1 #include <linux/moduleloader.h>
2 #include <linux/workqueue.h>
3 #include <linux/netdevice.h>
4 #include <linux/filter.h>
5 #include <linux/cache.h>
6 #include <linux/if_vlan.h>
8 #include <asm/cacheflush.h>
9 #include <asm/ptrace.h>
13 int bpf_jit_enable __read_mostly;
15 static inline bool is_simm13(unsigned int value)
17 return value + 0x1000 < 0x2000;
20 static void bpf_flush_icache(void *start_, void *end_)
23 /* Cheetah's I-cache is fully coherent. */
24 if (tlb_type == spitfire) {
25 unsigned long start = (unsigned long) start_;
26 unsigned long end = (unsigned long) end_;
29 end = (end + 7UL) & ~7UL;
38 #define SEEN_DATAREF 1 /* might call external helpers */
39 #define SEEN_XREG 2 /* ebx is used */
40 #define SEEN_MEM 4 /* use mem[] for temporary storage */
42 #define S13(X) ((X) & 0x1fff)
43 #define IMMED 0x00002000
44 #define RD(X) ((X) << 25)
45 #define RS1(X) ((X) << 14)
47 #define OP(X) ((X) << 30)
48 #define OP2(X) ((X) << 22)
49 #define OP3(X) ((X) << 19)
50 #define COND(X) ((X) << 25)
52 #define F2(X, Y) (OP(X) | OP2(Y))
53 #define F3(X, Y) (OP(X) | OP3(Y))
55 #define CONDN COND(0x0)
56 #define CONDE COND(0x1)
57 #define CONDLE COND(0x2)
58 #define CONDL COND(0x3)
59 #define CONDLEU COND(0x4)
60 #define CONDCS COND(0x5)
61 #define CONDNEG COND(0x6)
62 #define CONDVC COND(0x7)
63 #define CONDA COND(0x8)
64 #define CONDNE COND(0x9)
65 #define CONDG COND(0xa)
66 #define CONDGE COND(0xb)
67 #define CONDGU COND(0xc)
68 #define CONDCC COND(0xd)
69 #define CONDPOS COND(0xe)
70 #define CONDVS COND(0xf)
72 #define CONDGEU CONDCC
75 #define WDISP22(X) (((X) >> 2) & 0x3fffff)
77 #define BA (F2(0, 2) | CONDA)
78 #define BGU (F2(0, 2) | CONDGU)
79 #define BLEU (F2(0, 2) | CONDLEU)
80 #define BGEU (F2(0, 2) | CONDGEU)
81 #define BLU (F2(0, 2) | CONDLU)
82 #define BE (F2(0, 2) | CONDE)
83 #define BNE (F2(0, 2) | CONDNE)
86 #define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20))
91 #define SETHI(K, REG) \
92 (F2(0, 0x4) | RD(REG) | (((K) >> 10) & 0x3fffff))
93 #define OR_LO(K, REG) \
94 (F3(2, 0x02) | IMMED | RS1(REG) | ((K) & 0x3ff) | RD(REG))
96 #define ADD F3(2, 0x00)
97 #define AND F3(2, 0x01)
98 #define ANDCC F3(2, 0x11)
99 #define OR F3(2, 0x02)
100 #define XOR F3(2, 0x03)
101 #define SUB F3(2, 0x04)
102 #define SUBCC F3(2, 0x14)
103 #define MUL F3(2, 0x0a) /* umul */
104 #define DIV F3(2, 0x0e) /* udiv */
105 #define SLL F3(2, 0x25)
106 #define SRL F3(2, 0x26)
107 #define JMPL F3(2, 0x38)
109 #define BR F2(0, 0x01)
110 #define RD_Y F3(2, 0x28)
111 #define WR_Y F3(2, 0x30)
113 #define LD32 F3(3, 0x00)
114 #define LD8 F3(3, 0x01)
115 #define LD16 F3(3, 0x02)
116 #define LD64 F3(3, 0x0b)
117 #define ST32 F3(3, 0x04)
119 #ifdef CONFIG_SPARC64
121 #define BASE_STACKFRAME 176
124 #define BASE_STACKFRAME 96
127 #define LD32I (LD32 | IMMED)
128 #define LD8I (LD8 | IMMED)
129 #define LD16I (LD16 | IMMED)
