1 /* 2 * BPF Jit compiler for s390. 3 * 4 * Copyright IBM Corp. 2012 5 * 6 * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com> 7 */ 8 #include <linux/moduleloader.h> 9 #include <linux/netdevice.h> 10 #include <linux/if_vlan.h> 11 #include <linux/filter.h> 12 #include <linux/random.h> 13 #include <linux/init.h> 14 #include <asm/cacheflush.h> 15 #include <asm/facility.h> 16 #include <asm/dis.h> 17 18 /* 19 * Conventions: 20 * %r2 = skb pointer 21 * %r3 = offset parameter 22 * %r4 = scratch register / length parameter 23 * %r5 = BPF A accumulator 24 * %r8 = return address 25 * %r9 = save register for skb pointer 26 * %r10 = skb->data 27 * %r11 = skb->len - skb->data_len (headlen) 28 * %r12 = BPF X accumulator 29 * %r13 = literal pool pointer 30 * 0(%r15) - 63(%r15) scratch memory array with BPF_MEMWORDS 31 */ 32 int bpf_jit_enable __read_mostly; 33 34 /* 35 * assembly code in arch/x86/net/bpf_jit.S 36 */ 37 extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[]; 38 extern u8 sk_load_word_ind[], sk_load_half_ind[], sk_load_byte_ind[]; 39 40 struct bpf_jit { 41 unsigned int seen; 42 u8 *start; 43 u8 *prg; 44 u8 *mid; 45 u8 *lit; 46 u8 *end; 47 u8 *base_ip; 48 u8 *ret0_ip; 49 u8 *exit_ip; 50 unsigned int off_load_word; 51 unsigned int off_load_half; 52 unsigned int off_load_byte; 53 unsigned int off_load_bmsh; 54 unsigned int off_load_iword; 55 unsigned int off_load_ihalf; 56 unsigned int off_load_ibyte; 57 }; 58 59 #define BPF_SIZE_MAX 4096 /* Max size for program */ 60 61 #define SEEN_DATAREF 1 /* might call external helpers */ 62 #define SEEN_XREG 2 /* ebx is used */ 63 #define SEEN_MEM 4 /* use mem[] for temporary storage */ 64 #define SEEN_RET0 8 /* pc_ret0 points to a valid return 0 */ 65 #define SEEN_LITERAL 16 /* code uses literals */ 66 #define SEEN_LOAD_WORD 32 /* code uses sk_load_word */ 67 #define SEEN_LOAD_HALF 64 /* code uses sk_load_half */ 68 #define SEEN_LOAD_BYTE 128 /* code uses sk_load_byte */ 69 #define SEEN_LOAD_BMSH 256 /* code uses sk_load_byte_msh */ 70 #define SEEN_LOAD_IWORD 512 /* code uses sk_load_word_ind */ 71 #define SEEN_LOAD_IHALF 1024 /* code uses sk_load_half_ind */ 72 #define SEEN_LOAD_IBYTE 2048 /* code uses sk_load_byte_ind */ 73 74 #define EMIT2(op) \ 75 ({ \ 76 if (jit->prg + 2 <= jit->mid) \ 77 *(u16 *) jit->prg = op; \ 78 jit->prg += 2; \ 79 }) 80 81 #define EMIT4(op) \ 82 ({ \ 83 if (jit->prg + 4 <= jit->mid) \ 84 *(u32 *) jit->prg = op; \ 85 jit->prg += 4; \ 86 }) 87 88 #define EMIT4_DISP(op, disp) \ 89 ({ \ 90 unsigned int __disp = (disp) & 0xfff; \ 91 EMIT4(op | __disp); \ 92 }) 93 94 #define EMIT4_IMM(op, imm) \ 95 ({ \ 96 unsigned int __imm = (imm) & 0xffff; \ 97 EMIT4(op | __imm); \ 98 }) 99 100 #define EMIT4_PCREL(op, pcrel) \ 101 ({ \ 102 long __pcrel = ((pcrel) >> 1) & 0xffff; \ 103 EMIT4(op | __pcrel); \ 104 }) 105 106 #define EMIT6(op1, op2) \ 107 ({ \ 108 if (jit->prg + 6 <= jit->mid) { \ 109 *(u32 *) jit->prg = op1; \ 110 *(u16 *) (jit->prg + 4) = op2; \ 111 } \ 112 jit->prg += 6; \ 113 }) 114 115 #define EMIT6_DISP(op1, op2, disp) \ 116 ({ \ 117 unsigned int __disp = (disp) & 0xfff; \ 118 EMIT6(op1 | __disp, op2); \ 119 }) 120 121 #define EMIT6_IMM(op, imm) \ 122 ({ \ 123 unsigned int __imm = (imm); \ 124 EMIT6(op | (__imm >> 16), __imm & 0xffff); \ 125 }) 126 127 #define EMIT_CONST(val) \ 128 ({ \ 129 unsigned int ret; \ 130 ret = (unsigned int) (jit->lit - jit->base_ip); \ 131 jit->seen |= SEEN_LITERAL; \ 132 if (jit->lit + 4 <= jit->end) \ 133 *(u32 *) jit->lit = val; \ 134 jit->lit += 4; \ 135 ret; \ 136 }) 137 138 #define EMIT_FN_CONST(bit, fn) \ 139 ({ \ 140 unsigned int ret; \ 141 ret = (unsigned int) (jit->lit - jit->base_ip); \ 142 if (jit->seen & bit) { \ 143 jit->seen |= SEEN_LITERAL; \ 144 if (jit->lit + 8 <= jit->end) \ 145 *(void **) jit->lit = fn; \ 146 jit->lit += 8; \ 147 } \ 148 ret; \ 149 }) 150 151 static void bpf_jit_prologue(struct bpf_jit *jit) 152 { 153 /* Save registers and create stack frame if necessary */ 154 if (jit->seen & SEEN_DATAREF) { 155 /* stmg %r8,%r15,88(%r15) */ 156 EMIT6(0xeb8ff058, 0x0024); 157 /* lgr %r14,%r15 */ 158 EMIT4(0xb90400ef); 159 /* aghi %r15,<offset> */ 160 EMIT4_IMM(0xa7fb0000, (jit->seen & SEEN_MEM) ? -112 : -80); 161 /* stg %r14,152(%r15) */ 162 EMIT6(0xe3e0f098, 0x0024); 163 } else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL)) 164 /* stmg %r12,%r13,120(%r15) */ 165 EMIT6(0xebcdf078, 0x0024); 166 else if (jit->seen & SEEN_XREG) 167 /* stg %r12,120(%r15) */ 168 EMIT6(0xe3c0f078, 0x0024); 169 else if (jit->seen & SEEN_LITERAL) 170 /* stg %r13,128(%r15) */ 171 EMIT6(0xe3d0f080, 0x0024); 172 173 /* Setup literal pool */ 174 if (jit->seen & SEEN_LITERAL) { 175 /* basr %r13,0 */ 176 EMIT2(0x0dd0); 177 jit->base_ip = jit->prg; 178 } 179 jit->off_load_word = EMIT_FN_CONST(SEEN_LOAD_WORD, sk_load_word); 180 jit->off_load_half = EMIT_FN_CONST(SEEN_LOAD_HALF, sk_load_half); 181 jit->off_load_byte = EMIT_FN_CONST(SEEN_LOAD_BYTE, sk_load_byte); 182 jit->off_load_bmsh = EMIT_FN_CONST(SEEN_LOAD_BMSH, sk_load_byte_msh); 183 jit->off_load_iword = EMIT_FN_CONST(SEEN_LOAD_IWORD, sk_load_word_ind); 184 jit->off_load_ihalf = EMIT_FN_CONST(SEEN_LOAD_IHALF, sk_load_half_ind); 185 jit->off_load_ibyte = EMIT_FN_CONST(SEEN_LOAD_IBYTE, sk_load_byte_ind); 186 187 /* Filter needs to access skb data */ 188 if (jit->seen & SEEN_DATAREF) { 189 /* l %r11,<len>(%r2) */ 190 EMIT4_DISP(0x58b02000, offsetof(struct sk_buff, len)); 191 /* s %r11,<data_len>(%r2) */ 192 EMIT4_DISP(0x5bb02000, offsetof(struct sk_buff, data_len)); 193 /* lg %r10,<data>(%r2) */ 194 EMIT6_DISP(0xe3a02000, 0x0004, 195 offsetof(struct sk_buff, data)); 196 } 197 } 198 199 static void bpf_jit_epilogue(struct bpf_jit *jit) 200 { 201 /* Return 0 */ 202 if (jit->seen & SEEN_RET0) { 203 jit->ret0_ip = jit->prg; 204 /* lghi %r2,0 */ 205 EMIT4(0xa7290000); 206 } 207 jit->exit_ip = jit->prg; 208 /* Restore registers */ 209 if (jit->seen & SEEN_DATAREF) 210 /* lmg %r8,%r15,<offset>(%r15) */ 211 EMIT6_DISP(0xeb8ff000, 0x0004, 212 (jit->seen & SEEN_MEM) ? 200 : 168); 213 else if ((jit->seen & SEEN_XREG) && (jit->seen & SEEN_LITERAL)) 214 /* lmg %r12,%r13,120(%r15) */ 215 EMIT6(0xebcdf078, 0x0004); 216 else if (jit->seen & SEEN_XREG) 217 /* lg %r12,120(%r15) */ 218 EMIT6(0xe3c0f078, 0x0004); 219 else if (jit->seen & SEEN_LITERAL) 220 /* lg %r13,128(%r15) */ 221 EMIT6(0xe3d0f080, 0x0004); 222 /* br %r14 */ 223 EMIT2(0x07fe); 224 } 225 226 /* Helper to find the offset of pkt_type in sk_buff 227 * Make sure its still a 3bit field starting at the MSBs within a byte. 228 */ 229 #define PKT_TYPE_MAX 0xe0 