arch/sparc/net/bpf_jit_comp.c

   1 #include <linux/moduleloader.h>
   2 #include <linux/workqueue.h>
   3 #include <linux/netdevice.h>
   4 #include <linux/filter.h>
   5 #include <linux/cache.h>
   6
   7 #include <asm/cacheflush.h>
   8 #include <asm/ptrace.h>
   9
  10 #include "bpf_jit.h"
  11
  12 int bpf_jit_enable __read_mostly;
  13
  14 static inline bool is_simm13(unsigned int value)
  15 {
  16         return value + 0x1000 < 0x2000;
  17 }
  18
  19 static void bpf_flush_icache(void *start_, void *end_)
  20 {
  21 #ifdef CONFIG_SPARC64
  22         /* Cheetah's I-cache is fully coherent.  */
  23         if (tlb_type == spitfire) {
  24                 unsigned long start = (unsigned long) start_;
  25                 unsigned long end = (unsigned long) end_;
  26
  27                 start &= ~7UL;
  28                 end = (end + 7UL) & ~7UL;
  29                 while (start < end) {
  30                         flushi(start);
  31                         start += 32;
  32                 }
  33         }
  34 #endif
  35 }
  36
  37 #define SEEN_DATAREF 1 /* might call external helpers */
  38 #define SEEN_XREG    2 /* ebx is used */
  39 #define SEEN_MEM     4 /* use mem[] for temporary storage */
  40
  41 #define S13(X)          ((X) & 0x1fff)
  42 #define IMMED           0x00002000
  43 #define RD(X)           ((X) << 25)
  44 #define RS1(X)          ((X) << 14)
  45 #define RS2(X)          ((X))
  46 #define OP(X)           ((X) << 30)
  47 #define OP2(X)          ((X) << 22)
  48 #define OP3(X)          ((X) << 19)
  49 #define COND(X)         ((X) << 25)
  50 #define F1(X)           OP(X)
  51 #define F2(X, Y)        (OP(X) | OP2(Y))
  52 #define F3(X, Y)        (OP(X) | OP3(Y))
  53
  54 #define CONDN           COND(0x0)
  55 #define CONDE           COND(0x1)
  56 #define CONDLE          COND(0x2)
  57 #define CONDL           COND(0x3)
  58 #define CONDLEU         COND(0x4)
  59 #define CONDCS          COND(0x5)
  60 #define CONDNEG         COND(0x6)
  61 #define CONDVC          COND(0x7)
  62 #define CONDA           COND(0x8)
  63 #define CONDNE          COND(0x9)
  64 #define CONDG           COND(0xa)
  65 #define CONDGE          COND(0xb)
  66 #define CONDGU          COND(0xc)
  67 #define CONDCC          COND(0xd)
  68 #define CONDPOS         COND(0xe)
  69 #define CONDVS          COND(0xf)
  70
  71 #define CONDGEU         CONDCC
  72 #define CONDLU          CONDCS
  73
  74 #define WDISP22(X)      (((X) >> 2) & 0x3fffff)
  75
  76 #define BA              (F2(0, 2) | CONDA)
  77 #define BGU             (F2(0, 2) | CONDGU)
  78 #define BLEU            (F2(0, 2) | CONDLEU)
  79 #define BGEU            (F2(0, 2) | CONDGEU)
  80 #define BLU             (F2(0, 2) | CONDLU)
  81 #define BE              (F2(0, 2) | CONDE)
  82 #define BNE             (F2(0, 2) | CONDNE)
  83
  84 #ifdef CONFIG_SPARC64
  85 #define BNE_PTR         (F2(0, 1) | CONDNE | (2 << 20))
  86 #else
  87 #define BNE_PTR         BNE
  88 #endif
  89
  90 #define SETHI(K, REG)   \
  91         (F2(0, 0x4) | RD(REG) | (((K) >> 10) & 0x3fffff))
  92 #define OR_LO(K, REG)   \
  93         (F3(2, 0x02) | IMMED | RS1(REG) | ((K) & 0x3ff) | RD(REG))
  94
  95 #define ADD             F3(2, 0x00)
  96 #define AND             F3(2, 0x01)
