPF_JMP | BPF_JNE | BPF_X: 1680 case BPF_JMP32 | BPF_JNE | BPF_X: 1681 case BPF_JMP | BPF_JSGT | BPF_X: 1682 case BPF_JMP32 | BPF_JSGT | BPF_X: 1683 case BPF_JMP | BPF_JSLT | BPF_X: 1684 case BPF_JMP32 | BPF_JSLT | BPF_X: 1685 case BPF_JMP | BPF_JSGE | BPF_X: 1686 case BPF_JMP32 | BPF_JSGE | BPF_X: 1687 case BPF_JMP | BPF_JSLE | BPF_X: 1688 case BPF_JMP32 | BPF_JSLE | BPF_X: 1689 case BPF_JMP | BPF_JSET | BPF_X: 1690 case BPF_JMP32 | BPF_JSET | BPF_X: 1691 rvoff = rv_offset(i, off, ctx); 1692 if (!is64) { 1693 s = ctx->ninsns; 1694 if (is_signed_bpf_cond(BPF_OP(code))) { 1695 emit_sextw_alt(&rs, RV_REG_T1, ctx); 1696 emit_sextw_alt(&rd, RV_REG_T2, ctx); 1697 } else { 1698 emit_zextw_alt(&rs, RV_REG_T1, ctx); 1699 emit_zextw_alt(&rd, RV_REG_T2, ctx); 1700 } 1701 e = ctx->ninsns; 1702 1703 /* Adjust for extra insns */ 1704 rvoff -= ninsns_rvoff(e - s); 1705 } 1706 1707 if (BPF_OP(code) == BPF_JSET) { 1708 /* Adjust for and */ 1709 rvoff -= 4; 1710 emit_and(RV_REG_T1, rd, rs, ctx); 1711 emit_branch(BPF_JNE, RV_REG_T1, RV_REG_ZERO, rvoff, ctx); 1712 } else { 1713 emit_branch(BPF_OP(code), rd, rs, rvoff, ctx); 1714 } 1715 break; 1716 1717 /* IF (dst COND imm) JUMP off */ 1718 case BPF_JMP | BPF_JEQ | BPF_K: 1719 case BPF_JMP32 | BPF_JEQ | BPF_K: 1720 case BPF_JMP | BPF_JGT | BPF_K: 1721 case BPF_JMP32 | BPF_JGT | BPF_K: 1722 case BPF_JMP | BPF_JLT | BPF_K: 1723 case BPF_JMP32 | BPF_JLT | BPF_K: 1724 case BPF_JMP | BPF_JGE | BPF_K: 1725 case BPF_JMP32 | BPF_JGE | BPF_K: 1726 case BPF_JMP | BPF_JLE | BPF_K: 1727 case BPF_JMP32 | BPF_JLE | BPF_K: 1728 case BPF_JMP | BPF_JNE | BPF_K: 1729 case BPF_JMP32 | BPF_JNE | BPF_K: 1730 case BPF_JMP | BPF_JSGT | BPF_K: 1731 case BPF_JMP32 | BPF_JSGT | BPF_K: 1732 case BPF_JMP | BPF_JSLT | BPF_K: 1733 case BPF_JMP32 | BPF_JSLT | BPF_K: 1734 case BPF_JMP | BPF_JSGE | BPF_K: 1735 case BPF_JMP32 | BPF_JSGE | BPF_K: 1736 case BPF_JMP | BPF_JSLE | BPF_K: 1737 case BPF_JMP32 | BPF_JSLE | BPF_K: 1738 rvoff = rv_offset(i, off, ctx); 1739 s = ctx->ninsns; 1740 if (imm) 1741 emit_imm(RV_REG_T1, imm, ctx); 1742 rs = imm ? RV_REG_T1 : RV_REG_ZERO; 1743 if (!is64) { 1744 if (is_signed_bpf_cond(BPF_OP(code))) { 1745 emit_sextw_alt(&rd, RV_REG_T2, ctx); 1746 /* rs has been sign extended */ 1747 } else { 1748 emit_zextw_alt(&rd, RV_REG_T2, ctx); 1749 if (imm) 1750 emit_zextw(rs, rs, ctx); 1751 } 1752 } 1753 e = ctx->ninsns; 1754 1755 /* Adjust for extra insns */ 1756 rvoff -= ninsns_rvoff(e - s); 1757 emit_branch(BPF_OP(code), rd, rs, rvoff, ctx); 1758 break; 1759 1760 case BPF_JMP | BPF_JSET | BPF_K: 1761 case BPF_JMP32 | BPF_JSET | BPF_K: 1762 rvoff = rv_offset(i, off, ctx); 1763 s = ctx->ninsns; 1764 if (is_12b_int(imm)) { 1765 emit_andi(RV_REG_T1, rd, imm, ctx); 1766 } else { 1767 emit_imm(RV_REG_T1, imm, ctx); 1768 emit_and(RV_REG_T1, rd, RV_REG_T1, ctx); 1769 } 1770 /* For jset32, we should clear the upper 32 bits of t1, but 1771 * sign-extension is sufficient here and saves one instruction, 1772 * as t1 is used only in comparison