230 static int pkt_type_offset; 231 232 static int __init bpf_pkt_type_offset_init(void) 233 { 234 struct sk_buff skb_probe = { 235 .pkt_type = ~0, 236 }; 237 char *ct = (char *)&skb_probe; 238 int off; 239 240 pkt_type_offset = -1; 241 for (off = 0; off < sizeof(struct sk_buff); off++) { 242 if (!ct[off]) 243 continue; 244 if (ct[off] == PKT_TYPE_MAX) 245 pkt_type_offset = off; 246 else { 247 /* Found non matching bit pattern, fix needed. */ 248 WARN_ON_ONCE(1); 249 pkt_type_offset = -1; 250 return -1; 251 } 252 } 253 return 0; 254 } 255 device_initcall(bpf_pkt_type_offset_init); 256 257 /* 258 * make sure we dont leak kernel information to user 259 */ 260 static void bpf_jit_noleaks(struct bpf_jit *jit, struct sock_filter *filter) 261 { 262 /* Clear temporary memory if (seen & SEEN_MEM) */ 263 if (jit->seen & SEEN_MEM) 264 /* xc 0(64,%r15),0(%r15) */ 265 EMIT6(0xd73ff000, 0xf000); 266 /* Clear X if (seen & SEEN_XREG) */ 267 if (jit->seen & SEEN_XREG) 268 /* lhi %r12,0 */ 269 EMIT4(0xa7c80000); 270 /* Clear A if the first register does not set it. */ 271 switch (filter[0].code) { 272 case BPF_LD | BPF_W | BPF_ABS: 273 case BPF_LD | BPF_H | BPF_ABS: 274 case BPF_LD | BPF_B | BPF_ABS: 275 case BPF_LD | BPF_W | BPF_LEN: 276 case BPF_LD | BPF_W | BPF_IND: 277 case BPF_LD | BPF_H | BPF_IND: 278 case BPF_LD | BPF_B | BPF_IND: 279 case BPF_LD | BPF_IMM: 280 case BPF_LD | BPF_MEM: 281 case BPF_MISC | BPF_TXA: 282 case BPF_RET | BPF_K: 283 /* first instruction sets A register */ 284 break; 285 default: /* A = 0 */ 286 /* lhi %r5,0 */ 287 EMIT4(0xa7580000); 288 } 289 } 290 291 static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter, 292 unsigned int *addrs, int i, int last) 293 { 294 unsigned int K; 295 int offset; 296 unsigned int mask; 297 u16 code; 298 299 K = filter->k; 300 code = bpf_anc_helper(filter); 301 302 switch (code) { 303 case BPF_ALU | BPF_ADD | BPF_X: /* A += X */ 304 jit->seen |= SEEN_XREG; 305 /* ar %r5,%r12 */ 306 EMIT2(0x1a5c); 307 break; 308 case BPF_ALU | BPF_ADD | BPF_K: /* A += K */ 309 if (!K) 310 break; 311 if (K <= 16383) 312 /* ahi %r5,<K> */ 313 EMIT4_IMM(0xa75a0000, K); 314 else if (test_facility(21)) 315 /* alfi %r5,<K> */ 316 EMIT6_IMM(0xc25b0000, K); 317 else 318 /* a %r5,<d(K)>(%r13) */ 319 EMIT4_DISP(0x5a50d000, EMIT_CONST(K)); 320 break; 321 case BPF_ALU | BPF_SUB | BPF_X: /* A -= X */ 322 jit->seen |= SEEN_XREG; 323 /* sr %r5,%r12 */ 324 EMIT2(0x1b5c); 325 break; 326 case BPF_ALU | BPF_SUB | BPF_K: /* A -= K */ 327 if (!K) 328 break; 329 if (K <= 16384) 330 /* ahi %r5,-K */ 331 EMIT4_IMM(0xa75a0000, -K); 332 else if (test_facility(21)) 333 /* alfi %r5,-K */ 334 EMIT6_IMM(0xc25b0000, -K); 335 else 336 /* s %r5,<d(K)>(%r13) */ 337 EMIT4_DISP(0x5b50d000, EMIT_CONST(K)); 338 break; 339 case BPF_ALU | BPF_MUL | BPF_X: /* A *= X */ 340 jit->seen |= SEEN_XREG; 341 /* msr %r5,%r12 */ 342 EMIT4(0xb252005c); 343 break; 344 case BPF_ALU | BPF_MUL | BPF_K: /* A *= K */ 345 if (K <= 16383) 346 /* mhi %r5,K */ 347 EMIT4_IMM(0xa75c0000, K); 348 else if (test_facility(34)) 349 /* msfi %r5,<K> */ 350 EMIT6_IMM(0xc2510000, K); 351 else 352 /* ms %r5,<d(K)>(%r13) */ 353 EMIT4_DISP(0x7150d000, EMIT_CONST(K)); 354 break; 355 case BPF_ALU | BPF_DIV | BPF_X: /* A /= X */ 356 jit->seen |= SEEN_XREG | SEEN_RET0; 357 /* ltr %r12,%r12 */ 358 EMIT2(0x12cc); 359 /* jz <ret0> */ 360 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg)); 361 /* lhi %r4,0 */ 362 EMIT4(0xa7480000); 363 /* dlr %r4,%r12 */ 364 EMIT4(0xb997004c); 365 break; 366 case BPF_ALU | BPF_DIV | BPF_K: /* A /= K */ 367 if (K == 1) 368 break; 369 /* lhi %r4,0 */ 370 EMIT4(0xa7480000); 371 /* dl %r4,<d(K)>(%r13) */ 372 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K)); 373 break; 374 case BPF_ALU | BPF_MOD | BPF_X: /* A %= X */ 375 jit->seen |= SEEN_XREG | SEEN_RET0; 376 /* ltr %r12,%r12 */ 377 EMIT2(0x12cc); 378 /* jz <ret0> */ 379 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg)); 380 /* lhi %r4,0 */ 381 EMIT4(0xa7480000); 382 /* dlr %r4,%r12 */ 383 EMIT4(0xb997004c); 384 /* lr %r5,%r4 */ 385 EMIT2(0x1854); 386 break; 387 case BPF_ALU | BPF_MOD | BPF_K: /* A %= K */ 388 if (K == 1) { 389 /* lhi %r5,0 */ 390 EMIT4(0xa7580000); 391 break; 392 } 393 /* lhi %r4,0 */ 394 EMIT4(0xa7480000); 395 /* dl %r4,<d(K)>(%r13) */ 396 EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K)); 397 /* lr %r5,%r4 */ 398 EMIT2(0x1854); 399 break; 400 case BPF_ALU | BPF_AND | BPF_X: /* A &= X */ 401 jit->seen |= SEEN_XREG; 402 /* nr %r5,%r12 */ 403 EMIT2(0x145c); 404 break; 405 case BPF_ALU | BPF_AND | BPF_K: /* A &= K */ 406 if (test_facility(21)) 407 /* nilf %r5,<K> */ 408 EMIT6_IMM(0xc05b0000, K); 409 else 410 /* n %r5,<d(K)>(%r13) */ 411 EMIT4_DISP(0x5450d000, EMIT_CONST(K)); 412 break; 413 case BPF_ALU | BPF_OR | BPF_X: /* A |= X */ 414 jit->seen |= SEEN_XREG; 415 /* or %r5,%r12 */ 416 EMIT2(0x165c); 417 break; 418 case BPF_ALU | BPF_OR | BPF_K: /* A |= K */ 419 if (test_facility(21)) 420 /* oilf %r5,<K> */ 421 EMIT6_IMM(0xc05d0000, K); 422 else 423 /* o %r5,<d(K)>(%r13) */ 424 EMIT4_DISP(0x5650d000, EMIT_CONST(K)); 425 break; 426 case BPF_ANC | SKF_AD_ALU_XOR_X: /* A ^= X; */ 427 case BPF_ALU | BPF_XOR | BPF_X: 428 jit->seen |= SEEN_XREG; 429 /* xr %r5,%r12 */ 430 EMIT2(0x175c); 431 break; 432 case BPF_ALU | BPF_XOR | BPF_K: /* A ^= K */ 433 if (!K) 434 break; 435 /* x %r5,<d(K)>(%r13) */ 436 EMIT4_DISP(0x5750d000, EMIT_CONST(K)); 437 break; 438 case BPF_ALU | BPF_LSH | BPF_X: /* A <<= X; */ 439 jit->seen |= SEEN_XREG; 440 /* sll %r5,0(%r12) */ 441 EMIT4(0x8950c000); 442 break; 443 case BPF_ALU | BPF_LSH | BPF_K: /* A <<= K */ 444 if (K == 0) 445 break; 446 /* sll %r5,K */ 447 EMIT4_DISP(0x89500000, K); 448 break; 449 case BPF_ALU | BPF_RSH | BPF_X: /* A >>= X; */ 450 jit->seen |= SEEN_XREG; 451 /* srl %r5,0(%r12) */ 452 EMIT4(0x8850c000); 453 break; 454 case BPF_ALU | BPF_RSH | BPF_K: /* A >>= K; */ 455 if (K == 0) 456 break; 457 /* srl %r5,K */ 458 EMIT4_DISP(0x88500000, K); 459 break; 460 case BPF_ALU | BPF_NEG: /* A = -A */ 461 /* lnr %r5,%r5 */ 462 EMIT2(0x1155); 463 break; 464 case BPF_JMP | BPF_JA: /* ip += K */ 465 offset = addrs[i + K] + jit->start - jit->prg; 466 EMIT4_PCREL(0xa7f40000, offset); 467 break; 468 case BPF_JMP | BPF_JGT | BPF_K: /* ip += (A > K) ? jt : jf */ 469 mask = 0x200000; /* jh */ 470 goto kbranch; 471 case BPF_JMP | BPF_JGE | BPF_K: /* ip += (A >= K) ? jt : jf */ 472 mask = 0xa00000; /* jhe */ 473 goto kbranch; 474 case BPF_JMP | BPF_JEQ | BPF_K: /* ip += (A == K) ? jt : jf */ 475 mask = 0x800000; /* je */ 476 kbranch: /* Emit compare if the branch