  97 #define ANDCC           F3(2, 0x11)
  98 #define OR              F3(2, 0x02)
  99 #define XOR             F3(2, 0x03)
 100 #define SUB             F3(2, 0x04)
 101 #define SUBCC           F3(2, 0x14)
 102 #define MUL             F3(2, 0x0a)     /* umul */
 103 #define DIV             F3(2, 0x0e)     /* udiv */
 104 #define SLL             F3(2, 0x25)
 105 #define SRL             F3(2, 0x26)
 106 #define JMPL            F3(2, 0x38)
 107 #define CALL            F1(1)
 108 #define BR              F2(0, 0x01)
 109 #define RD_Y            F3(2, 0x28)
 110 #define WR_Y            F3(2, 0x30)
 111
 112 #define LD32            F3(3, 0x00)
 113 #define LD8             F3(3, 0x01)
 114 #define LD16            F3(3, 0x02)
 115 #define LD64            F3(3, 0x0b)
 116 #define ST32            F3(3, 0x04)
 117
 118 #ifdef CONFIG_SPARC64
 119 #define LDPTR           LD64
 120 #define BASE_STACKFRAME 176
 121 #else
 122 #define LDPTR           LD32
 123 #define BASE_STACKFRAME 96
 124 #endif
 125
 126 #define LD32I           (LD32 | IMMED)
 127 #define LD8I            (LD8 | IMMED)
 128 #define LD16I           (LD16 | IMMED)
 129 #define LD64I           (LD64 | IMMED)
 130 #define LDPTRI          (LDPTR | IMMED)
 131 #define ST32I           (ST32 | IMMED)
 132
 133 #define emit_nop()              \
 134 do {                            \
 135         *prog++ = SETHI(0, G0); \
 136 } while (0)
 137
 138 #define emit_neg()                                      \
 139 do {    /* sub %g0, r_A, r_A */                         \
 140         *prog++ = SUB | RS1(G0) | RS2(r_A) | RD(r_A);   \
 141 } while (0)
 142
 143 #define emit_reg_move(FROM, TO)                         \
 144 do {    /* or %g0, FROM, TO */                          \
 145         *prog++ = OR | RS1(G0) | RS2(FROM) | RD(TO);    \
 146 } while (0)
 147
 148 #define emit_clear(REG)                                 \
 149 do {    /* or %g0, %g0, REG */                          \
 150         *prog++ = OR | RS1(G0) | RS2(G0) | RD(REG);     \
 151 } while (0)
 152
 153 #define emit_set_const(K, REG)                                  \
 154 do {    /* sethi %hi(K), REG */                                 \
 155         *prog++ = SETHI(K, REG);                                \
 156         /* or REG, %lo(K), REG */                               \
 157         *prog++ = OR_LO(K, REG);                                \
 158 } while (0)
 159
 160         /* Emit
 161          *
 162          *      OP      r_A, r_X, r_A
 163          */
 164 #define emit_alu_X(OPCODE)                                      \
 165 do {                                                            \
 166         seen |= SEEN_XREG;                                      \
 167         *prog++ = OPCODE | RS1(r_A) | RS2(r_X) | RD(r_A);       \
 168 } while (0)
 169
 170         /* Emit either:
 171          *
 172          *      OP      r_A, K, r_A
 173          *
 174          * or
 175          *
 176          *      sethi   %hi(K), r_TMP
 177          *      or      r_TMP, %lo(K), r_TMP
 178          *      OP      r_A, r_TMP, r_A
 179          *
 180          * depending upon whether K fits in a signed 13-bit
 181          * immediate instruction field.  Emit nothing if K
 182          * is zero.
