xref: /linux/arch/x86/net/bpf_jit_comp.c (revision 2c63221cd9e5c0dad0424029aeb1c40faada8330)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * bpf_jit_comp.c: BPF JIT compiler
4  *
5  * Copyright (C) 2011-2013 Eric Dumazet (eric.dumazet@gmail.com)
6  * Internal BPF Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
7  */
8 #include <linux/netdevice.h>
9 #include <linux/filter.h>
10 #include <linux/if_vlan.h>
11 #include <linux/bpf.h>
12 #include <asm/extable.h>
13 #include <asm/set_memory.h>
14 #include <asm/nospec-branch.h>
15 
16 static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len)
17 {
18 	if (len == 1)
19 		*ptr = bytes;
20 	else if (len == 2)
21 		*(u16 *)ptr = bytes;
22 	else {
23 		*(u32 *)ptr = bytes;
24 		barrier();
25 	}
26 	return ptr + len;
27 }
28 
29 #define EMIT(bytes, len) \
30 	do { prog = emit_code(prog, bytes, len); cnt += len; } while (0)
31 
32 #define EMIT1(b1)		EMIT(b1, 1)
33 #define EMIT2(b1, b2)		EMIT((b1) + ((b2) << 8), 2)
34 #define EMIT3(b1, b2, b3)	EMIT((b1) + ((b2) << 8) + ((b3) << 16), 3)
35 #define EMIT4(b1, b2, b3, b4)   EMIT((b1) + ((b2) << 8) + ((b3) << 16) + ((b4) << 24), 4)
36 
37 #define EMIT1_off32(b1, off) \
38 	do { EMIT1(b1); EMIT(off, 4); } while (0)
39 #define EMIT2_off32(b1, b2, off) \
40 	do { EMIT2(b1, b2); EMIT(off, 4); } while (0)
41 #define EMIT3_off32(b1, b2, b3, off) \
42 	do { EMIT3(b1, b2, b3); EMIT(off, 4); } while (0)
43 #define EMIT4_off32(b1, b2, b3, b4, off) \
44 	do { EMIT4(b1, b2, b3, b4); EMIT(off, 4); } while (0)
45 
46 static bool is_imm8(int value)
47 {
48 	return value <= 127 && value >= -128;
49 }
50 
51 static bool is_simm32(s64 value)
52 {
53 	return value == (s64)(s32)value;
54 }
55 
56 static bool is_uimm32(u64 value)
57 {
58 	return value == (u64)(u32)value;
59 }
60 
61 /* mov dst, src */
62 #define EMIT_mov(DST, SRC)								 \
63 	do {										 \
64 		if (DST != SRC)								 \
65 			EMIT3(add_2mod(0x48, DST, SRC), 0x89, add_2reg(0xC0, DST, SRC)); \
66 	} while (0)
67 
68 static int bpf_size_to_x86_bytes(int bpf_size)
69 {
70 	if (bpf_size == BPF_W)
71 		return 4;
72 	else if (bpf_size == BPF_H)
73 		return 2;
74 	else if (bpf_size == BPF_B)
75 		return 1;
76 	else if (bpf_size == BPF_DW)
77 		return 4; /* imm32 */
78 	else
79 		return 0;
80 }
81 
82 /*
83  * List of x86 cond jumps opcodes (. + s8)
84  * Add 0x10 (and an extra 0x0f) to generate far jumps (. + s32)
85  */
86 #define X86_JB  0x72
87 #define X86_JAE 0x73
88 #define X86_JE  0x74
89 #define X86_JNE 0x75
90 #define X86_JBE 0x76
91 #define X86_JA  0x77
92 #define X86_JL  0x7C
93 #define X86_JGE 0x7D
94 #define X86_JLE 0x7E
95 #define X86_JG  0x7F
96 
97 /* Pick a register outside of BPF range for JIT internal work */
98 #define AUX_REG (MAX_BPF_JIT_REG + 1)
99 
100 /*
101  * The following table maps BPF registers to x86-64 registers.
102  *
103  * x86-64 register R12 is unused, since if used as base address
104  * register in load/store instructions, it always needs an
105  * extra byte of encoding and is callee saved.
106  *
107  * Also x86-64 register R9 is unused. x86-64 register R10 is
108  * used for blinding (if enabled).
109  */
110 static const int reg2hex[] = {
111 	[BPF_REG_0] = 0,  /* RAX */
112 	[BPF_REG_1] = 7,  /* RDI */
113 	[BPF_REG_2] = 6,  /* RSI */
114 	[BPF_REG_3] = 2,  /* RDX */
115 	[BPF_REG_4] = 1,  /* RCX */
116 	[BPF_REG_5] = 0,  /* R8  */
117 	[BPF_REG_6] = 3,  /* RBX callee saved */
118 	[BPF_REG_7] = 5,  /* R13 callee saved */
119 	[BPF_REG_8] = 6,  /* R14 callee saved */
120 	[BPF_REG_9] = 7,  /* R15 callee saved */
121 	[BPF_REG_FP] = 5, /* RBP readonly */
122 	[BPF_REG_AX] = 2, /* R10 temp register */
123 	[AUX_REG] = 3,    /* R11 temp register */
124 };
125 
126 static const int reg2pt_regs[] = {
127 	[BPF_REG_0] = offsetof(struct pt_regs, ax),
128 	[BPF_REG_1] = offsetof(struct pt_regs, di),
129 	[BPF_REG_2] = offsetof(struct pt_regs, si),
130 	[BPF_REG_3] = offsetof(struct pt_regs, dx),
131 	[BPF_REG_4] = offsetof(struct pt_regs, cx),
132 	[BPF_REG_5] = offsetof(struct pt_regs, r8),
133 	[BPF_REG_6] = offsetof(struct pt_regs, bx),
134 	[BPF_REG_7] = offsetof(struct pt_regs, r13),
135 	[BPF_REG_8] = offsetof(struct pt_regs, r14),
136 	[BPF_REG_9] = offsetof(struct pt_regs, r15),
137 };
138 
139 /*
140  * is_ereg() == true if BPF register 'reg' maps to x86-64 r8..r15
141  * which need extra byte of encoding.