130 #define LD64I (LD64 | IMMED)
131 #define LDPTRI (LDPTR | IMMED)
132 #define ST32I (ST32 | IMMED)
136 *prog++ = SETHI(0, G0); \
140 do { /* sub %g0, r_A, r_A */ \
141 *prog++ = SUB | RS1(G0) | RS2(r_A) | RD(r_A); \
144 #define emit_reg_move(FROM, TO) \
145 do { /* or %g0, FROM, TO */ \
146 *prog++ = OR | RS1(G0) | RS2(FROM) | RD(TO); \
149 #define emit_clear(REG) \
150 do { /* or %g0, %g0, REG */ \
151 *prog++ = OR | RS1(G0) | RS2(G0) | RD(REG); \
154 #define emit_set_const(K, REG) \
155 do { /* sethi %hi(K), REG */ \
156 *prog++ = SETHI(K, REG); \
157 /* or REG, %lo(K), REG */ \
158 *prog++ = OR_LO(K, REG); \
165 #define emit_alu_X(OPCODE) \
168 *prog++ = OPCODE | RS1(r_A) | RS2(r_X) | RD(r_A); \
177 * sethi %hi(K), r_TMP
178 * or r_TMP, %lo(K), r_TMP
181 * depending upon whether K fits in a signed 13-bit
182 * immediate instruction field. Emit nothing if K
185 #define emit_alu_K(OPCODE, K) \
188 unsigned int _insn = OPCODE; \
189 _insn |= RS1(r_A) | RD(r_A); \
190 if (is_simm13(K)) { \
191 *prog++ = _insn | IMMED | S13(K); \
193 emit_set_const(K, r_TMP); \
194 *prog++ = _insn | RS2(r_TMP); \
199 #define emit_loadimm(K, DEST) \
201 if (is_simm13(K)) { \
202 /* or %g0, K, DEST */ \
203 *prog++ = OR | IMMED | RS1(G0) | S13(K) | RD(DEST); \
205 emit_set_const(K, DEST); \
209 #define emit_loadptr(BASE, STRUCT, FIELD, DEST) \
210 do { unsigned int _off = offsetof(STRUCT, FIELD); \
211 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(void *)); \
212 *prog++ = LDPTRI | RS1(BASE) | S13(_off) | RD(DEST); \
215 #define emit_load32(BASE, STRUCT, FIELD, DEST) \
216 do { unsigned int _off = offsetof(STRUCT, FIELD); \
217 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u32)); \
218 *prog++ = LD32I | RS1(BASE) | S13(_off) | RD(DEST); \
221 #define emit_load16(BASE, STRUCT, FIELD, DEST) \
222 do { unsigned int _off = offsetof(STRUCT, FIELD); \
223 BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u16)); \
224 *prog++ = LD16I | RS1(BASE) | S13(_off) | RD(DEST); \
227 #define __emit_load8(BASE, STRUCT, FIELD, DEST) \
228 do { unsigned int _off = offsetof(STRUCT, FIELD); \
229 *prog++ = LD8I | RS1(BASE) | S13(_off) | RD(DEST); \
232 #define emit_load8(BASE, STRUCT, FIELD, DEST) \
233 do { BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u8)); \
234 __emit_load8(BASE, STRUCT, FIELD, DEST); \
237 #define emit_ldmem(OFF, DEST) \
238 do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(DEST); \
241 #define emit_stmem(OFF, SRC) \
242 do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(SRC); \
246 #ifdef CONFIG_SPARC64
247 #define emit_load_cpu(REG) \
248 emit_load16(G6, struct thread_info, cpu, REG)
250 #define emit_load_cpu(REG) \
251 emit_load32(G6, struct thread_info, cpu, REG)
254 #define emit_load_cpu(REG) emit_clear(REG)
257 #define emit_skb_loadptr(FIELD, DEST) \
258 emit_loadptr(r_SKB, struct sk_buff, FIELD, DEST)