targets are different */ 477 if (filter->jt != filter->jf) { 478 if (K <= 16383) 479 /* chi %r5,<K> */ 480 EMIT4_IMM(0xa75e0000, K); 481 else if (test_facility(21)) 482 /* clfi %r5,<K> */ 483 EMIT6_IMM(0xc25f0000, K); 484 else 485 /* c %r5,<d(K)>(%r13) */ 486 EMIT4_DISP(0x5950d000, EMIT_CONST(K)); 487 } 488 branch: if (filter->jt == filter->jf) { 489 if (filter->jt == 0) 490 break; 491 /* j <jt> */ 492 offset = addrs[i + filter->jt] + jit->start - jit->prg; 493 EMIT4_PCREL(0xa7f40000, offset); 494 break; 495 } 496 if (filter->jt != 0) { 497 /* brc <mask>,<jt> */ 498 offset = addrs[i + filter->jt] + jit->start - jit->prg; 499 EMIT4_PCREL(0xa7040000 | mask, offset); 500 } 501 if (filter->jf != 0) { 502 /* brc <mask^15>,<jf> */ 503 offset = addrs[i + filter->jf] + jit->start - jit->prg; 504 EMIT4_PCREL(0xa7040000 | (mask ^ 0xf00000), offset); 505 } 506 break; 507 case BPF_JMP | BPF_JSET | BPF_K: /* ip += (A & K) ? jt : jf */ 508 mask = 0x700000; /* jnz */ 509 /* Emit test if the branch targets are different */ 510 if (filter->jt != filter->jf) { 511 if (K > 65535) { 512 /* lr %r4,%r5 */ 513 EMIT2(0x1845); 514 /* n %r4,<d(K)>(%r13) */ 515 EMIT4_DISP(0x5440d000, EMIT_CONST(K)); 516 } else 517 /* tmll %r5,K */ 518 EMIT4_IMM(0xa7510000, K); 519 } 520 goto branch; 521 case BPF_JMP | BPF_JGT | BPF_X: /* ip += (A > X) ? jt : jf */ 522 mask = 0x200000; /* jh */ 523 goto xbranch; 524 case BPF_JMP | BPF_JGE | BPF_X: /* ip += (A >= X) ? jt : jf */ 525 mask = 0xa00000; /* jhe */ 526 goto xbranch; 527 case BPF_JMP | BPF_JEQ | BPF_X: /* ip += (A == X) ? jt : jf */ 528 mask = 0x800000; /* je */ 529 xbranch: /* Emit compare if the branch targets are different */ 530 if (filter->jt != filter->jf) { 531 jit->seen |= SEEN_XREG; 532 /* cr %r5,%r12 */ 533 EMIT2(0x195c); 534 } 535 goto branch; 536 case BPF_JMP | BPF_JSET | BPF_X: /* ip += (A & X) ? jt : jf */ 537 mask = 0x700000; /* jnz */ 538 /* Emit test if the branch targets are different */ 539 if (filter->jt != filter->jf) { 540 jit->seen |= SEEN_XREG; 541 /* lr %r4,%r5 */ 542 EMIT2(0x1845); 543 /* nr %r4,%r12 */ 544 EMIT2(0x144c); 545 } 546 goto branch; 547 case BPF_LD | BPF_W | BPF_ABS: /* A = *(u32 *) (skb->data+K) */ 548 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_WORD; 549 offset = jit->off_load_word; 550 goto load_abs; 551 case BPF_LD | BPF_H | BPF_ABS: /* A = *(u16 *) (skb->data+K) */ 552 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_HALF; 553 offset = jit->off_load_half; 554 goto load_abs; 555 case BPF_LD | BPF_B | BPF_ABS: /* A = *(u8 *) (skb->data+K) */ 556 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_BYTE; 557 offset = jit->off_load_byte; 558 load_abs: if ((int) K < 0) 559 goto out; 560 call_fn: /* lg %r1,<d(function)>(%r13) */ 561 EMIT6_DISP(0xe310d000, 0x0004, offset); 562 /* l %r3,<d(K)>(%r13) */ 563 EMIT4_DISP(0x5830d000, EMIT_CONST(K)); 564 /* basr %r8,%r1 */ 565 EMIT2(0x0d81); 566 /* jnz <ret0> */ 567 EMIT4_PCREL(0xa7740000, (jit->ret0_ip - jit->prg)); 568 break; 569 case BPF_LD | BPF_W | BPF_IND: /* A = *(u32 *) (skb->data+K+X) */ 570 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IWORD; 571 offset = jit->off_load_iword; 572 goto call_fn; 573 case BPF_LD | BPF_H | BPF_IND: /* A = *(u16 *) (skb->data+K+X) */ 574 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IHALF; 