142  * rax,rcx,...,rbp have simpler encoding
143  */
144 static bool is_ereg(u32 reg)
145 {
146 	return (1 << reg) & (BIT(BPF_REG_5) |
147 			     BIT(AUX_REG) |
148 			     BIT(BPF_REG_7) |
149 			     BIT(BPF_REG_8) |
150 			     BIT(BPF_REG_9) |
151 			     BIT(BPF_REG_AX));
152 }
153 
154 static bool is_axreg(u32 reg)
155 {
156 	return reg == BPF_REG_0;
157 }
158 
159 /* Add modifiers if 'reg' maps to x86-64 registers R8..R15 */
160 static u8 add_1mod(u8 byte, u32 reg)
161 {
162 	if (is_ereg(reg))
163 		byte |= 1;
164 	return byte;
165 }
166 
167 static u8 add_2mod(u8 byte, u32 r1, u32 r2)
168 {
169 	if (is_ereg(r1))
170 		byte |= 1;
171 	if (is_ereg(r2))
172 		byte |= 4;
173 	return byte;
174 }
175 
176 /* Encode 'dst_reg' register into x86-64 opcode 'byte' */
177 static u8 add_1reg(u8 byte, u32 dst_reg)
178 {
179 	return byte + reg2hex[dst_reg];
180 }
181 
182 /* Encode 'dst_reg' and 'src_reg' registers into x86-64 opcode 'byte' */
183 static u8 add_2reg(u8 byte, u32 dst_reg, u32 src_reg)
184 {
185 	return byte + reg2hex[dst_reg] + (reg2hex[src_reg] << 3);
186 }
187 
188 static void jit_fill_hole(void *area, unsigned int size)
189 {
190 	/* Fill whole space with INT3 instructions */
191 	memset(area, 0xcc, size);
192 }
193 
194 struct jit_context {
195 	int cleanup_addr; /* Epilogue code offset */
196 };
197 
198 /* Maximum number of bytes emitted while JITing one eBPF insn */
199 #define BPF_MAX_INSN_SIZE	128
200 #define BPF_INSN_SAFETY		64
201 
202 #define PROLOGUE_SIZE		20
203 
204 /*
205  * Emit x86-64 prologue code for BPF program and check its size.
206  * bpf_tail_call helper will skip it while jumping into another program
207  */
208 static void emit_prologue(u8 **pprog, u32 stack_depth, bool ebpf_from_cbpf)
209 {
210 	u8 *prog = *pprog;
211 	int cnt = 0;
212 
213 	EMIT1(0x55);             /* push rbp */
214 	EMIT3(0x48, 0x89, 0xE5); /* mov rbp, rsp */
215 	/* sub rsp, rounded_stack_depth */
216 	EMIT3_off32(0x48, 0x81, 0xEC, round_up(stack_depth, 8));
217 	EMIT1(0x53);             /* push rbx */
218 	EMIT2(0x41, 0x55);       /* push r13 */
219 	EMIT2(0x41, 0x56);       /* push r14 */
220 	EMIT2(0x41, 0x57);       /* push r15 */
221 	if (!ebpf_from_cbpf) {
222 		/* zero init tail_call_cnt */
223 		EMIT2(0x6a, 0x00);
224 		BUILD_BUG_ON(cnt != PROLOGUE_SIZE);
225 	}
226 	*pprog = prog;
227 }
228 
229 /*
230  * Generate the following code:
231  *
232  * ... bpf_tail_call(void *ctx, struct bpf_array *array, u64 index) ...
233  *   if (index >= array->map.max_entries)
234  *     goto out;
235  *   if (++tail_call_cnt > MAX_TAIL_CALL_CNT)
236  *     goto out;
237  *   prog = array->ptrs[index];
238  *   if (prog == NULL)
239  *     goto out;
240  *   goto *(prog->bpf_func + prologue_size);
241  * out:
242  */
243 static void emit_bpf_tail_call(u8 **pprog)
244 {
245 	u8 *prog = *pprog;
246 	int label1, label2, label3;
247 	int cnt = 0;
248 
249 	/*
250 	 * rdi - pointer to ctx
251 	 * rsi - pointer to bpf_array
252 	 * rdx - index in bpf_array
253 	 */
254 
255 	/*
256 	 * if (index >= array->map.max_entries)
257 	 *	goto out;
258 	 */
259 	EMIT2(0x89, 0xD2);                        /* mov edx, edx */
260 	EMIT3(0x39, 0x56,                         /* cmp dword ptr [rsi + 16], edx */
261 	      offsetof(struct bpf_array, map.max_entries));
262 #define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* Number of bytes to jump */
263 	EMIT2(X86_JBE, OFFSET1);                  /* jbe out */
264 	label1 = cnt;
265 
266 	/*
267 	 * if (tail_call_cnt > MAX_TAIL_CALL_CNT)
268 	 *	goto out;
269 	 */
270 	EMIT2_off32(0x8B, 0x85, -36 - MAX_BPF_STACK); /* mov eax, dword ptr [rbp - 548] */
271 	EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT);     /* cmp eax, MAX_TAIL_CALL_CNT */
272 #define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
273 	EMIT2(X86_JA, OFFSET2);                   /* ja out */
274 	label2 = cnt;
275 	EMIT3(0x83, 0xC0, 0x01);                  /* add eax, 1 */
276 	EMIT2_off32(0x89, 0x85, -36 - MAX_BPF_STACK); /* mov dword ptr [rbp -548], eax */
277 
278 	/* prog = array->ptrs[index]; */
279 	EMIT4_off32(0x48, 0x8B, 0x84, 0xD6,       /* mov rax, [rsi + rdx * 8 + offsetof(...)] */
280 		    offsetof(struct bpf_array, ptrs));
281 
282 	/*
283 	 * if (prog == NULL)
284 	 *	goto out;
285 	 */
286 	EMIT3(0x48, 0x85, 0xC0);		  /* test rax,rax */
287 #define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE)
288 	EMIT2(X86_JE, OFFSET3);                   /* je out */
289 	label3 = cnt;
290 
291 	/* goto *(prog->bpf_func + prologue_size); */
292 	EMIT4(0x48, 0x8B, 0x40,                   /* mov rax, qword ptr [rax + 32] */
293 	      offsetof(struct bpf_prog, bpf_func));
294 	EMIT4(0x48, 0x83, 0xC0, PROLOGUE_SIZE);   /* add rax, prologue_size */
295 
296 	/*
297 	 * Wow we're ready to jump into next BPF program
298 	 * rdi == ctx (1st arg)
299 	 * rax == prog->bpf_func + prologue_size
300 	 */
301 	RETPOLINE_RAX_BPF_JIT();
302 
303 	/* out: */
304 	BUILD_BUG_ON(cnt - label1 != OFFSET1);
305 	BUILD_BUG_ON(cnt - label2 != OFFSET2);
306 	BUILD_BUG_ON(cnt - label3 != OFFSET3);
307 	*pprog = prog;
308 }
309 
310 static void emit_mov_imm32(u8 **pprog, bool sign_propagate,
311 			   u32 dst_reg, const u32 imm32)
312 {
313 	u8 *prog = *pprog;
314 	u8 b1, b2, b3;
315 	int cnt = 0;
316 
317 	/*
318 	 * Optimization: if imm32 is positive, use 'mov %eax, imm32'
319 	 * (which zero-extends imm32) to save 2 bytes.
320 	 */
321 	if (sign_propagate && (s32)imm32 < 0) {
322 		/* 'mov %rax, imm32' sign extends imm32 */
323 		b1 = add_1mod(0x48, dst_reg);
324 		b2 = 0xC7;
325 		b3 = 0xC0;
326 		EMIT3_off32(b1, b2, add_1reg(b3, dst_reg), imm32);
327 		goto done;
328 	}
329 
330 	/*
331 	 * Optimization: if imm32 is zero, use 'xor %eax, %eax'
332 	 * to save 3 bytes.