259 #define emit_skb_load32(FIELD, DEST) \
260 emit_load32(r_SKB, struct sk_buff, FIELD, DEST)
261 #define emit_skb_load16(FIELD, DEST) \
262 emit_load16(r_SKB, struct sk_buff, FIELD, DEST)
263 #define __emit_skb_load8(FIELD, DEST) \
264 __emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
265 #define emit_skb_load8(FIELD, DEST) \
266 emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
268 #define emit_jmpl(BASE, IMM_OFF, LREG) \
269 *prog++ = (JMPL | IMMED | RS1(BASE) | S13(IMM_OFF) | RD(LREG))
271 #define emit_call(FUNC) \
272 do { void *_here = image + addrs[i] - 8; \
273 unsigned int _off = (void *)(FUNC) - _here; \
274 *prog++ = CALL | (((_off) >> 2) & 0x3fffffff); \
278 #define emit_branch(BR_OPC, DEST) \
279 do { unsigned int _here = addrs[i] - 8; \
280 *prog++ = BR_OPC | WDISP22((DEST) - _here); \
283 #define emit_branch_off(BR_OPC, OFF) \
284 do { *prog++ = BR_OPC | WDISP22(OFF); \
287 #define emit_jump(DEST) emit_branch(BA, DEST)
289 #define emit_read_y(REG) *prog++ = RD_Y | RD(REG)
290 #define emit_write_y(REG) *prog++ = WR_Y | IMMED | RS1(REG) | S13(0)
292 #define emit_cmp(R1, R2) \
293 *prog++ = (SUBCC | RS1(R1) | RS2(R2) | RD(G0))
295 #define emit_cmpi(R1, IMM) \
296 *prog++ = (SUBCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
298 #define emit_btst(R1, R2) \
299 *prog++ = (ANDCC | RS1(R1) | RS2(R2) | RD(G0))
301 #define emit_btsti(R1, IMM) \
302 *prog++ = (ANDCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
304 #define emit_sub(R1, R2, R3) \
305 *prog++ = (SUB | RS1(R1) | RS2(R2) | RD(R3))
307 #define emit_subi(R1, IMM, R3) \
308 *prog++ = (SUB | IMMED | RS1(R1) | S13(IMM) | RD(R3))
310 #define emit_add(R1, R2, R3) \
311 *prog++ = (ADD | RS1(R1) | RS2(R2) | RD(R3))
313 #define emit_addi(R1, IMM, R3) \
314 *prog++ = (ADD | IMMED | RS1(R1) | S13(IMM) | RD(R3))
316 #define emit_and(R1, R2, R3) \
317 *prog++ = (AND | RS1(R1) | RS2(R2) | RD(R3))
319 #define emit_andi(R1, IMM, R3) \
320 *prog++ = (AND | IMMED | RS1(R1) | S13(IMM) | RD(R3))
322 #define emit_alloc_stack(SZ) \
323 *prog++ = (SUB | IMMED | RS1(SP) | S13(SZ) | RD(SP))
325 #define emit_release_stack(SZ) \
326 *prog++ = (ADD | IMMED | RS1(SP) | S13(SZ) | RD(SP))
328 /* A note about branch offset calculations. The addrs[] array,
329 * indexed by BPF instruction, records the address after all the
330 * sparc instructions emitted for that BPF instruction.
332 * The most common case is to emit a branch at the end of such
333 * a code sequence. So this would be two instructions, the
334 * branch and it's delay slot.
336 * Therefore by default the branch emitters calculate the branch
339 * destination - (addrs[i] - 8)
341 * This "addrs[i] - 8" is the address of the branch itself or
342 * what "." would be in assembler notation. The "8" part is
343 * how we take into consideration the branch and it's delay
344 * slot mentioned above.