 183          */
 184 #define emit_alu_K(OPCODE, K)                                   \
 185 do {                                                            \
 186         if (K) {                                                \
 187                 unsigned int _insn = OPCODE;                    \
 188                 _insn |= RS1(r_A) | RD(r_A);                    \
 189                 if (is_simm13(K)) {                             \
 190                         *prog++ = _insn | IMMED | S13(K);       \
 191                 } else {                                        \
 192                         emit_set_const(K, r_TMP);               \
 193                         *prog++ = _insn | RS2(r_TMP);           \
 194                 }                                               \
 195         }                                                       \
 196 } while (0)
 197
 198 #define emit_loadimm(K, DEST)                                           \
 199 do {                                                                    \
 200         if (is_simm13(K)) {                                             \
 201                 /* or %g0, K, DEST */                                   \
 202                 *prog++ = OR | IMMED | RS1(G0) | S13(K) | RD(DEST);     \
 203         } else {                                                        \
 204                 emit_set_const(K, DEST);                                \
 205         }                                                               \
 206 } while (0)
 207
 208 #define emit_loadptr(BASE, STRUCT, FIELD, DEST)                         \
 209 do {    unsigned int _off = offsetof(STRUCT, FIELD);                    \
 210         BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(void *));    \
 211         *prog++ = LDPTRI | RS1(BASE) | S13(_off) | RD(DEST);            \
 212 } while (0)
 213
 214 #define emit_load32(BASE, STRUCT, FIELD, DEST)                          \
 215 do {    unsigned int _off = offsetof(STRUCT, FIELD);                    \
 216         BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u32));       \
 217         *prog++ = LD32I | RS1(BASE) | S13(_off) | RD(DEST);             \
 218 } while (0)
 219
 220 #define emit_load16(BASE, STRUCT, FIELD, DEST)                          \
 221 do {    unsigned int _off = offsetof(STRUCT, FIELD);                    \
 222         BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u16));       \
 223         *prog++ = LD16I | RS1(BASE) | S13(_off) | RD(DEST);             \
 224 } while (0)
 225
 226 #define __emit_load8(BASE, STRUCT, FIELD, DEST)                         \
 227 do {    unsigned int _off = offsetof(STRUCT, FIELD);                    \
 228         *prog++ = LD8I | RS1(BASE) | S13(_off) | RD(DEST);              \
 229 } while (0)
 230
 231 #define emit_load8(BASE, STRUCT, FIELD, DEST)                           \
 232 do {    BUILD_BUG_ON(FIELD_SIZEOF(STRUCT, FIELD) != sizeof(u8));        \
 233         __emit_load8(BASE, STRUCT, FIELD, DEST);                        \
 234 } while (0)
 235
 236 #define emit_ldmem(OFF, DEST)                                   \
 237 do {    *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(DEST);     \
 238 } while (0)
 239
 240 #define emit_stmem(OFF, SRC)                                    \
 241 do {    *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(SRC);      \
 242 } while (0)
 243
 244 #ifdef CONFIG_SMP
 245 #ifdef CONFIG_SPARC64
 246 #define emit_load_cpu(REG)                                              \
 247         emit_load16(G6, struct thread_info, cpu, REG)
 248 #else
 249 #define emit_load_cpu(REG)                                              \
 250         emit_load32(G6, struct thread_info, cpu, REG)
 251 #endif
 252 #else
 253 #define emit_load_cpu(REG)      emit_clear(REG)
 254 #endif
 255
 256 #define emit_skb_loadptr(FIELD, DEST) \
 257         emit_loadptr(r_SKB, struct sk_buff, FIELD, DEST)
 258 #define emit_skb_load32(FIELD, DEST) \
 259         emit_load32(r_SKB, struct sk_buff, FIELD, DEST)
 260 #define emit_skb_load16(FIELD, DEST) \
 261         emit_load16(r_SKB, struct sk_buff, FIELD, DEST)
 262 #define __emit_skb_load8(FIELD, DEST) \
 263         __emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
 264 #define emit_skb_load8(FIELD, DEST) \
 265         emit_load8(r_SKB, struct sk_buff, FIELD, DEST)
 266
 267 #define emit_jmpl(BASE, IMM_OFF, LREG) \
 268         *prog++ = (JMPL | IMMED | RS1(BASE) | S13(IMM_OFF) | RD(LREG))
 269
 270 #define emit_call(FUNC)                                 \
 271 do {    void *_here = image + addrs[i] - 8;             \
 272         unsigned int _off = (void *)(FUNC) - _here;     \
 273         *prog++ = CALL | (((_off) >> 2) & 0x3fffffff);  \
 274         emit_nop();                                     \
 275 } while (0)
 276
 277 #define emit_branch(BR_OPC, DEST)                       \
 278 do {    unsigned int _here = addrs[i] - 8;              \