333 	 */
334 	if (imm32 == 0) {
335 		if (is_ereg(dst_reg))
336 			EMIT1(add_2mod(0x40, dst_reg, dst_reg));
337 		b2 = 0x31; /* xor */
338 		b3 = 0xC0;
339 		EMIT2(b2, add_2reg(b3, dst_reg, dst_reg));
340 		goto done;
341 	}
342 
343 	/* mov %eax, imm32 */
344 	if (is_ereg(dst_reg))
345 		EMIT1(add_1mod(0x40, dst_reg));
346 	EMIT1_off32(add_1reg(0xB8, dst_reg), imm32);
347 done:
348 	*pprog = prog;
349 }
350 
351 static void emit_mov_imm64(u8 **pprog, u32 dst_reg,
352 			   const u32 imm32_hi, const u32 imm32_lo)
353 {
354 	u8 *prog = *pprog;
355 	int cnt = 0;
356 
357 	if (is_uimm32(((u64)imm32_hi << 32) | (u32)imm32_lo)) {
358 		/*
359 		 * For emitting plain u32, where sign bit must not be
360 		 * propagated LLVM tends to load imm64 over mov32
361 		 * directly, so save couple of bytes by just doing
362 		 * 'mov %eax, imm32' instead.
363 		 */
364 		emit_mov_imm32(&prog, false, dst_reg, imm32_lo);
365 	} else {
366 		/* movabsq %rax, imm64 */
367 		EMIT2(add_1mod(0x48, dst_reg), add_1reg(0xB8, dst_reg));
368 		EMIT(imm32_lo, 4);
369 		EMIT(imm32_hi, 4);
370 	}
371 
372 	*pprog = prog;
373 }
374 
375 static void emit_mov_reg(u8 **pprog, bool is64, u32 dst_reg, u32 src_reg)
376 {
377 	u8 *prog = *pprog;
378 	int cnt = 0;
379 
380 	if (is64) {
381 		/* mov dst, src */
382 		EMIT_mov(dst_reg, src_reg);
383 	} else {
384 		/* mov32 dst, src */
385 		if (is_ereg(dst_reg) || is_ereg(src_reg))
386 			EMIT1(add_2mod(0x40, dst_reg, src_reg));
387 		EMIT2(0x89, add_2reg(0xC0, dst_reg, src_reg));
388 	}
389 
390 	*pprog = prog;
391 }
392 
393 
394 static bool ex_handler_bpf(const struct exception_table_entry *x,
395 			   struct pt_regs *regs, int trapnr,
396 			   unsigned long error_code, unsigned long fault_addr)
397 {
398 	u32 reg = x->fixup >> 8;
399 
400 	/* jump over faulting load and clear dest register */
401 	*(unsigned long *)((void *)regs + reg) = 0;
402 	regs->ip += x->fixup & 0xff;
403 	return true;
404 }
405 
406 static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
407 		  int oldproglen, struct jit_context *ctx)
408 {
409 	struct bpf_insn *insn = bpf_prog->insnsi;
410 	int insn_cnt = bpf_prog->len;
411 	bool seen_exit = false;
412 	u8 temp[BPF_MAX_INSN_SIZE + BPF_INSN_SAFETY];
413 	int i, cnt = 0, excnt = 0;
414 	int proglen = 0;
415 	u8 *prog = temp;
416 
417 	emit_prologue(&prog, bpf_prog->aux->stack_depth,
418 		      bpf_prog_was_classic(bpf_prog));
419 	addrs[0] = prog - temp;
420 
421 	for (i = 1; i <= insn_cnt; i++, insn++) {
422 		const s32 imm32 = insn->imm;
423 		u32 dst_reg = insn->dst_reg;
424 		u32 src_reg = insn->src_reg;
425 		u8 b2 = 0, b3 = 0;
426 		s64 jmp_offset;
427 		u8 jmp_cond;
428 		int ilen;
429 		u8 *func;
430 
431 		switch (insn->code) {
432 			/* ALU */
433 		case BPF_ALU | BPF_ADD | BPF_X:
434 		case BPF_ALU | BPF_SUB | BPF_X:
435 		case BPF_ALU | BPF_AND | BPF_X:
436 		case BPF_ALU | BPF_OR | BPF_X:
437 		case BPF_ALU | BPF_XOR | BPF_X:
438 		case BPF_ALU64 | BPF_ADD | BPF_X:
439 		case BPF_ALU64 | BPF_SUB | BPF_X:
440 		case BPF_ALU64 | BPF_AND | BPF_X:
441 		case BPF_ALU64 | BPF_OR | BPF_X:
442 		case BPF_ALU64 | BPF_XOR | BPF_X:
443 			switch (BPF_OP(insn->code)) {
444 			case BPF_ADD: b2 = 0x01; break;
445 			case BPF_SUB: b2 = 0x29; break;
446 			case BPF_AND: b2 = 0x21; break;
447 			case BPF_OR: b2 = 0x09; break;
448 			case BPF_XOR: b2 = 0x31; break;
449 			}
450 			if (BPF_CLASS(insn->code) == BPF_ALU64)
451 				EMIT1(add_2mod(0x48, dst_reg, src_reg));
452 			else if (is_ereg(dst_reg) || is_ereg(src_reg))
453 				EMIT1(add_2mod(0x40, dst_reg, src_reg));
454 			EMIT2(b2, add_2reg(0xC0, dst_reg, src_reg));
455 			break;
456 
457 		case BPF_ALU64 | BPF_MOV | BPF_X:
458 		case BPF_ALU | BPF_MOV | BPF_X:
459 			emit_mov_reg(&prog,
460 				     BPF_CLASS(insn->code) == BPF_ALU64,
461 				     dst_reg, src_reg);
462 			break;
463 
464 			/* neg dst */
465 		case BPF_ALU | BPF_NEG:
466 		case BPF_ALU64 | BPF_NEG:
467 			if (BPF_CLASS(insn->code) == BPF_ALU64)
468 				EMIT1(add_1mod(0x48, dst_reg));
469 			else if (is_ereg(dst_reg))
470 				EMIT1(add_1mod(0x40, dst_reg));
471 			EMIT2(0xF7, add_1reg(0xD8, dst_reg));
472 			break;
473 
474 		case BPF_ALU | BPF_ADD | BPF_K:
475 		case BPF_ALU | BPF_SUB | BPF_K:
476 		case BPF_ALU | BPF_AND | BPF_K:
477 		case BPF_ALU | BPF_OR | BPF_K:
478 		case BPF_ALU | BPF_XOR | BPF_K:
479 		case BPF_ALU64 | BPF_ADD | BPF_K:
480 		case BPF_ALU64 | BPF_SUB | BPF_K:
481 		case BPF_ALU64 | BPF_AND | BPF_K:
482 		case BPF_ALU64 | BPF_OR | BPF_K:
483 		case BPF_ALU64 | BPF_XOR | BPF_K:
484 			if (BPF_CLASS(insn->code) == BPF_ALU64)
485 				EMIT1(add_1mod(0x48, dst_reg));
486 			else if (is_ereg(dst_reg))
487 				EMIT1(add_1mod(0x40, dst_reg));
488 
489 			/*
490 			 * b3 holds 'normal' opcode, b2 short form only valid
491 			 * in case dst is eax/rax.