575 offset = jit->off_load_ihalf; 576 goto call_fn; 577 case BPF_LD | BPF_B | BPF_IND: /* A = *(u8 *) (skb->data+K+X) */ 578 jit->seen |= SEEN_DATAREF | SEEN_RET0 | SEEN_LOAD_IBYTE; 579 offset = jit->off_load_ibyte; 580 goto call_fn; 581 case BPF_LDX | BPF_B | BPF_MSH: 582 /* X = (*(u8 *)(skb->data+K) & 0xf) << 2 */ 583 jit->seen |= SEEN_RET0; 584 if ((int) K < 0) { 585 /* j <ret0> */ 586 EMIT4_PCREL(0xa7f40000, (jit->ret0_ip - jit->prg)); 587 break; 588 } 589 jit->seen |= SEEN_DATAREF | SEEN_LOAD_BMSH; 590 offset = jit->off_load_bmsh; 591 goto call_fn; 592 case BPF_LD | BPF_W | BPF_LEN: /* A = skb->len; */ 593 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4); 594 /* l %r5,<d(len)>(%r2) */ 595 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, len)); 596 break; 597 case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */ 598 jit->seen |= SEEN_XREG; 599 /* l %r12,<d(len)>(%r2) */ 600 EMIT4_DISP(0x58c02000, offsetof(struct sk_buff, len)); 601 break; 602 case BPF_LD | BPF_IMM: /* A = K */ 603 if (K <= 16383) 604 /* lhi %r5,K */ 605 EMIT4_IMM(0xa7580000, K); 606 else if (test_facility(21)) 607 /* llilf %r5,<K> */ 608 EMIT6_IMM(0xc05f0000, K); 609 else 610 /* l %r5,<d(K)>(%r13) */ 611 EMIT4_DISP(0x5850d000, EMIT_CONST(K)); 612 break; 613 case BPF_LDX | BPF_IMM: /* X = K */ 614 jit->seen |= SEEN_XREG; 615 if (K <= 16383) 616 /* lhi %r12,<K> */ 617 EMIT4_IMM(0xa7c80000, K); 618 else if (test_facility(21)) 619 /* llilf %r12,<K> */ 620 EMIT6_IMM(0xc0cf0000, K); 621 else 622 /* l %r12,<d(K)>(%r13) */ 623 EMIT4_DISP(0x58c0d000, EMIT_CONST(K)); 624 break; 625 case BPF_LD | BPF_MEM: /* A = mem[K] */ 626 jit->seen |= SEEN_MEM; 627 /* l %r5,<K>(%r15) */ 628 EMIT4_DISP(0x5850f000, 629 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 630 break; 631 case BPF_LDX | BPF_MEM: /* X = mem[K] */ 632 jit->seen |= SEEN_XREG | SEEN_MEM; 633 /* l %r12,<K>(%r15) */ 634 EMIT4_DISP(0x58c0f000, 635 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 636 break; 637 case BPF_MISC | BPF_TAX: /* X = A */ 638 jit->seen |= SEEN_XREG; 639 /* lr %r12,%r5 */ 640 EMIT2(0x18c5); 641 break; 642 case BPF_MISC | BPF_TXA: /* A = X */ 643 jit->seen |= SEEN_XREG; 644 /* lr %r5,%r12 */ 645 EMIT2(0x185c); 646 break; 647 case BPF_RET | BPF_K: 648 if (K == 0) { 649 jit->seen |= SEEN_RET0; 650 if (last) 651 break; 652 /* j <ret0> */ 653 EMIT4_PCREL(0xa7f40000, jit->ret0_ip - jit->prg); 654 } else { 655 if (K <= 16383) 656 /* lghi %r2,K */ 657 EMIT4_IMM(0xa7290000, K); 658 else 659 /* llgf %r2,<K>(%r13) */ 660 EMIT6_DISP(0xe320d000, 0x0016, EMIT_CONST(K)); 661 /* j <exit> */ 662 if (last && !(jit->seen & SEEN_RET0)) 663 break; 664 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg); 665 } 666 break; 667 case BPF_RET | BPF_A: 668 /* llgfr %r2,%r5 */ 669 EMIT4(0xb9160025); 670 /* j <exit> */ 671 EMIT4_PCREL(0xa7f40000, jit->exit_ip - jit->prg); 672 break; 673 case BPF_ST: /* mem[K] = A */ 674 jit->seen |= SEEN_MEM; 675 /* st %r5,<K>(%r15) */ 676 EMIT4_DISP(0x5050f000, 677 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 678 break; 679 case BPF_STX: /* mem[K] = X : mov %ebx,off8(%rbp) */ 680 jit->seen |= SEEN_XREG | SEEN_MEM; 681 /* st %r12,<K>(%r15) */ 682 EMIT4_DISP(0x50c0f000, 683 (jit->seen & SEEN_DATAREF) ? 