346 * Sometimes we need to emit a branch earlier in the code
347 * sequence. And in these situations we adjust "destination"
348 * to accomodate this difference. For example, if we needed
349 * to emit a branch (and it's delay slot) right before the
350 * final instruction emitted for a BPF opcode, we'd use
351 * "destination + 4" instead of just plain "destination" above.
353 * This is why you see all of these funny emit_branch() and
354 * emit_jump() calls with adjusted offsets.
357 void bpf_jit_compile(struct sk_filter *fp)
359 unsigned int cleanup_addr, proglen, oldproglen = 0;
360 u32 temp[8], *prog, *func, seen = 0, pass;
361 const struct sock_filter *filter = fp->insns;
362 int i, flen = fp->len, pc_ret0 = -1;
369 addrs = kmalloc(flen * sizeof(*addrs), GFP_KERNEL);
373 /* Before first pass, make a rough estimation of addrs[]
374 * each bpf instruction is translated to less than 64 bytes
376 for (proglen = 0, i = 0; i < flen; i++) {
380 cleanup_addr = proglen; /* epilogue address */
382 for (pass = 0; pass < 10; pass++) {
383 u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
385 /* no prologue/epilogue for trivial filters (RET something) */
391 if (seen_or_pass0 & SEEN_MEM) {
392 unsigned int sz = BASE_STACKFRAME;
393 sz += BPF_MEMWORDS * sizeof(u32);
394 emit_alloc_stack(sz);
397 /* Make sure we dont leek kernel memory. */
398 if (seen_or_pass0 & SEEN_XREG)
401 /* If this filter needs to access skb data,
402 * load %o4 and %o5 with:
403 * %o4 = skb->len - skb->data_len
405 * And also back up %o7 into r_saved_O7 so we can
406 * invoke the stubs using 'call'.
408 if (seen_or_pass0 & SEEN_DATAREF) {
409 emit_load32(r_SKB, struct sk_buff, len, r_HEADLEN);
410 emit_load32(r_SKB, struct sk_buff, data_len, r_TMP);
411 emit_sub(r_HEADLEN, r_TMP, r_HEADLEN);
412 emit_loadptr(r_SKB, struct sk_buff, data, r_SKB_DATA);
415 emit_reg_move(O7, r_saved_O7);
417 switch (filter[0].code) {
420 case BPF_S_ANC_PROTOCOL:
421 case BPF_S_ANC_PKTTYPE:
422 case BPF_S_ANC_IFINDEX:
424 case BPF_S_ANC_RXHASH:
425 case BPF_S_ANC_VLAN_TAG:
426 case BPF_S_ANC_VLAN_TAG_PRESENT:
428 case BPF_S_ANC_QUEUE:
432 /* The first instruction sets the A register (or is
433 * a "RET 'constant'")
437 /* Make sure we dont leak kernel information to the
440 emit_clear(r_A); /* A = 0 */
443 for (i = 0; i < flen; i++) {
444 unsigned int K = filter[i].k;
445 unsigned int t_offset;
446 unsigned int f_offset;
450 switch (filter[i].code) {
451 case BPF_S_ALU_ADD_X: /* A += X; */
454 case BPF_S_ALU_ADD_K: /* A += K; */
457 case BPF_S_ALU_SUB_X: /* A -= X; */
460 case BPF_S_ALU_SUB_K: /* A -= K */
463 case BPF_S_ALU_AND_X: /* A &= X */
466 case BPF_S_ALU_AND_K: /* A &= K */
469 case BPF_S_ALU_OR_X: /* A |= X */
472 case BPF_S_ALU_OR_K: /* A |= K */
475 case BPF_S_ANC_ALU_XOR_X: /* A ^= X; */
476 case BPF_S_ALU_XOR_X:
479 case BPF_S_ALU_XOR_K: /* A ^= K */
482 case BPF_S_ALU_LSH_X: /* A <<= X */
485 case BPF_S_ALU_LSH_K: /* A <<= K */
488 case BPF_S_ALU_RSH_X: /* A >>= X */
491 case BPF_S_ALU_RSH_K: /* A >>= K */
494 case BPF_S_ALU_MUL_X: /* A *= X; */
497 case BPF_S_ALU_MUL_K: /* A *= K */
500 case BPF_S_ALU_DIV_K: /* A /= K */
504 case BPF_S_ALU_DIV_X: /* A /= X; */
507 t_offset = addrs[pc_ret0 - 1];
508 #ifdef CONFIG_SPARC32
509 emit_branch(BE, t_offset + 20);
511 emit_branch(BE, t_offset + 8);
513 emit_nop(); /* delay slot */
515 emit_branch_off(BNE, 16);
517 #ifdef CONFIG_SPARC32
518 emit_jump(cleanup_addr + 20);
520 emit_jump(cleanup_addr + 8);
525 #ifdef CONFIG_SPARC32
526 /* The Sparc v8 architecture requires
527 * three instructions between a %y
528 * register write and the first use.