492 			 */
493 			switch (BPF_OP(insn->code)) {
494 			case BPF_ADD:
495 				b3 = 0xC0;
496 				b2 = 0x05;
497 				break;
498 			case BPF_SUB:
499 				b3 = 0xE8;
500 				b2 = 0x2D;
501 				break;
502 			case BPF_AND:
503 				b3 = 0xE0;
504 				b2 = 0x25;
505 				break;
506 			case BPF_OR:
507 				b3 = 0xC8;
508 				b2 = 0x0D;
509 				break;
510 			case BPF_XOR:
511 				b3 = 0xF0;
512 				b2 = 0x35;
513 				break;
514 			}
515 
516 			if (is_imm8(imm32))
517 				EMIT3(0x83, add_1reg(b3, dst_reg), imm32);
518 			else if (is_axreg(dst_reg))
519 				EMIT1_off32(b2, imm32);
520 			else
521 				EMIT2_off32(0x81, add_1reg(b3, dst_reg), imm32);
522 			break;
523 
524 		case BPF_ALU64 | BPF_MOV | BPF_K:
525 		case BPF_ALU | BPF_MOV | BPF_K:
526 			emit_mov_imm32(&prog, BPF_CLASS(insn->code) == BPF_ALU64,
527 				       dst_reg, imm32);
528 			break;
529 
530 		case BPF_LD | BPF_IMM | BPF_DW:
531 			emit_mov_imm64(&prog, dst_reg, insn[1].imm, insn[0].imm);
532 			insn++;
533 			i++;
534 			break;
535 
536 			/* dst %= src, dst /= src, dst %= imm32, dst /= imm32 */
537 		case BPF_ALU | BPF_MOD | BPF_X:
538 		case BPF_ALU | BPF_DIV | BPF_X:
539 		case BPF_ALU | BPF_MOD | BPF_K:
540 		case BPF_ALU | BPF_DIV | BPF_K:
541 		case BPF_ALU64 | BPF_MOD | BPF_X:
542 		case BPF_ALU64 | BPF_DIV | BPF_X:
543 		case BPF_ALU64 | BPF_MOD | BPF_K:
544 		case BPF_ALU64 | BPF_DIV | BPF_K:
545 			EMIT1(0x50); /* push rax */
546 			EMIT1(0x52); /* push rdx */
547 
548 			if (BPF_SRC(insn->code) == BPF_X)
549 				/* mov r11, src_reg */
550 				EMIT_mov(AUX_REG, src_reg);
551 			else
552 				/* mov r11, imm32 */
553 				EMIT3_off32(0x49, 0xC7, 0xC3, imm32);
554 
555 			/* mov rax, dst_reg */
556 			EMIT_mov(BPF_REG_0, dst_reg);
557 
558 			/*
559 			 * xor edx, edx
560 			 * equivalent to 'xor rdx, rdx', but one byte less
561 			 */
562 			EMIT2(0x31, 0xd2);
563 
564 			if (BPF_CLASS(insn->code) == BPF_ALU64)
565 				/* div r11 */
566 				EMIT3(0x49, 0xF7, 0xF3);
567 			else
568 				/* div r11d */
569 				EMIT3(0x41, 0xF7, 0xF3);
570 
571 			if (BPF_OP(insn->code) == BPF_MOD)
572 				/* mov r11, rdx */
573 				EMIT3(0x49, 0x89, 0xD3);
574 			else
575 				/* mov r11, rax */
576 				EMIT3(0x49, 0x89, 0xC3);
577 
578 			EMIT1(0x5A); /* pop rdx */
579 			EMIT1(0x58); /* pop rax */
580 
581 			/* mov dst_reg, r11 */
582 			EMIT_mov(dst_reg, AUX_REG);
583 			break;
584 
585 		case BPF_ALU | BPF_MUL | BPF_K:
586 		case BPF_ALU | BPF_MUL | BPF_X:
587 		case BPF_ALU64 | BPF_MUL | BPF_K:
588 		case BPF_ALU64 | BPF_MUL | BPF_X:
589 		{
590 			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;
591 
592 			if (dst_reg != BPF_REG_0)
593 				EMIT1(0x50); /* push rax */
594 			if (dst_reg != BPF_REG_3)
595 				EMIT1(0x52); /* push rdx */
596 
597 			/* mov r11, dst_reg */
598 			EMIT_mov(AUX_REG, dst_reg);
599 
600 			if (BPF_SRC(insn->code) == BPF_X)
601 				emit_mov_reg(&prog, is64, BPF_REG_0, src_reg);
602 			else
603 				emit_mov_imm32(&prog, is64, BPF_REG_0, imm32);
604 
605 			if (is64)
606 				EMIT1(add_1mod(0x48, AUX_REG));
607 			else if (is_ereg(AUX_REG))
608 				EMIT1(add_1mod(0x40, AUX_REG));
609 			/* mul(q) r11 */
610 			EMIT2(0xF7, add_1reg(0xE0, AUX_REG));
611 
612 			if (dst_reg != BPF_REG_3)
613 				EMIT1(0x5A); /* pop rdx */
614 			if (dst_reg != BPF_REG_0) {
615 				/* mov dst_reg, rax */
616 				EMIT_mov(dst_reg, BPF_REG_0);
617 				EMIT1(0x58); /* pop rax */
618 			}
619 			break;
620 		}
621 			/* Shifts */
622 		case BPF_ALU | BPF_LSH | BPF_K:
623 		case BPF_ALU | BPF_RSH | BPF_K:
624 		case BPF_ALU | BPF_ARSH | BPF_K:
625 		case BPF_ALU64 | BPF_LSH | BPF_K:
626 		case BPF_ALU64 | BPF_RSH | BPF_K:
627 		case BPF_ALU64 | BPF_ARSH | BPF_K:
628 			if (BPF_CLASS(insn->code) == BPF_ALU64)
629 				EMIT1(add_1mod(0x48, dst_reg));
630 			else if (is_ereg(dst_reg))
631 				EMIT1(add_1mod(0x40, dst_reg));
632 
633 			switch (BPF_OP(insn->code)) {
634 			case BPF_LSH: b3 = 0xE0; break;
635 			case BPF_RSH: b3 = 0xE8; break;
636 			case BPF_ARSH: b3 = 0xF8; break;
637 			}
638 
639 			if (imm32 == 1)
640 				EMIT2(0xD1, add_1reg(b3, dst_reg));
641 			else
642 				EMIT3(0xC1, add_1reg(b3, dst_reg), imm32);
643 			break;
644 
645 		case BPF_ALU | BPF_LSH | BPF_X:
646 		case BPF_ALU | BPF_RSH | BPF_X:
647 		case BPF_ALU | BPF_ARSH | BPF_X:
648 		case BPF_ALU64 | BPF_LSH | BPF_X:
649 		case BPF_ALU64 | BPF_RSH | BPF_X:
650 		case BPF_ALU64 | BPF_ARSH | BPF_X:
651 
652 			/* Check for bad case when dst_reg == rcx */
653 			if (dst_reg == BPF_REG_4) {
654 				/* mov r11, dst_reg */
655 				EMIT_mov(AUX_REG, dst_reg);
656 				dst_reg = AUX_REG;
657 			}
658 
659 			if (src_reg != BPF_REG_4) { /* common case */
660 				EMIT1(0x51); /* push rcx */
661 
662 				/* mov rcx, src_reg */
663 				EMIT_mov(BPF_REG_4, src_reg);
664 			}
665 