against zero. 1773 */ 1774 if (!is64 && imm < 0) 1775 emit_sextw(RV_REG_T1, RV_REG_T1, ctx); 1776 e = ctx->ninsns; 1777 rvoff -= ninsns_rvoff(e - s); 1778 emit_branch(BPF_JNE, RV_REG_T1, RV_REG_ZERO, rvoff, ctx); 1779 break; 1780 1781 /* function call */ 1782 case BPF_JMP | BPF_CALL: 1783 { 1784 bool fixed_addr; 1785 u64 addr; 1786 1787 /* Inline calls to bpf_get_smp_processor_id() 1788 * 1789 * RV_REG_TP holds the address of the current CPU's task_struct and thread_info is 1790 * at offset 0 in task_struct. 1791 * Load cpu from thread_info: 1792 * Set R0 to ((struct thread_info *)(RV_REG_TP))->cpu 1793 * 1794 * This replicates the implementation of raw_smp_processor_id() on RISCV 1795 */ 1796 if (insn->src_reg == 0 && insn->imm == BPF_FUNC_get_smp_processor_id) { 1797 /* Load current CPU number in R0 */ 1798 emit_lw(bpf_to_rv_reg(BPF_REG_0, ctx), offsetof(struct thread_info, cpu), 1799 RV_REG_TP, ctx); 1800 break; 1801 } 1802 1803 /* Implement helper call to bpf_get_current_task/_btf() inline */ 1804 if (insn->src_reg == 0 && (insn->imm == BPF_FUNC_get_current_task || 1805 insn->imm == BPF_FUNC_get_current_task_btf)) { 1806 emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_TP, ctx); 1807 break; 1808 } 1809 1810 mark_call(ctx); 1811 ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, 1812 &addr, &fixed_addr); 1813 if (ret < 0) 1814 return ret; 1815 1816 if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) { 1817 const struct btf_func_model *fm; 1818 int idx; 1819 1820 fm = bpf_jit_find_kfunc_model(ctx->prog, insn); 1821 if (!fm) 1822 return -EINVAL; 1823 1824 for (idx = 0; idx < fm->nr_args; idx++) { 1825 u8 reg = bpf_to_rv_reg(BPF_REG_1 + idx, ctx); 1826 bool sign = fm->arg_flags[idx] & BTF_FMODEL_SIGNED_ARG; 1827 1828 if (sign_extend(reg, reg, fm->arg_size[idx], sign, ctx)) 1829 return -EINVAL; 1830 } 1831 } 1832 1833 /* restore TCC to RV_REG_TCC before bpf2bpf call */ 1834 if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL) 1835 emit_ld(RV_REG_TCC, ctx->tcc_offset, RV_REG_SP, ctx); 1836 1837 ret = emit_call(addr, fixed_addr, ctx); 1838 if (ret) 1839 return ret; 1840 1841 /* store updated TCC back to stack after bpf2bpf call */ 1842 if (aux->tail_call_reachable && insn->src_reg == BPF_PSEUDO_CALL) 1843 emit_sd(RV_REG_SP, ctx->tcc_offset, RV_REG_TCC, ctx); 1844 1845 /* 1846 * arch_bpf_timed_may_goto() is emitted by the verifier and 1847 * returns its result in BPF_REG_AX instead of BPF_REG_0, so 1848 * skip the normal "move return register into R0". 1849 */ 1850 if (insn->src_reg != BPF_PSEUDO_CALL && addr != (u64)arch_bpf_timed_may_goto) 1851 emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx); 1852 break; 1853 } 1854 /* tail call */ 1855 case BPF_JMP | BPF_TAIL_CALL: 1856 if (emit_bpf_tail_call(i, ctx)) 1857 return -1; 1858 break; 1859 1860 /* function return */ 1861 case BPF_JMP | BPF_EXIT: 1862 if (i == ctx->prog->len - 1) 1863 break; 1864 1865 rvoff = epilogue_offset(ctx); 1866 ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx); 