 279         *prog++ = BR_OPC | WDISP22((DEST) - _here);     \
 280 } while (0)
 281
 282 #define emit_branch_off(BR_OPC, OFF)                    \
 283 do {    *prog++ = BR_OPC | WDISP22(OFF);                \
 284 } while (0)
 285
 286 #define emit_jump(DEST)         emit_branch(BA, DEST)
 287
 288 #define emit_read_y(REG)        *prog++ = RD_Y | RD(REG)
 289 #define emit_write_y(REG)       *prog++ = WR_Y | IMMED | RS1(REG) | S13(0)
 290
 291 #define emit_cmp(R1, R2) \
 292         *prog++ = (SUBCC | RS1(R1) | RS2(R2) | RD(G0))
 293
 294 #define emit_cmpi(R1, IMM) \
 295         *prog++ = (SUBCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
 296
 297 #define emit_btst(R1, R2) \
 298         *prog++ = (ANDCC | RS1(R1) | RS2(R2) | RD(G0))
 299
 300 #define emit_btsti(R1, IMM) \
 301         *prog++ = (ANDCC | IMMED | RS1(R1) | S13(IMM) | RD(G0));
 302
 303 #define emit_sub(R1, R2, R3) \
 304         *prog++ = (SUB | RS1(R1) | RS2(R2) | RD(R3))
 305
 306 #define emit_subi(R1, IMM, R3) \
 307         *prog++ = (SUB | IMMED | RS1(R1) | S13(IMM) | RD(R3))
 308
 309 #define emit_add(R1, R2, R3) \
 310         *prog++ = (ADD | RS1(R1) | RS2(R2) | RD(R3))
 311
 312 #define emit_addi(R1, IMM, R3) \
 313         *prog++ = (ADD | IMMED | RS1(R1) | S13(IMM) | RD(R3))
 314
 315 #define emit_alloc_stack(SZ) \
 316         *prog++ = (SUB | IMMED | RS1(SP) | S13(SZ) | RD(SP))
 317
 318 #define emit_release_stack(SZ) \
 319         *prog++ = (ADD | IMMED | RS1(SP) | S13(SZ) | RD(SP))
 320
 321 /* A note about branch offset calculations.  The addrs[] array,
 322  * indexed by BPF instruction, records the address after all the
 323  * sparc instructions emitted for that BPF instruction.
 324  *
 325  * The most common case is to emit a branch at the end of such
 326  * a code sequence.  So this would be two instructions, the
 327  * branch and it's delay slot.
 328  *
 329  * Therefore by default the branch emitters calculate the branch
 330  * offset field as:
 331  *
 332  *      destination - (addrs[i] - 8)
 333  *
 334  * This "addrs[i] - 8" is the address of the branch itself or
 335  * what "." would be in assembler notation.  The "8" part is
 336  * how we take into consideration the branch and it's delay
 337  * slot mentioned above.
 338  *
 339  * Sometimes we need to emit a branch earlier in the code
 340  * sequence.  And in these situations we adjust "destination"
 341  * to accomodate this difference.  For example, if we needed
 342  * to emit a branch (and it's delay slot) right before the
 343  * final instruction emitted for a BPF opcode, we'd use
 344  * "destination + 4" instead of just plain "destination" above.
 345  *
 346  * This is why you see all of these funny emit_branch() and
 347  * emit_jump() calls with adjusted offsets.
 348  */
 349
 350 void bpf_jit_compile(struct sk_filter *fp)
 351 {
 352         unsigned int cleanup_addr, proglen, oldproglen = 0;
 353         u32 temp[8], *prog, *func, seen = 0, pass;
 354         const struct sock_filter *filter = fp->insns;
 355         int i, flen = fp->len, pc_ret0 = -1;
 356         unsigned int *addrs;
 357         void *image;
 358
 359         if (!bpf_jit_enable)
 360                 return;
 361
 362         addrs = kmalloc(flen * sizeof(*addrs), GFP_KERNEL);
 363         if (addrs == NULL)
 364                 return;
 365
 366         /* Before first pass, make a rough estimation of addrs[]
 367          * each bpf instruction is translated to less than 64 bytes
 368          */
 369         for (proglen = 0, i = 0; i < flen; i++) {
 370                 proglen += 64;
 371                 addrs[i] = proglen;
 372         }
 373         cleanup_addr = proglen; /* epilogue address */
 374         image = NULL;
 375         for (pass = 0; pass < 10; pass++) {
 376                 u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
 377
 378                 /* no prologue/epilogue for trivial filters (RET something) */
 379                 proglen = 0;
 380                 prog = temp;
 381
 382                 /* Prologue */
 383                 if (seen_or_pass0) {
 384                         if (seen_or_pass0 & SEEN_MEM) {
 385                                 unsigned int sz = BASE_STACKFRAME;
 386                                 sz += BPF_MEMWORDS * sizeof(u32);
 387                                 emit_alloc_stack(sz);
 388                         }
 389
 390                         /* Make sure we dont leek kernel memory. */
 391                         if (seen_or_pass0 & SEEN_XREG)
 392                                 emit_clear(r_X);
 393
 394                         /* If this filter needs to access skb data,
 395                          * load %o4 and %o5 with:
 396                          *  %o4 = skb->len - skb->data_len
 397                          *  %o5 = skb->data
 398                          * And also back up %o7 into r_saved_O7 so we can
 399                          * invoke the stubs using 'call'.