666 			/* shl %rax, %cl | shr %rax, %cl | sar %rax, %cl */
667 			if (BPF_CLASS(insn->code) == BPF_ALU64)
668 				EMIT1(add_1mod(0x48, dst_reg));
669 			else if (is_ereg(dst_reg))
670 				EMIT1(add_1mod(0x40, dst_reg));
671 
672 			switch (BPF_OP(insn->code)) {
673 			case BPF_LSH: b3 = 0xE0; break;
674 			case BPF_RSH: b3 = 0xE8; break;
675 			case BPF_ARSH: b3 = 0xF8; break;
676 			}
677 			EMIT2(0xD3, add_1reg(b3, dst_reg));
678 
679 			if (src_reg != BPF_REG_4)
680 				EMIT1(0x59); /* pop rcx */
681 
682 			if (insn->dst_reg == BPF_REG_4)
683 				/* mov dst_reg, r11 */
684 				EMIT_mov(insn->dst_reg, AUX_REG);
685 			break;
686 
687 		case BPF_ALU | BPF_END | BPF_FROM_BE:
688 			switch (imm32) {
689 			case 16:
690 				/* Emit 'ror %ax, 8' to swap lower 2 bytes */
691 				EMIT1(0x66);
692 				if (is_ereg(dst_reg))
693 					EMIT1(0x41);
694 				EMIT3(0xC1, add_1reg(0xC8, dst_reg), 8);
695 
696 				/* Emit 'movzwl eax, ax' */
697 				if (is_ereg(dst_reg))
698 					EMIT3(0x45, 0x0F, 0xB7);
699 				else
700 					EMIT2(0x0F, 0xB7);
701 				EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
702 				break;
703 			case 32:
704 				/* Emit 'bswap eax' to swap lower 4 bytes */
705 				if (is_ereg(dst_reg))
706 					EMIT2(0x41, 0x0F);
707 				else
708 					EMIT1(0x0F);
709 				EMIT1(add_1reg(0xC8, dst_reg));
710 				break;
711 			case 64:
712 				/* Emit 'bswap rax' to swap 8 bytes */
713 				EMIT3(add_1mod(0x48, dst_reg), 0x0F,
714 				      add_1reg(0xC8, dst_reg));
715 				break;
716 			}
717 			break;
718 
719 		case BPF_ALU | BPF_END | BPF_FROM_LE:
720 			switch (imm32) {
721 			case 16:
722 				/*
723 				 * Emit 'movzwl eax, ax' to zero extend 16-bit
724 				 * into 64 bit
725 				 */
726 				if (is_ereg(dst_reg))
727 					EMIT3(0x45, 0x0F, 0xB7);
728 				else
729 					EMIT2(0x0F, 0xB7);
730 				EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
731 				break;
732 			case 32:
733 				/* Emit 'mov eax, eax' to clear upper 32-bits */
734 				if (is_ereg(dst_reg))
735 					EMIT1(0x45);
736 				EMIT2(0x89, add_2reg(0xC0, dst_reg, dst_reg));
737 				break;
738 			case 64:
739 				/* nop */
740 				break;
741 			}
742 			break;
743 
744 			/* ST: *(u8*)(dst_reg + off) = imm */
745 		case BPF_ST | BPF_MEM | BPF_B:
746 			if (is_ereg(dst_reg))
747 				EMIT2(0x41, 0xC6);
748 			else
749 				EMIT1(0xC6);
750 			goto st;
751 		case BPF_ST | BPF_MEM | BPF_H:
752 			if (is_ereg(dst_reg))
753 				EMIT3(0x66, 0x41, 0xC7);
754 			else
755 				EMIT2(0x66, 0xC7);
756 			goto st;
757 		case BPF_ST | BPF_MEM | BPF_W:
758 			if (is_ereg(dst_reg))
759 				EMIT2(0x41, 0xC7);
760 			else
761 				EMIT1(0xC7);
762 			goto st;
763 		case BPF_ST | BPF_MEM | BPF_DW:
764 			EMIT2(add_1mod(0x48, dst_reg), 0xC7);
765 
766 st:			if (is_imm8(insn->off))
767 				EMIT2(add_1reg(0x40, dst_reg), insn->off);
768 			else
769 				EMIT1_off32(add_1reg(0x80, dst_reg), insn->off);
770 
771 			EMIT(imm32, bpf_size_to_x86_bytes(BPF_SIZE(insn->code)));
772 			break;
773 
774 			/* STX: *(u8*)(dst_reg + off) = src_reg */
775 		case BPF_STX | BPF_MEM | BPF_B:
776 			/* Emit 'mov byte ptr [rax + off], al' */
777 			if (is_ereg(dst_reg) || is_ereg(src_reg) ||
778 			    /* We have to add extra byte for x86 SIL, DIL regs */
779 			    src_reg == BPF_REG_1 || src_reg == BPF_REG_2)
780 				EMIT2(add_2mod(0x40, dst_reg, src_reg), 0x88);
781 			else
782 				EMIT1(0x88);
783 			goto stx;
784 		case BPF_STX | BPF_MEM | BPF_H:
785 			if (is_ereg(dst_reg) || is_ereg(src_reg))
786 				EMIT3(0x66, add_2mod(0x40, dst_reg, src_reg), 0x89);
787 			else
788 				EMIT2(0x66, 0x89);
789 			goto stx;
790 		case BPF_STX | BPF_MEM | BPF_W:
791 			if (is_ereg(dst_reg) || is_ereg(src_reg))
792 				EMIT2(add_2mod(0x40, dst_reg, src_reg), 0x89);
793 			else
794 				EMIT1(0x89);
795 			goto stx;
796 		case BPF_STX | BPF_MEM | BPF_DW:
797 			EMIT2(add_2mod(0x48, dst_reg, src_reg), 0x89);
798 stx:			if (is_imm8(insn->off))
799 				EMIT2(add_2reg(0x40, dst_reg, src_reg), insn->off);
800 			else
801 				EMIT1_off32(add_2reg(0x80, dst_reg, src_reg),
802 					    insn->off);
803 			break;
804 
805 			/* LDX: dst_reg = *(u8*)(src_reg + off) */
806 		case BPF_LDX | BPF_MEM | BPF_B:
807 		case BPF_LDX | BPF_PROBE_MEM | BPF_B:
808 			/* Emit 'movzx rax, byte ptr [rax + off]' */
809 			EMIT3(add_2mod(0x48, src_reg, dst_reg), 0x0F, 0xB6);
810 			goto ldx;
811 		case BPF_LDX | BPF_MEM | BPF_H:
812 		case BPF_LDX | BPF_PROBE_MEM | BPF_H:
813 			/* Emit 'movzx rax, word ptr [rax + off]' */
814 			EMIT3(add_2mod(0x48, src_reg, dst_reg), 0x0F, 0xB7);
815 			goto ldx;
816 		case BPF_LDX | BPF_MEM | BPF_W:
817 		case BPF_LDX | BPF_PROBE_MEM | BPF_W:
818 			/* Emit 'mov eax, dword ptr [rax+0x14]' */
819 			if (is_ereg(dst_reg) || is_ereg(src_reg))
820 				EMIT2(add_2mod(0x40, src_reg, dst_reg), 0x8B);