1867 if (ret) 1868 return ret; 1869 break; 1870 1871 /* dst = imm64 */ 1872 case BPF_LD | BPF_IMM | BPF_DW: 1873 { 1874 struct bpf_insn insn1 = insn[1]; 1875 u64 imm64; 1876 1877 imm64 = (u64)insn1.imm << 32 | (u32)imm; 1878 if (bpf_pseudo_func(insn)) { 1879 /* fixed-length insns for extra jit pass */ 1880 ret = emit_addr(rd, imm64, extra_pass, ctx); 1881 if (ret) 1882 return ret; 1883 } else { 1884 emit_imm(rd, imm64, ctx); 1885 } 1886 1887 return 1; 1888 } 1889 1890 /* LDX: dst = *(unsigned size *)(src + off) */ 1891 case BPF_LDX | BPF_MEM | BPF_B: 1892 case BPF_LDX | BPF_MEM | BPF_H: 1893 case BPF_LDX | BPF_MEM | BPF_W: 1894 case BPF_LDX | BPF_MEM | BPF_DW: 1895 case BPF_LDX | BPF_PROBE_MEM | BPF_B: 1896 case BPF_LDX | BPF_PROBE_MEM | BPF_H: 1897 case BPF_LDX | BPF_PROBE_MEM | BPF_W: 1898 case BPF_LDX | BPF_PROBE_MEM | BPF_DW: 1899 /* LDSX: dst = *(signed size *)(src + off) */ 1900 case BPF_LDX | BPF_MEMSX | BPF_B: 1901 case BPF_LDX | BPF_MEMSX | BPF_H: 1902 case BPF_LDX | BPF_MEMSX | BPF_W: 1903 case BPF_LDX | BPF_PROBE_MEMSX | BPF_B: 1904 case BPF_LDX | BPF_PROBE_MEMSX | BPF_H: 1905 case BPF_LDX | BPF_PROBE_MEMSX | BPF_W: 1906 /* LDX | PROBE_MEM32: dst = *(unsigned size *)(src + RV_REG_ARENA + off) */ 1907 case BPF_LDX | BPF_PROBE_MEM32 | BPF_B: 1908 case BPF_LDX | BPF_PROBE_MEM32 | BPF_H: 1909 case BPF_LDX | BPF_PROBE_MEM32 | BPF_W: 1910 case BPF_LDX | BPF_PROBE_MEM32 | BPF_DW: 1911 { 1912 bool sign_ext; 1913 1914 sign_ext = BPF_MODE(insn->code) == BPF_MEMSX || 1915 BPF_MODE(insn->code) == BPF_PROBE_MEMSX; 1916 1917 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1918 emit_add(RV_REG_T2, rs, RV_REG_ARENA, ctx); 1919 rs = RV_REG_T2; 1920 } 1921 1922 emit_ldx(rd, off, rs, BPF_SIZE(code), sign_ext, ctx); 1923 1924 ret = add_exception_handler(insn, rd, ctx); 1925 if (ret) 1926 return ret; 1927 1928 if (BPF_SIZE(code) != BPF_DW && insn_is_zext(&insn[1])) 1929 return 1; 1930 break; 1931 } 1932 1933 /* speculation barrier */ 1934 case BPF_ST | BPF_NOSPEC: 1935 break; 1936 1937 /* ST: *(size *)(dst + off) = imm */ 1938 case BPF_ST | BPF_MEM | BPF_B: 1939 case BPF_ST | BPF_MEM | BPF_H: 1940 case BPF_ST | BPF_MEM | BPF_W: 1941 case BPF_ST | BPF_MEM | BPF_DW: 1942 /* ST | PROBE_MEM32: *(size *)(dst + RV_REG_ARENA + off) = imm */ 1943 case BPF_ST | BPF_PROBE_MEM32 | BPF_B: 1944 case BPF_ST | BPF_PROBE_MEM32 | BPF_H: 1945 case BPF_ST | BPF_PROBE_MEM32 | BPF_W: 1946 case BPF_ST | BPF_PROBE_MEM32 | BPF_DW: 1947 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1948 emit_add(RV_REG_T3, rd, RV_REG_ARENA, ctx); 1949 rd = RV_REG_T3; 1950 } 1951 1952 emit_st(rd, off, imm, BPF_SIZE(code), ctx); 1953 1954 ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx); 1955 if (ret) 1956 return ret; 1957 break; 1958 1959 /* STX: *(size *)(dst + off) = src */ 1960 case BPF_STX | BPF_MEM | BPF_B: 1961 case BPF_STX | BPF_MEM | BPF_H: 1962 case BPF_STX | BPF_MEM | BPF_W: 1963 case BPF_STX | BPF_MEM | BPF_DW: 1964 /* STX | PROBE_MEM32: *(size *)(dst + RV_REG_ARENA + off) = src */ 1965 case BPF_STX | BPF_PROBE_MEM32 | BPF_B: 1966 case BPF_STX | BPF_PROBE_MEM32 | BPF_H: 1967 case BPF_STX | BPF_PROBE_MEM32 | BPF_W: 1968 case BPF_STX | BPF_PROBE_MEM32 | BPF_DW: 1969 if (BPF_MODE(insn->code) == BPF_PROBE_MEM32) { 1970 emit_add(RV_REG_T2, rd, RV_REG_ARENA, ctx); 1971 rd = RV_REG_T2; 1972 } 1973 1974 emit_stx(rd, off, rs, BPF_SIZE(code), ctx); 1975 1976 ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx); 1977 if (ret) 1978 return ret; 1979 break; 1980 1981 /* Atomics */ 1982 case BPF_STX | BPF_ATOMIC | BPF_B: 1983 case BPF_STX | BPF_ATOMIC | BPF_H: 1984 case BPF_STX | BPF_ATOMIC | BPF_W: 1985 case BPF_STX | BPF_ATOMIC | BPF_DW: 1986 case BPF_STX | BPF_PROBE_ATOMIC | BPF_B: 1987 case BPF_STX | BPF_PROBE_ATOMIC | BPF_H: 1988 case BPF_STX | BPF_PROBE_ATOMIC | BPF_W: 1989 case BPF_STX | BPF_PROBE_ATOMIC | BPF_DW: 1990 if (bpf_atomic_is_load_store(insn)) 1991 ret = emit_atomic_ld_st(rd, rs, insn, ctx); 1992 else 1993 ret = emit_atomic_rmw(rd, rs, insn, ctx); 1994 1995 /* ret can be 1 (skip-zext); extable entry still needs to be added */ 1996 if (ret >= 0) { 1997 /* 1998 * A load-acquire reads into dst_reg, and a read-modify-write 1999 * carrying BPF_FETCH reads the old value into src_reg, or into 2000 * r0 for a BPF_CMPXCHG. Clear that register on fault, the 2001 * remaining atomics have no destination register. 2002 */ 2003 int load_reg = bpf_atomic_load_reg(insn); 2004 2005 ret = add_exception_handler(insn, load_reg < 0 ? 2006 REG_DONT_CLEAR_MARKER : regmap[load_reg], 2007 ctx) ?: ret; 2008 } 2009 2010 if (ret) 2011 return ret; 2012 break; 2013 2014 default: 2015 pr_err("bpf-jit: unknown opcode %02x\n", code); 2016 return -EINVAL; 2017 } 2018 2019 return 0; 2020 } 2021 2022 void bpf_jit_build_prologue(struct rv_jit_context *ctx, bool is_subprog) 2023 { 2024 int i, stack_adjust = 0, store_offset, bpf_stack_adjust; 2025 2026 bpf_stack_adjust = round_up(ctx->prog->aux->stack_depth, STACK_ALIGN); 2027 if (bpf_stack_adjust) 2028 mark_fp(ctx); 2029 2030 if (seen_reg(RV_REG_RA, ctx)) 2031 stack_adjust += 8; 2032 stack_adjust += 8; /* RV_REG_FP */ 2033 if (seen_reg(RV_REG_S1, ctx)) 2034 stack_adjust += 8; 2035 if (seen_reg(RV_REG_S2, ctx)) 2036 stack_adjust += 8; 2037 if (seen_reg(RV_REG_S3, ctx)) 2038 stack_adjust += 8; 2039 if (seen_reg(RV_REG_S4, ctx)) 2040 stack_adjust += 8; 2041 if (seen_reg(RV_REG_S5, ctx)) 2042 stack_adjust += 8; 2043 if (ctx->arena_vm_start) 2044 stack_adjust += 8; 2045 stack_adjust += 8; /* RV_REG_TCC */ 2046 2047 stack_adjust = round_up(stack_adjust, STACK_ALIGN); 2048 stack_adjust += bpf_stack_adjust; 2049 2050 store_offset = stack_adjust - 8; 2051 2052 /* emit kcfi type preamble immediately before the first insn */ 2053 emit_kcfi(is_subprog ? cfi_bpf_subprog_hash : cfi_bpf_hash, ctx); 2054 2055 /* bpf prog starts here as kcfi skipped during prog->bpf_func setup */ 2056 2057 /* nops reserved for auipc+jalr pair */ 2058 for (i = 0; i < RV_FENTRY_NINSNS; i++) 2059 emit(rv_nop(), ctx); 2060 2061 if (!is_subprog) 