 400                          */
 401                         if (seen_or_pass0 & SEEN_DATAREF) {
 402                                 emit_load32(r_SKB, struct sk_buff, len, r_HEADLEN);
 403                                 emit_load32(r_SKB, struct sk_buff, data_len, r_TMP);
 404                                 emit_sub(r_HEADLEN, r_TMP, r_HEADLEN);
 405                                 emit_loadptr(r_SKB, struct sk_buff, data, r_SKB_DATA);
 406                         }
 407                 }
 408                 emit_reg_move(O7, r_saved_O7);
 409
 410                 switch (filter[0].code) {
 411                 case BPF_S_RET_K:
 412                 case BPF_S_LD_W_LEN:
 413                 case BPF_S_ANC_PROTOCOL:
 414                 case BPF_S_ANC_PKTTYPE:
 415                 case BPF_S_ANC_IFINDEX:
 416                 case BPF_S_ANC_MARK:
 417                 case BPF_S_ANC_RXHASH:
 418                 case BPF_S_ANC_CPU:
 419                 case BPF_S_ANC_QUEUE:
 420                 case BPF_S_LD_W_ABS:
 421                 case BPF_S_LD_H_ABS:
 422                 case BPF_S_LD_B_ABS:
 423                         /* The first instruction sets the A register (or is
 424                          * a "RET 'constant'")
 425                          */
 426                         break;
 427                 default:
 428                         /* Make sure we dont leak kernel information to the
 429                          * user.
 430                          */
 431                         emit_clear(r_A); /* A = 0 */
 432                 }
 433
 434                 for (i = 0; i < flen; i++) {
 435                         unsigned int K = filter[i].k;
 436                         unsigned int t_offset;
 437                         unsigned int f_offset;
 438                         u32 t_op, f_op;
 439                         int ilen;
 440
 441                         switch (filter[i].code) {
 442                         case BPF_S_ALU_ADD_X:   /* A += X; */
 443                                 emit_alu_X(ADD);
 444                                 break;
 445                         case BPF_S_ALU_ADD_K:   /* A += K; */
 446                                 emit_alu_K(ADD, K);
 447                                 break;
 448                         case BPF_S_ALU_SUB_X:   /* A -= X; */
 449                                 emit_alu_X(SUB);
 450                                 break;
 451                         case BPF_S_ALU_SUB_K:   /* A -= K */
 452                                 emit_alu_K(SUB, K);
 453                                 break;
 454                         case BPF_S_ALU_AND_X:   /* A &= X */
 455                                 emit_alu_X(AND);
 456                                 break;
 457                         case BPF_S_ALU_AND_K:   /* A &= K */
 458                                 emit_alu_K(AND, K);
 459                                 break;
 460                         case BPF_S_ALU_OR_X:    /* A |= X */
 461                                 emit_alu_X(OR);
 462                                 break;
 463                         case BPF_S_ALU_OR_K:    /* A |= K */
 464                                 emit_alu_K(OR, K);
 465                                 break;
 466                         case BPF_S_ANC_ALU_XOR_X: /* A ^= X; */
 467                                 emit_alu_X(XOR);
 468                                 break;
 469                         case BPF_S_ALU_LSH_X:   /* A <<= X */
 470                                 emit_alu_X(SLL);
 471                                 break;
 472                         case BPF_S_ALU_LSH_K:   /* A <<= K */
 473                                 emit_alu_K(SLL, K);
 474                                 break;
 475                         case BPF_S_ALU_RSH_X:   /* A >>= X */
 476                                 emit_alu_X(SRL);
 477                                 break;
 478                         case BPF_S_ALU_RSH_K:   /* A >>= K */
 479                                 emit_alu_K(SRL, K);
 480                                 break;
 481                         case BPF_S_ALU_MUL_X:   /* A *= X; */
 482                                 emit_alu_X(MUL);
 483                                 break;
 484                         case BPF_S_ALU_MUL_K:   /* A *= K */
 485                                 emit_alu_K(MUL, K);
 486                                 break;
 487                         case BPF_S_ALU_DIV_K:   /* A /= K */
 488                                 emit_alu_K(MUL, K);
 489                                 emit_read_y(r_A);
 490                                 break;
 491                         case BPF_S_ALU_DIV_X:   /* A /= X; */
 492                                 emit_cmpi(r_X, 0);
 493                                 if (pc_ret0 > 0) {
 494                                         t_offset = addrs[pc_ret0 - 1];
 495 #ifdef CONFIG_SPARC32
 496                                         emit_branch(BE, t_offset + 20);
 497 #else
 498                                         emit_branch(BE, t_offset + 8);
 499 #endif
 500                                         emit_nop(); /* delay slot */
 501                                 } else {
 502                                         emit_branch_off(BNE, 16);
 503                                         emit_nop();
 504 #ifdef CONFIG_SPARC32
 505                                         emit_jump(cleanup_addr + 20);
 506 #else
 507                                         emit_jump(cleanup_addr + 8);
 508 #endif
 509                                         emit_clear(r_A);
 510                                 }
 511                                 emit_write_y(G0);
 512 #ifdef CONFIG_SPARC32
 513                                 /* The Sparc v8 architecture requires
 514                                  * three instructions between a %y
 515                                  * register write and the first use.