821 			else
822 				EMIT1(0x8B);
823 			goto ldx;
824 		case BPF_LDX | BPF_MEM | BPF_DW:
825 		case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
826 			/* Emit 'mov rax, qword ptr [rax+0x14]' */
827 			EMIT2(add_2mod(0x48, src_reg, dst_reg), 0x8B);
828 ldx:			/*
829 			 * If insn->off == 0 we can save one extra byte, but
830 			 * special case of x86 R13 which always needs an offset
831 			 * is not worth the hassle
832 			 */
833 			if (is_imm8(insn->off))
834 				EMIT2(add_2reg(0x40, src_reg, dst_reg), insn->off);
835 			else
836 				EMIT1_off32(add_2reg(0x80, src_reg, dst_reg),
837 					    insn->off);
838 			if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
839 				struct exception_table_entry *ex;
840 				u8 *_insn = image + proglen;
841 				s64 delta;
842 
843 				if (!bpf_prog->aux->extable)
844 					break;
845 
846 				if (excnt >= bpf_prog->aux->num_exentries) {
847 					pr_err("ex gen bug\n");
848 					return -EFAULT;
849 				}
850 				ex = &bpf_prog->aux->extable[excnt++];
851 
852 				delta = _insn - (u8 *)&ex->insn;
853 				if (!is_simm32(delta)) {
854 					pr_err("extable->insn doesn't fit into 32-bit\n");
855 					return -EFAULT;
856 				}
857 				ex->insn = delta;
858 
859 				delta = (u8 *)ex_handler_bpf - (u8 *)&ex->handler;
860 				if (!is_simm32(delta)) {
861 					pr_err("extable->handler doesn't fit into 32-bit\n");
862 					return -EFAULT;
863 				}
864 				ex->handler = delta;
865 
866 				if (dst_reg > BPF_REG_9) {
867 					pr_err("verifier error\n");
868 					return -EFAULT;
869 				}
870 				/*
871 				 * Compute size of x86 insn and its target dest x86 register.
872 				 * ex_handler_bpf() will use lower 8 bits to adjust
873 				 * pt_regs->ip to jump over this x86 instruction
874 				 * and upper bits to figure out which pt_regs to zero out.
875 				 * End result: x86 insn "mov rbx, qword ptr [rax+0x14]"
876 				 * of 4 bytes will be ignored and rbx will be zero inited.
877 				 */
878 				ex->fixup = (prog - temp) | (reg2pt_regs[dst_reg] << 8);
879 			}
880 			break;
881 
882 			/* STX XADD: lock *(u32*)(dst_reg + off) += src_reg */
883 		case BPF_STX | BPF_XADD | BPF_W:
884 			/* Emit 'lock add dword ptr [rax + off], eax' */
885 			if (is_ereg(dst_reg) || is_ereg(src_reg))
886 				EMIT3(0xF0, add_2mod(0x40, dst_reg, src_reg), 0x01);
887 			else
888 				EMIT2(0xF0, 0x01);
889 			goto xadd;
890 		case BPF_STX | BPF_XADD | BPF_DW:
891 			EMIT3(0xF0, add_2mod(0x48, dst_reg, src_reg), 0x01);
892 xadd:			if (is_imm8(insn->off))
893 				EMIT2(add_2reg(0x40, dst_reg, src_reg), insn->off);
894 			else
895 				EMIT1_off32(add_2reg(0x80, dst_reg, src_reg),
896 					    insn->off);
897 			break;
898 
899 			/* call */
900 		case BPF_JMP | BPF_CALL:
901 			func = (u8 *) __bpf_call_base + imm32;
902 			jmp_offset = func - (image + addrs[i]);
903 			if (!imm32 || !is_simm32(jmp_offset)) {
904 				pr_err("unsupported BPF func %d addr %p image %p\n",
905 				       imm32, func, image);
906 				return -EINVAL;
907 			}
908 			EMIT1_off32(0xE8, jmp_offset);
909 			break;
910 
911 		case BPF_JMP | BPF_TAIL_CALL:
912 			emit_bpf_tail_call(&prog);
913 			break;
914 
915 			/* cond jump */
916 		case BPF_JMP | BPF_JEQ | BPF_X:
917 		case BPF_JMP | BPF_JNE | BPF_X:
918 		case BPF_JMP | BPF_JGT | BPF_X:
919 		case BPF_JMP | BPF_JLT | BPF_X:
920 		case BPF_JMP | BPF_JGE | BPF_X:
921 		case BPF_JMP | BPF_JLE | BPF_X:
922 		case BPF_JMP | BPF_JSGT | BPF_X:
923 		case BPF_JMP | BPF_JSLT | BPF_X:
924 		case BPF_JMP | BPF_JSGE | BPF_X:
925 		case BPF_JMP | BPF_JSLE | BPF_X:
926 		case BPF_JMP32 | BPF_JEQ | BPF_X:
927 		case BPF_JMP32 | BPF_JNE | BPF_X:
928 		case BPF_JMP32 | BPF_JGT | BPF_X:
929 		case BPF_JMP32 | BPF_JLT | BPF_X:
930 		case BPF_JMP32 | BPF_JGE | BPF_X:
931 		case BPF_JMP32 | BPF_JLE | BPF_X:
932 		case BPF_JMP32 | BPF_JSGT | BPF_X:
933 		case BPF_JMP32 | BPF_JSLT | BPF_X:
934 		case BPF_JMP32 | BPF_JSGE | BPF_X:
935 		case BPF_JMP32 | BPF_JSLE | BPF_X:
936 			/* cmp dst_reg, src_reg */
937 			if (BPF_CLASS(insn->code) == BPF_JMP)
938 				EMIT1(add_2mod(0x48, dst_reg, src_reg));
939 			else if (is_ereg(dst_reg) || is_ereg(src_reg))
940 				EMIT1(add_2mod(0x40, dst_reg, src_reg));
941 			EMIT2(0x39, add_2reg(0xC0, dst_reg, src_reg));
942 			goto emit_cond_jmp;
943 
944 		case BPF_JMP | BPF_JSET | BPF_X:
945 		case BPF_JMP32 | BPF_JSET | BPF_X:
946 			/* test dst_reg, src_reg */
947 			if (BPF_CLASS(insn->code) == BPF_JMP)
948 				EMIT1(add_2mod(0x48, dst_reg, src_reg));
949 			else if (is_ereg(dst_reg) || is_ereg(src_reg))
950 				EMIT1(add_2mod(0x40, dst_reg, src_reg));
951 			EMIT2(0x85, add_2reg(0xC0, dst_reg, src_reg));
952 			goto emit_cond_jmp;
953 
954 		case BPF_JMP | BPF_JSET | BPF_K:
955 		case BPF_JMP32 | BPF_JSET | BPF_K:
956 			/* test dst_reg, imm32 */