545 emit_loadimm(K, r_A);
551 emit_jump(cleanup_addr);
555 if (seen_or_pass0 & SEEN_MEM) {
556 unsigned int sz = BASE_STACKFRAME;
557 sz += BPF_MEMWORDS * sizeof(u32);
558 emit_release_stack(sz);
561 /* jmpl %r_saved_O7 + 8, %g0 */
562 emit_jmpl(r_saved_O7, 8, G0);
563 emit_reg_move(r_A, O0); /* delay slot */
567 emit_reg_move(r_A, r_X);
571 emit_reg_move(r_X, r_A);
576 case BPF_S_ANC_PROTOCOL:
577 emit_skb_load16(protocol, r_A);
580 /* GCC won't let us take the address of
581 * a bit field even though we very much
582 * know what we are doing here.
584 case BPF_S_ANC_PKTTYPE:
585 __emit_skb_load8(pkt_type, r_A);
589 case BPF_S_ANC_IFINDEX:
590 emit_skb_loadptr(dev, r_A);
592 emit_branch(BNE_PTR, cleanup_addr + 4);
594 emit_load32(r_A, struct net_device, ifindex, r_A);
597 emit_skb_load32(mark, r_A);
599 case BPF_S_ANC_QUEUE:
600 emit_skb_load16(queue_mapping, r_A);
602 case BPF_S_ANC_HATYPE:
603 emit_skb_loadptr(dev, r_A);
605 emit_branch(BNE_PTR, cleanup_addr + 4);
607 emit_load16(r_A, struct net_device, type, r_A);
609 case BPF_S_ANC_RXHASH:
610 emit_skb_load32(rxhash, r_A);
612 case BPF_S_ANC_VLAN_TAG:
613 case BPF_S_ANC_VLAN_TAG_PRESENT:
614 emit_skb_load16(vlan_tci, r_A);
615 if (filter[i].code == BPF_S_ANC_VLAN_TAG) {
616 emit_andi(r_A, VLAN_VID_MASK, r_A);
618 emit_loadimm(VLAN_TAG_PRESENT, r_TMP);
619 emit_and(r_A, r_TMP, r_A);
624 emit_loadimm(K, r_A);
627 emit_loadimm(K, r_X);
630 emit_ldmem(K * 4, r_A);
633 emit_ldmem(K * 4, r_X);
636 emit_stmem(K * 4, r_A);
639 emit_stmem(K * 4, r_X);
642 #define CHOOSE_LOAD_FUNC(K, func) \
643 ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
646 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_word);
647 common_load: seen |= SEEN_DATAREF;
648 emit_loadimm(K, r_OFF);
652 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_half);
655 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte);
657 case BPF_S_LDX_B_MSH:
658 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte_msh);
661 func = bpf_jit_load_word;
662 common_load_ind: seen |= SEEN_DATAREF | SEEN_XREG;
665 emit_addi(r_X, K, r_OFF);
667 emit_loadimm(K, r_TMP);
668 emit_add(r_X, r_TMP, r_OFF);
671 emit_reg_move(r_X, r_OFF);
676 func = bpf_jit_load_half;
677 goto common_load_ind;
679 func = bpf_jit_load_byte;
680 goto common_load_ind;
682 emit_jump(addrs[i + K]);
686 #define COND_SEL(CODE, TOP, FOP) \
692 COND_SEL(BPF_S_JMP_JGT_K, BGU, BLEU);
693 COND_SEL(BPF_S_JMP_JGE_K, BGEU, BLU);