160 + K*4 : K*4); 684 break; 685 case BPF_ANC | SKF_AD_PROTOCOL: /* A = ntohs(skb->protocol); */ 686 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, protocol) != 2); 687 /* lhi %r5,0 */ 688 EMIT4(0xa7580000); 689 /* icm %r5,3,<d(protocol)>(%r2) */ 690 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, protocol)); 691 break; 692 case BPF_ANC | SKF_AD_IFINDEX: /* if (!skb->dev) return 0; 693 * A = skb->dev->ifindex */ 694 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4); 695 jit->seen |= SEEN_RET0; 696 /* lg %r1,<d(dev)>(%r2) */ 697 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev)); 698 /* ltgr %r1,%r1 */ 699 EMIT4(0xb9020011); 700 /* jz <ret0> */ 701 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg); 702 /* l %r5,<d(ifindex)>(%r1) */ 703 EMIT4_DISP(0x58501000, offsetof(struct net_device, ifindex)); 704 break; 705 case BPF_ANC | SKF_AD_MARK: /* A = skb->mark */ 706 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, mark) != 4); 707 /* l %r5,<d(mark)>(%r2) */ 708 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, mark)); 709 break; 710 case BPF_ANC | SKF_AD_QUEUE: /* A = skb->queue_mapping */ 711 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, queue_mapping) != 2); 712 /* lhi %r5,0 */ 713 EMIT4(0xa7580000); 714 /* icm %r5,3,<d(queue_mapping)>(%r2) */ 715 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, queue_mapping)); 716 break; 717 case BPF_ANC | SKF_AD_HATYPE: /* if (!skb->dev) return 0; 718 * A = skb->dev->type */ 719 BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, type) != 2); 720 jit->seen |= SEEN_RET0; 721 /* lg %r1,<d(dev)>(%r2) */ 722 EMIT6_DISP(0xe3102000, 0x0004, offsetof(struct sk_buff, dev)); 723 /* ltgr %r1,%r1 */ 724 EMIT4(0xb9020011); 725 /* jz <ret0> */ 726 EMIT4_PCREL(0xa7840000, jit->ret0_ip - jit->prg); 727 /* lhi %r5,0 */ 728 EMIT4(0xa7580000); 729 /* icm %r5,3,<d(type)>(%r1) */ 730 EMIT4_DISP(0xbf531000, offsetof(struct net_device, type)); 731 break; 732 case BPF_ANC | SKF_AD_RXHASH: /* A = skb->hash */ 733 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, hash) != 4); 734 /* l %r5,<d(hash)>(%r2) */ 735 EMIT4_DISP(0x58502000, offsetof(struct sk_buff, hash)); 736 break; 737 case BPF_ANC | SKF_AD_VLAN_TAG: 738 case BPF_ANC | SKF_AD_VLAN_TAG_PRESENT: 739 BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, vlan_tci) != 2); 740 BUILD_BUG_ON(VLAN_TAG_PRESENT != 0x1000); 741 /* lhi %r5,0 */ 742 EMIT4(0xa7580000); 743 /* icm %r5,3,<d(vlan_tci)>(%r2) */ 744 EMIT4_DISP(0xbf532000, offsetof(struct sk_buff, vlan_tci)); 745 if (code == (BPF_ANC | SKF_AD_VLAN_TAG)) { 746 /* nill %r5,0xefff */ 747 EMIT4_IMM(0xa5570000, ~VLAN_TAG_PRESENT); 748 } else { 749 /* nill %r5,0x1000 */ 750 EMIT4_IMM(0xa5570000, VLAN_TAG_PRESENT); 751 /* srl %r5,12 */ 752 EMIT4_DISP(0x88500000, 12); 753 } 754 break; 755 case BPF_ANC | SKF_AD_PKTTYPE: 756 if (pkt_type_offset < 0) 757 goto out; 758 /* lhi %r5,0 */ 759 EMIT4(0xa7580000); 760 /* ic %r5,<d(pkt_type_offset)>(%r2) */ 761 EMIT4_DISP(0x43502000, pkt_type_offset); 762 /* srl %r5,5 */ 763 EMIT4_DISP(0x88500000, 5); 764 break; 765 case BPF_ANC | SKF_AD_CPU: /* A = smp_processor_id() */ 766 #ifdef CONFIG_SMP 767 /* l %r5,<d(cpu_nr)> */ 768 EMIT4_DISP(0x58500000, offsetof(struct _lowcore, cpu_nr)); 769 #else 770 /* lhi %r5,0 */ 771 EMIT4(0xa7580000); 772 #endif 773 break; 774 default: /* too complex, give up */ 775 goto out; 776 } 777 addrs[i] = jit->prg - jit->start; 778 return 0; 779 out: 780 return -1; 781 } 782 783 /* 784 * Note: for security reasons, bpf code will follow a randomly 785 * sized amount of illegal instructions. 