957 			if (BPF_CLASS(insn->code) == BPF_JMP)
958 				EMIT1(add_1mod(0x48, dst_reg));
959 			else if (is_ereg(dst_reg))
960 				EMIT1(add_1mod(0x40, dst_reg));
961 			EMIT2_off32(0xF7, add_1reg(0xC0, dst_reg), imm32);
962 			goto emit_cond_jmp;
963 
964 		case BPF_JMP | BPF_JEQ | BPF_K:
965 		case BPF_JMP | BPF_JNE | BPF_K:
966 		case BPF_JMP | BPF_JGT | BPF_K:
967 		case BPF_JMP | BPF_JLT | BPF_K:
968 		case BPF_JMP | BPF_JGE | BPF_K:
969 		case BPF_JMP | BPF_JLE | BPF_K:
970 		case BPF_JMP | BPF_JSGT | BPF_K:
971 		case BPF_JMP | BPF_JSLT | BPF_K:
972 		case BPF_JMP | BPF_JSGE | BPF_K:
973 		case BPF_JMP | BPF_JSLE | BPF_K:
974 		case BPF_JMP32 | BPF_JEQ | BPF_K:
975 		case BPF_JMP32 | BPF_JNE | BPF_K:
976 		case BPF_JMP32 | BPF_JGT | BPF_K:
977 		case BPF_JMP32 | BPF_JLT | BPF_K:
978 		case BPF_JMP32 | BPF_JGE | BPF_K:
979 		case BPF_JMP32 | BPF_JLE | BPF_K:
980 		case BPF_JMP32 | BPF_JSGT | BPF_K:
981 		case BPF_JMP32 | BPF_JSLT | BPF_K:
982 		case BPF_JMP32 | BPF_JSGE | BPF_K:
983 		case BPF_JMP32 | BPF_JSLE | BPF_K:
984 			/* test dst_reg, dst_reg to save one extra byte */
985 			if (imm32 == 0) {
986 				if (BPF_CLASS(insn->code) == BPF_JMP)
987 					EMIT1(add_2mod(0x48, dst_reg, dst_reg));
988 				else if (is_ereg(dst_reg))
989 					EMIT1(add_2mod(0x40, dst_reg, dst_reg));
990 				EMIT2(0x85, add_2reg(0xC0, dst_reg, dst_reg));
991 				goto emit_cond_jmp;
992 			}
993 
994 			/* cmp dst_reg, imm8/32 */
995 			if (BPF_CLASS(insn->code) == BPF_JMP)
996 				EMIT1(add_1mod(0x48, dst_reg));
997 			else if (is_ereg(dst_reg))
998 				EMIT1(add_1mod(0x40, dst_reg));
999 
1000 			if (is_imm8(imm32))
1001 				EMIT3(0x83, add_1reg(0xF8, dst_reg), imm32);
1002 			else
1003 				EMIT2_off32(0x81, add_1reg(0xF8, dst_reg), imm32);
1004 
1005 emit_cond_jmp:		/* Convert BPF opcode to x86 */
1006 			switch (BPF_OP(insn->code)) {
1007 			case BPF_JEQ:
1008 				jmp_cond = X86_JE;
1009 				break;
1010 			case BPF_JSET:
1011 			case BPF_JNE:
1012 				jmp_cond = X86_JNE;
1013 				break;
1014 			case BPF_JGT:
1015 				/* GT is unsigned '>', JA in x86 */
1016 				jmp_cond = X86_JA;
1017 				break;
1018 			case BPF_JLT:
1019 				/* LT is unsigned '<', JB in x86 */
1020 				jmp_cond = X86_JB;
1021 				break;
1022 			case BPF_JGE:
1023 				/* GE is unsigned '>=', JAE in x86 */
1024 				jmp_cond = X86_JAE;
1025 				break;
1026 			case BPF_JLE:
1027 				/* LE is unsigned '<=', JBE in x86 */
1028 				jmp_cond = X86_JBE;
1029 				break;
1030 			case BPF_JSGT:
1031 				/* Signed '>', GT in x86 */
1032 				jmp_cond = X86_JG;
1033 				break;
1034 			case BPF_JSLT:
1035 				/* Signed '<', LT in x86 */
1036 				jmp_cond = X86_JL;
1037 				break;
1038 			case BPF_JSGE:
1039 				/* Signed '>=', GE in x86 */
1040 				jmp_cond = X86_JGE;
1041 				break;
1042 			case BPF_JSLE:
1043 				/* Signed '<=', LE in x86 */
1044 				jmp_cond = X86_JLE;
1045 				break;
1046 			default: /* to silence GCC warning */
1047 				return -EFAULT;
1048 			}
1049 			jmp_offset = addrs[i + insn->off] - addrs[i];
1050 			if (is_imm8(jmp_offset)) {
1051 				EMIT2(jmp_cond, jmp_offset);
1052 			} else if (is_simm32(jmp_offset)) {
1053 				EMIT2_off32(0x0F, jmp_cond + 0x10, jmp_offset);
1054 			} else {
1055 				pr_err("cond_jmp gen bug %llx\n", jmp_offset);
1056 				return -EFAULT;
1057 			}
1058 
1059 			break;
1060 
1061 		case BPF_JMP | BPF_JA:
1062 			if (insn->off == -1)
1063 				/* -1 jmp instructions will always jump
1064 				 * backwards two bytes. Explicitly handling
1065 				 * this case avoids wasting too many passes
1066 				 * when there are long sequences of replaced
1067 				 * dead code.
1068 				 */
1069 				jmp_offset = -2;
1070 			else
1071 				jmp_offset = addrs[i + insn->off] - addrs[i];
1072 
1073 			if (!jmp_offset)
1074 				/* Optimize out nop jumps */
1075 				break;
1076 emit_jmp:
1077 			if (is_imm8(jmp_offset)) {
1078 				EMIT2(0xEB, jmp_offset);
1079 			} else if (is_simm32(jmp_offset)) {
1080 				EMIT1_off32(0xE9, jmp_offset);
1081 			} else {
1082 				pr_err("jmp gen bug %llx\n", jmp_offset);
1083 				return -EFAULT;
1084 			}
1085 			break;
1086 
1087 		case BPF_JMP | BPF_EXIT:
1088 			if (seen_exit) {
1089 				jmp_offset = ctx->cleanup_addr - addrs[i];
1090 				goto emit_jmp;
1091 			}
1092 			seen_exit = true;
1093 			/* Update cleanup_addr */
1094 			ctx->cleanup_addr = proglen;
1095 			if (!bpf_prog_was_classic(bpf_prog))
1096 				EMIT1(0x5B); /* get rid of tail_call_cnt */
1097 			EMIT2(0x41, 0x5F);   /* pop r15 */
1098 			EMIT2(0x41, 0x5E);   /* pop r14 */
1099 			EMIT2(0x41, 0x5D);   /* pop r13 */
1100 			EMIT1(0x5B);         /* pop rbx */
1101 			EMIT1(0xC9);         /* leave */
1102 			EMIT1(0xC3);         /* ret */
1103 			break;
1104 
1105 		default:
1106 			/*
1107 			 * By design x86-64 JIT should support all BPF instructions.