694 COND_SEL(BPF_S_JMP_JEQ_K, BE, BNE);
695 COND_SEL(BPF_S_JMP_JSET_K, BNE, BE);
696 COND_SEL(BPF_S_JMP_JGT_X, BGU, BLEU);
697 COND_SEL(BPF_S_JMP_JGE_X, BGEU, BLU);
698 COND_SEL(BPF_S_JMP_JEQ_X, BE, BNE);
699 COND_SEL(BPF_S_JMP_JSET_X, BNE, BE);
701 cond_branch: f_offset = addrs[i + filter[i].jf];
702 t_offset = addrs[i + filter[i].jt];
704 /* same targets, can avoid doing the test :) */
705 if (filter[i].jt == filter[i].jf) {
711 switch (filter[i].code) {
712 case BPF_S_JMP_JGT_X:
713 case BPF_S_JMP_JGE_X:
714 case BPF_S_JMP_JEQ_X:
718 case BPF_S_JMP_JSET_X:
722 case BPF_S_JMP_JEQ_K:
723 case BPF_S_JMP_JGT_K:
724 case BPF_S_JMP_JGE_K:
728 emit_loadimm(K, r_TMP);
729 emit_cmp(r_A, r_TMP);
732 case BPF_S_JMP_JSET_K:
736 emit_loadimm(K, r_TMP);
737 emit_btst(r_A, r_TMP);
741 if (filter[i].jt != 0) {
744 emit_branch(t_op, t_offset);
745 emit_nop(); /* delay slot */
752 emit_branch(f_op, f_offset);
753 emit_nop(); /* delay slot */
757 /* hmm, too complex filter, give up with jit compiler */
760 ilen = (void *) prog - (void *) temp;
762 if (unlikely(proglen + ilen > oldproglen)) {
763 pr_err("bpb_jit_compile fatal error\n");
765 module_free(NULL, image);
768 memcpy(image + proglen, temp, ilen);
774 /* last bpf instruction is always a RET :
775 * use it to give the cleanup instruction(s) addr
777 cleanup_addr = proglen - 8; /* jmpl; mov r_A,%o0; */
778 if (seen_or_pass0 & SEEN_MEM)
779 cleanup_addr -= 4; /* add %sp, X, %sp; */
782 if (proglen != oldproglen)
783 pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n",
784 proglen, oldproglen);
787 if (proglen == oldproglen) {
788 image = module_alloc(max_t(unsigned int,
790 sizeof(struct work_struct)));
794 oldproglen = proglen;
797 if (bpf_jit_enable > 1)
798 pr_err("flen=%d proglen=%u pass=%d image=%p\n",
799 flen, proglen, pass, image);
802 if (bpf_jit_enable > 1)
803 print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_ADDRESS,
804 16, 1, image, proglen, false);
805 bpf_flush_icache(image, image + proglen);
806 fp->bpf_func = (void *)image;
813 static void jit_free_defer(struct work_struct *arg)
815 module_free(NULL, arg);
818 /* run from softirq, we must use a work_struct to call
819 * module_free() from process context
821 void bpf_jit_free(struct sk_filter *fp)
823 if (fp->bpf_func != sk_run_filter) {
824 struct work_struct *work = (struct work_struct *)fp->bpf_func;
826 INIT_WORK(work, jit_free_defer);