 516                                  */
 517                                 emit_nop();
 518                                 emit_nop();
 519                                 emit_nop();
 520 #endif
 521                                 emit_alu_X(DIV);
 522                                 break;
 523                         case BPF_S_ALU_NEG:
 524                                 emit_neg();
 525                                 break;
 526                         case BPF_S_RET_K:
 527                                 if (!K) {
 528                                         if (pc_ret0 == -1)
 529                                                 pc_ret0 = i;
 530                                         emit_clear(r_A);
 531                                 } else {
 532                                         emit_loadimm(K, r_A);
 533                                 }
 534                                 /* Fallthrough */
 535                         case BPF_S_RET_A:
 536                                 if (seen_or_pass0) {
 537                                         if (i != flen - 1) {
 538                                                 emit_jump(cleanup_addr);
 539                                                 emit_nop();
 540                                                 break;
 541                                         }
 542                                         if (seen_or_pass0 & SEEN_MEM) {
 543                                                 unsigned int sz = BASE_STACKFRAME;
 544                                                 sz += BPF_MEMWORDS * sizeof(u32);
 545                                                 emit_release_stack(sz);
 546                                         }
 547                                 }
 548                                 /* jmpl %r_saved_O7 + 8, %g0 */
 549                                 emit_jmpl(r_saved_O7, 8, G0);
 550                                 emit_reg_move(r_A, O0); /* delay slot */
 551                                 break;
 552                         case BPF_S_MISC_TAX:
 553                                 seen |= SEEN_XREG;
 554                                 emit_reg_move(r_A, r_X);
 555                                 break;
 556                         case BPF_S_MISC_TXA:
 557                                 seen |= SEEN_XREG;
 558                                 emit_reg_move(r_X, r_A);
 559                                 break;
 560                         case BPF_S_ANC_CPU:
 561                                 emit_load_cpu(r_A);
 562                                 break;
 563                         case BPF_S_ANC_PROTOCOL:
 564                                 emit_skb_load16(protocol, r_A);
 565                                 break;
 566 #if 0
 567                                 /* GCC won't let us take the address of
 568                                  * a bit field even though we very much
 569                                  * know what we are doing here.