1108 			 * This error will be seen if new instruction was added
1109 			 * to the interpreter, but not to the JIT, or if there is
1110 			 * junk in bpf_prog.
1111 			 */
1112 			pr_err("bpf_jit: unknown opcode %02x\n", insn->code);
1113 			return -EINVAL;
1114 		}
1115 
1116 		ilen = prog - temp;
1117 		if (ilen > BPF_MAX_INSN_SIZE) {
1118 			pr_err("bpf_jit: fatal insn size error\n");
1119 			return -EFAULT;
1120 		}
1121 
1122 		if (image) {
1123 			if (unlikely(proglen + ilen > oldproglen)) {
1124 				pr_err("bpf_jit: fatal error\n");
1125 				return -EFAULT;
1126 			}
1127 			memcpy(image + proglen, temp, ilen);
1128 		}
1129 		proglen += ilen;
1130 		addrs[i] = proglen;
1131 		prog = temp;
1132 	}
1133 
1134 	if (image && excnt != bpf_prog->aux->num_exentries) {
1135 		pr_err("extable is not populated\n");
1136 		return -EFAULT;
1137 	}
1138 	return proglen;
1139 }
1140 
1141 struct x64_jit_data {
1142 	struct bpf_binary_header *header;
1143 	int *addrs;
1144 	u8 *image;
1145 	int proglen;
1146 	struct jit_context ctx;
1147 };
1148 
1149 struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
1150 {
1151 	struct bpf_binary_header *header = NULL;
1152 	struct bpf_prog *tmp, *orig_prog = prog;
1153 	struct x64_jit_data *jit_data;
1154 	int proglen, oldproglen = 0;
1155 	struct jit_context ctx = {};
1156 	bool tmp_blinded = false;
1157 	bool extra_pass = false;
1158 	u8 *image = NULL;
1159 	int *addrs;
1160 	int pass;
1161 	int i;
1162 
1163 	if (!prog->jit_requested)
1164 		return orig_prog;
1165 
1166 	tmp = bpf_jit_blind_constants(prog);
1167 	/*
1168 	 * If blinding was requested and we failed during blinding,
1169 	 * we must fall back to the interpreter.
1170 	 */
1171 	if (IS_ERR(tmp))
1172 		return orig_prog;
1173 	if (tmp != prog) {
1174 		tmp_blinded = true;
1175 		prog = tmp;
1176 	}
1177 
1178 	jit_data = prog->aux->jit_data;
1179 	if (!jit_data) {
1180 		jit_data = kzalloc(sizeof(*jit_data), GFP_KERNEL);
1181 		if (!jit_data) {
1182 			prog = orig_prog;
1183 			goto out;
1184 		}
1185 		prog->aux->jit_data = jit_data;
1186 	}
1187 	addrs = jit_data->addrs;
1188 	if (addrs) {
1189 		ctx = jit_data->ctx;
1190 		oldproglen = jit_data->proglen;
1191 		image = jit_data->image;
1192 		header = jit_data->header;
1193 		extra_pass = true;
1194 		goto skip_init_addrs;
1195 	}
1196 	addrs = kmalloc_array(prog->len + 1, sizeof(*addrs), GFP_KERNEL);
1197 	if (!addrs) {
1198 		prog = orig_prog;
1199 		goto out_addrs;
1200 	}
1201 
1202 	/*
1203 	 * Before first pass, make a rough estimation of addrs[]
1204 	 * each BPF instruction is translated to less than 64 bytes
1205 	 */
1206 	for (proglen = 0, i = 0; i <= prog->len; i++) {
1207 		proglen += 64;
1208 		addrs[i] = proglen;
1209 	}
1210 	ctx.cleanup_addr = proglen;
1211 skip_init_addrs:
1212 
1213 	/*
1214 	 * JITed image shrinks with every pass and the loop iterates
1215 	 * until the image stops shrinking. Very large BPF programs
1216 	 * may converge on the last pass. In such case do one more
1217 	 * pass to emit the final image.
1218 	 */
1219 	for (pass = 0; pass < 20 || image; pass++) {
1220 		proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
1221 		if (proglen <= 0) {
1222 out_image:
1223 			image = NULL;
1224 			if (header)
1225 				bpf_jit_binary_free(header);
1226 			prog = orig_prog;
1227 			goto out_addrs;
1228 		}
1229 		if (image) {
1230 			if (proglen != oldproglen) {
1231 				pr_err("bpf_jit: proglen=%d != oldproglen=%d\n",
1232 				       proglen, oldproglen);
1233 				goto out_image;
1234 			}
1235 			break;
1236 		}
1237 		if (proglen == oldproglen) {
1238 			/*
1239 			 * The number of entries in extable is the number of BPF_LDX
1240 			 * insns that access kernel memory via "pointer to BTF type".
1241 			 * The verifier changed their opcode from LDX|MEM|size
1242 			 * to LDX|PROBE_MEM|size to make JITing easier.
1243 			 */
1244 			u32 align = __alignof__(struct exception_table_entry);
1245 			u32 extable_size = prog->aux->num_exentries *
1246 				sizeof(struct exception_table_entry);
1247 
1248 			/* allocate module memory for x86 insns and extable */
1249 			header = bpf_jit_binary_alloc(roundup(proglen, align) + extable_size,
1250 						      &image, align, jit_fill_hole);
1251 			if (!header) {
1252 				prog = orig_prog;
1253 				goto out_addrs;
1254 			}
1255 			prog->aux->extable = (void *) image + roundup(proglen, align);
1256 		}
1257 		oldproglen = proglen;
1258 		cond_resched();
1259 	}
1260 
1261 	if (bpf_jit_enable > 1)
1262 		bpf_jit_dump(prog->len, proglen, pass + 1, image);
1263 
1264 	if (image) {
1265 		if (!prog->is_func || extra_pass) {
1266 			bpf_jit_binary_lock_ro(header);
1267 		} else {
1268 			jit_data->addrs = addrs;
1269 			jit_data->ctx = ctx;
1270 			jit_data->proglen = proglen;
1271 			jit_data->image = image;
1272 			jit_data->header = header;
1273 		}
1274 		prog->bpf_func = (void *)image;
1275 		prog->jited = 1;
1276 		prog->jited_len = proglen;
1277 	} else {
1278 		prog = orig_prog;
1279 	}
1280 
1281 	if (!image || !prog->is_func || extra_pass) {
1282 		if (image)
1283 			bpf_prog_fill_jited_linfo(prog, addrs + 1);
1284 out_addrs:
1285 		kfree(addrs);
1286 		kfree(jit_data);
1287 		prog->aux->jit_data = NULL;
1288 	}
1289 out:
1290 	if (tmp_blinded)
1291 		bpf_jit_prog_release_other(prog, prog == orig_prog ?
1292 					   tmp : orig_prog);
1293 	return prog;
1294 }
1295