786 */ 787 struct bpf_binary_header { 788 unsigned int pages; 789 u8 image[]; 790 }; 791 792 static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize, 793 u8 **image_ptr) 794 { 795 struct bpf_binary_header *header; 796 unsigned int sz, hole; 797 798 /* Most BPF filters are really small, but if some of them fill a page, 799 * allow at least 128 extra bytes for illegal instructions. 800 */ 801 sz = round_up(bpfsize + sizeof(*header) + 128, PAGE_SIZE); 802 header = module_alloc(sz); 803 if (!header) 804 return NULL; 805 memset(header, 0, sz); 806 header->pages = sz / PAGE_SIZE; 807 hole = min(sz - (bpfsize + sizeof(*header)), PAGE_SIZE - sizeof(*header)); 808 /* Insert random number of illegal instructions before BPF code 809 * and make sure the first instruction starts at an even address. 810 */ 811 *image_ptr = &header->image[(prandom_u32() % hole) & -2]; 812 return header; 813 } 814 815 void bpf_jit_compile(struct bpf_prog *fp) 816 { 817 struct bpf_binary_header *header = NULL; 818 unsigned long size, prg_len, lit_len; 819 struct bpf_jit jit, cjit; 820 unsigned int *addrs; 821 int pass, i; 822 823 if (!bpf_jit_enable) 824 return; 825 addrs = kcalloc(fp->len, sizeof(*addrs), GFP_KERNEL); 826 if (addrs == NULL) 827 return; 828 memset(&jit, 0, sizeof(cjit)); 829 memset(&cjit, 0, sizeof(cjit)); 830 831 for (pass = 0; pass < 10; pass++) { 832 jit.prg = jit.start; 833 jit.lit = jit.mid; 834 835 bpf_jit_prologue(&jit); 836 bpf_jit_noleaks(&jit, fp->insns); 837 for (i = 0; i < fp->len; i++) { 838 if (bpf_jit_insn(&jit, fp->insns + i, addrs, i, 839 i == fp->len - 1)) 840 goto out; 841 } 842 bpf_jit_epilogue(&jit); 843 if (jit.start) { 844 WARN_ON(jit.prg > cjit.prg || jit.lit > cjit.lit); 845 if (memcmp(&jit, &cjit, sizeof(jit)) == 0) 846 break; 847 } else if (jit.prg == cjit.prg && jit.lit == cjit.lit) { 848 prg_len = jit.prg - jit.start; 849 lit_len = jit.lit - jit.mid; 850 size = prg_len + lit_len; 851 if (size >= BPF_SIZE_MAX) 852 goto out; 853 header = bpf_alloc_binary(size, &jit.start); 854 if (!header) 855 goto out; 856 jit.prg = jit.mid = jit.start + prg_len; 857 jit.lit = jit.end = jit.start + prg_len + lit_len; 858 jit.base_ip += (unsigned long) jit.start; 859 jit.exit_ip += (unsigned long) jit.start; 860 jit.ret0_ip += (unsigned long) jit.start; 861 } 862 cjit = jit; 863 } 864 if (bpf_jit_enable > 1) { 865 bpf_jit_dump(fp->len, jit.end - jit.start, pass, jit.start); 866 if (jit.start) 867 print_fn_code(jit.start, jit.mid - jit.start); 868 } 869 if (jit.start) { 870 set_memory_ro((unsigned long)header, header->pages); 871 fp->bpf_func = (void *) jit.start; 872 fp->jited = 1; 873 } 874 out: 875 kfree(addrs); 876 } 877 878 void bpf_jit_free(struct bpf_prog *fp) 879 { 880 unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK; 881 struct bpf_binary_header *header = (void *)addr; 882 883 if (!fp->jited) 884 goto free_filter; 885 886 set_memory_rw(addr, header->pages); 887 module_free(NULL, header); 888 889 free_filter: 890 kfree(fp); 891 } 892