 570                                  */
 571                         case BPF_S_ANC_PKTTYPE:
 572                                 __emit_skb_load8(pkt_type, r_A);
 573                                 emit_alu_K(SRL, 5);
 574                                 break;
 575 #endif
 576                         case BPF_S_ANC_IFINDEX:
 577                                 emit_skb_loadptr(dev, r_A);
 578                                 emit_cmpi(r_A, 0);
 579                                 emit_branch(BNE_PTR, cleanup_addr + 4);
 580                                 emit_nop();
 581                                 emit_load32(r_A, struct net_device, ifindex, r_A);
 582                                 break;
 583                         case BPF_S_ANC_MARK:
 584                                 emit_skb_load32(mark, r_A);
 585                                 break;
 586                         case BPF_S_ANC_QUEUE:
 587                                 emit_skb_load16(queue_mapping, r_A);
 588                                 break;
 589                         case BPF_S_ANC_HATYPE:
 590                                 emit_skb_loadptr(dev, r_A);
 591                                 emit_cmpi(r_A, 0);
 592                                 emit_branch(BNE_PTR, cleanup_addr + 4);
 593                                 emit_nop();
 594                                 emit_load16(r_A, struct net_device, type, r_A);
 595                                 break;
 596                         case BPF_S_ANC_RXHASH:
 597                                 emit_skb_load32(rxhash, r_A);
 598                                 break;
 599
 600                         case BPF_S_LD_IMM:
 601                                 emit_loadimm(K, r_A);
 602                                 break;
 603                         case BPF_S_LDX_IMM:
 604                                 emit_loadimm(K, r_X);
 605                                 break;
 606                         case BPF_S_LD_MEM:
 607                                 emit_ldmem(K * 4, r_A);
 608                                 break;
 609                         case BPF_S_LDX_MEM:
 610                                 emit_ldmem(K * 4, r_X);
 611                                 break;
 612                         case BPF_S_ST:
 613                                 emit_stmem(K * 4, r_A);
 614                                 break;
 615                         case BPF_S_STX:
 616                                 emit_stmem(K * 4, r_X);
 617                                 break;
 618
 619 #define CHOOSE_LOAD_FUNC(K, func) \
 620         ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
 621
 622                         case BPF_S_LD_W_ABS:
 623                                 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_word);
 624 common_load:                    seen |= SEEN_DATAREF;
 625                                 emit_loadimm(K, r_OFF);
 626                                 emit_call(func);
 627                                 break;
 628                         case BPF_S_LD_H_ABS:
 629                                 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_half);
 630                                 goto common_load;
 631                         case BPF_S_LD_B_ABS:
 632                                 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte);
 633                                 goto common_load;
 634                         case BPF_S_LDX_B_MSH:
 635                                 func = CHOOSE_LOAD_FUNC(K, bpf_jit_load_byte_msh);
 636                                 goto common_load;
 637                         case BPF_S_LD_W_IND:
 638                                 func = bpf_jit_load_word;
 639 common_load_ind:                seen |= SEEN_DATAREF | SEEN_XREG;
 640                                 if (K) {
 641                                         if (is_simm13(K)) {
 642                                                 emit_addi(r_X, K, r_OFF);
 643                                         } else {
 644                                                 emit_loadimm(K, r_TMP);
 645                                                 emit_add(r_X, r_TMP, r_OFF);
 646                                         }
 647                                 } else {
 648                                         emit_reg_move(r_X, r_OFF);
 649                                 }
 650                                 emit_call(func);
 651                                 break;
 652                         case BPF_S_LD_H_IND:
 653                                 func = bpf_jit_load_half;
 654                                 goto common_load_ind;
 655                         case BPF_S_LD_B_IND:
 656                                 func = bpf_jit_load_byte;
 657                                 goto common_load_ind;
 658                         case BPF_S_JMP_JA:
 659                                 emit_jump(addrs[i + K]);
 660                                 emit_nop();
 661                                 break;
 662
 663 #define COND_SEL(CODE, TOP, FOP)        \
 664         case CODE:                      \
 665                 t_op = TOP;             \
 666                 f_op = FOP;             \
 667                 goto cond_branch
 668
 669                         COND_SEL(BPF_S_JMP_JGT_K, BGU, BLEU);
 670                         COND_SEL(BPF_S_JMP_JGE_K, BGEU, BLU);
 671                         COND_SEL(BPF_S_JMP_JEQ_K, BE, BNE);
 672                         COND_SEL(BPF_S_JMP_JSET_K, BNE, BE);
 673                         COND_SEL(BPF_S_JMP_JGT_X, BGU, BLEU);
 674                         COND_SEL(BPF_S_JMP_JGE_X, BGEU, BLU);
 675                         COND_SEL(BPF_S_JMP_JEQ_X, BE, BNE);
 676                         COND_SEL(BPF_S_JMP_JSET_X, BNE, BE);
 677
 678 cond_branch:                    f_offset = addrs[i + filter[i].jf];
 679                                 t_offset = addrs[i + filter[i].jt];
 680
 681                                 /* same targets, can avoid doing the test :) */
 682                                 if (filter[i].jt == filter[i].jf) {