2062 emit(rv_addi(RV_REG_TCC, RV_REG_ZERO, MAX_TAIL_CALL_CNT), ctx); 2063 2064 /* tailcall starts here, emit insn before it must be fixed */ 2065 2066 emit_addi(RV_REG_SP, RV_REG_SP, -stack_adjust, ctx); 2067 2068 if (seen_reg(RV_REG_RA, ctx)) { 2069 emit_sd(RV_REG_SP, store_offset, RV_REG_RA, ctx); 2070 store_offset -= 8; 2071 } 2072 emit_sd(RV_REG_SP, store_offset, RV_REG_FP, ctx); 2073 store_offset -= 8; 2074 if (seen_reg(RV_REG_S1, ctx)) { 2075 emit_sd(RV_REG_SP, store_offset, RV_REG_S1, ctx); 2076 store_offset -= 8; 2077 } 2078 if (seen_reg(RV_REG_S2, ctx)) { 2079 emit_sd(RV_REG_SP, store_offset, RV_REG_S2, ctx); 2080 store_offset -= 8; 2081 } 2082 if (seen_reg(RV_REG_S3, ctx)) { 2083 emit_sd(RV_REG_SP, store_offset, RV_REG_S3, ctx); 2084 store_offset -= 8; 2085 } 2086 if (seen_reg(RV_REG_S4, ctx)) { 2087 emit_sd(RV_REG_SP, store_offset, RV_REG_S4, ctx); 2088 store_offset -= 8; 2089 } 2090 if (seen_reg(RV_REG_S5, ctx)) { 2091 emit_sd(RV_REG_SP, store_offset, RV_REG_S5, ctx); 2092 store_offset -= 8; 2093 } 2094 if (ctx->arena_vm_start) { 2095 emit_sd(RV_REG_SP, store_offset, RV_REG_ARENA, ctx); 2096 store_offset -= 8; 2097 } 2098 2099 /* store TCC from RV_REG_TCC to stack */ 2100 emit_sd(RV_REG_SP, store_offset, RV_REG_TCC, ctx); 2101 ctx->tcc_offset = store_offset; 2102 2103 emit_addi(RV_REG_FP, RV_REG_SP, stack_adjust, ctx); 2104 2105 if (bpf_stack_adjust) 2106 emit_addi(RV_REG_S5, RV_REG_SP, bpf_stack_adjust, ctx); 2107 2108 ctx->stack_size = stack_adjust; 2109 2110 if (ctx->arena_vm_start) 2111 emit_imm(RV_REG_ARENA, ctx->arena_vm_start, ctx); 2112 } 2113 2114 void bpf_jit_build_epilogue(struct rv_jit_context *ctx) 2115 { 2116 __build_epilogue(false, ctx); 2117 } 2118 2119 bool bpf_jit_supports_kfunc_call(void) 2120 { 2121 return true; 2122 } 2123 2124 bool bpf_jit_supports_ptr_xchg(void) 2125 { 2126 return true; 2127 } 2128 2129 bool bpf_jit_supports_arena(void) 2130 { 2131 return true; 2132 } 2133 2134 bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena) 2135 { 2136 if (in_arena) { 2137 switch (insn->code) { 2138 case BPF_STX | BPF_ATOMIC | BPF_W: 2139 case BPF_STX | BPF_ATOMIC | BPF_DW: 2140 if (insn->imm == BPF_CMPXCHG) 2141 return rv_ext_enabled(ZACAS); 2142 break; 2143 case BPF_LDX | BPF_MEMSX | BPF_B: 2144 case BPF_LDX | BPF_MEMSX | BPF_H: 2145 case BPF_LDX | BPF_MEMSX | BPF_W: 2146 return false; 2147 } 2148 } 2149 2150 return true; 2151 } 2152 2153 bool bpf_jit_supports_percpu_insn(void) 2154 { 2155 return true; 2156 } 2157 2158 bool bpf_jit_inlines_helper_call(s32 imm) 2159 { 2160 switch (imm) { 2161 case BPF_FUNC_get_smp_processor_id: 2162 case BPF_FUNC_get_current_task: 2163 case BPF_FUNC_get_current_task_btf: 2164 return true; 2165 default: 2166 return false; 2167 } 2168 } 2169 2170 bool bpf_jit_supports_fsession(void) 2171 { 2172 return true; 2173 } 2174 2175 bool bpf_jit_supports_subprog_tailcalls(void) 2176 { 2177 return true; 2178 } 2179 2180 bool bpf_jit_supports_timed_may_goto(void) 2181 { 2182 return true; 2183 } 2184