 683                                         emit_jump(t_offset);
 684                                         emit_nop();
 685                                         break;
 686                                 }
 687
 688                                 switch (filter[i].code) {
 689                                 case BPF_S_JMP_JGT_X:
 690                                 case BPF_S_JMP_JGE_X:
 691                                 case BPF_S_JMP_JEQ_X:
 692                                         seen |= SEEN_XREG;
 693                                         emit_cmp(r_A, r_X);
 694                                         break;
 695                                 case BPF_S_JMP_JSET_X:
 696                                         seen |= SEEN_XREG;
 697                                         emit_btst(r_A, r_X);
 698                                         break;
 699                                 case BPF_S_JMP_JEQ_K:
 700                                 case BPF_S_JMP_JGT_K:
 701                                 case BPF_S_JMP_JGE_K:
 702                                         if (is_simm13(K)) {
 703                                                 emit_cmpi(r_A, K);
 704                                         } else {
 705                                                 emit_loadimm(K, r_TMP);
 706                                                 emit_cmp(r_A, r_TMP);
 707                                         }
 708                                         break;
 709                                 case BPF_S_JMP_JSET_K:
 710                                         if (is_simm13(K)) {
 711                                                 emit_btsti(r_A, K);
 712                                         } else {
 713                                                 emit_loadimm(K, r_TMP);
 714                                                 emit_btst(r_A, r_TMP);
 715                                         }
 716                                         break;
 717                                 }
 718                                 if (filter[i].jt != 0) {
 719                                         if (filter[i].jf)
 720                                                 t_offset += 8;
 721                                         emit_branch(t_op, t_offset);
 722                                         emit_nop(); /* delay slot */
 723                                         if (filter[i].jf) {
 724                                                 emit_jump(f_offset);
 725                                                 emit_nop();
 726                                         }
 727                                         break;
 728                                 }
 729                                 emit_branch(f_op, f_offset);
 730                                 emit_nop(); /* delay slot */
 731                                 break;
 732
 733                         default:
 734                                 /* hmm, too complex filter, give up with jit compiler */
 735                                 goto out;
 736                         }
 737                         ilen = (void *) prog - (void *) temp;
 738                         if (image) {
 739                                 if (unlikely(proglen + ilen > oldproglen)) {
 740                                         pr_err("bpb_jit_compile fatal error\n");
 741                                         kfree(addrs);
 742                                         module_free(NULL, image);
 743                                         return;
 744                                 }
 745                                 memcpy(image + proglen, temp, ilen);
 746                         }
 747                         proglen += ilen;
 748                         addrs[i] = proglen;
 749                         prog = temp;
 750                 }
 751                 /* last bpf instruction is always a RET :
 752                  * use it to give the cleanup instruction(s) addr
 753                  */
 754                 cleanup_addr = proglen - 8; /* jmpl; mov r_A,%o0; */
 755                 if (seen_or_pass0 & SEEN_MEM)
 756                         cleanup_addr -= 4; /* add %sp, X, %sp; */
 757
 758                 if (image) {
 759                         if (proglen != oldproglen)
 760                                 pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n",
 761                                        proglen, oldproglen);
 762                         break;
 763                 }
 764                 if (proglen == oldproglen) {
 765                         image = module_alloc(max_t(unsigned int,
 766                                                    proglen,
 767                                                    sizeof(struct work_struct)));
 768                         if (!image)
 769                                 goto out;
 770                 }
 771                 oldproglen = proglen;
 772         }
 773
 774         if (bpf_jit_enable > 1)
 775                 pr_err("flen=%d proglen=%u pass=%d image=%p\n",
 776                        flen, proglen, pass, image);
 777
 778         if (image) {
 779                 if (bpf_jit_enable > 1)
 780                         print_hex_dump(KERN_ERR, "JIT code: ", DUMP_PREFIX_ADDRESS,
 781                                        16, 1, image, proglen, false);
 782                 bpf_flush_icache(image, image + proglen);
 783                 fp->bpf_func = (void *)image;
 784         }
 785 out:
 786         kfree(addrs);
 787         return;
 788 }
 789
 790 static void jit_free_defer(struct work_struct *arg)
 791 {
 792         module_free(NULL, arg);
 793 }
 794
 795 /* run from softirq, we must use a work_struct to call
 796  * module_free() from process context
 797  */
 798 void bpf_jit_free(struct sk_filter *fp)
 799 {
 800         if (fp->bpf_func != sk_run_filter) {
 801                 struct work_struct *work = (struct work_struct *)fp->bpf_func;
 802
 803                 INIT_WORK(work, jit_free_defer);
 804                 schedule_work(work);
 805         }
 806 }