1 // SPDX-License-Identifier: GPL-2.0-only
5 * Copyright 2016 Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
8 * Based on the powerpc classic BPF JIT compiler by Matt Evans
10 #include <linux/moduleloader.h>
11 #include <asm/cacheflush.h>
12 #include <asm/asm-compat.h>
13 #include <linux/netdevice.h>
14 #include <linux/filter.h>
15 #include <linux/if_vlan.h>
16 #include <asm/kprobes.h>
17 #include <linux/bpf.h>
21 static void bpf_jit_fill_ill_insns(void *area, unsigned int size)
23 memset32(area, BREAKPOINT_INSTRUCTION, size / 4);
26 /* Fix updated addresses (for subprog calls, ldimm64, et al) during extra pass */
27 static int bpf_jit_fixup_addresses(struct bpf_prog *fp, u32 *image,
28 struct codegen_context *ctx, u32 *addrs)
30 const struct bpf_insn *insn = fp->insnsi;
36 for (i = 0; i < fp->len; i++) {
38 * During the extra pass, only the branch target addresses for
39 * the subprog calls need to be fixed. All other instructions
42 * The JITed image length does not change because we already
43 * ensure that the JITed instruction sequence for these calls
44 * are of fixed length by padding them with NOPs.
46 if (insn[i].code == (BPF_JMP | BPF_CALL) &&
47 insn[i].src_reg == BPF_PSEUDO_CALL) {
48 ret = bpf_jit_get_func_addr(fp, &insn[i], true,
55 * Save ctx->idx as this would currently point to the
56 * end of the JITed image and set it to the offset of
57 * the instruction sequence corresponding to the
58 * subprog call temporarily.
61 ctx->idx = addrs[i] / 4;
62 ret = bpf_jit_emit_func_call_rel(image, ctx, func_addr);
67 * Restore ctx->idx here. This is safe as the length
68 * of the JITed sequence remains unchanged.
71 } else if (insn[i].code == (BPF_LD | BPF_IMM | BPF_DW)) {
73 ctx->idx = addrs[i] / 4;
75 PPC_LI32(bpf_to_ppc(insn[i].dst_reg) - 1, (u32)insn[i + 1].imm);
76 PPC_LI32(bpf_to_ppc(insn[i].dst_reg), (u32)insn[i].imm);
77 for (j = ctx->idx - addrs[i] / 4; j < 4; j++)
80 func_addr = ((u64)(u32)insn[i].imm) | (((u64)(u32)insn[i + 1].imm) << 32);
81 PPC_LI64(bpf_to_ppc(insn[i].dst_reg), func_addr);
82 /* overwrite rest with nops */
83 for (j = ctx->idx - addrs[i] / 4; j < 5; j++)
94 int bpf_jit_emit_exit_insn(u32 *image, struct codegen_context *ctx, int tmp_reg, long exit_addr)
96 if (!exit_addr || is_offset_in_branch_range(exit_addr - (ctx->idx * 4))) {
98 } else if (ctx->alt_exit_addr) {
99 if (WARN_ON(!is_offset_in_branch_range((long)ctx->alt_exit_addr - (ctx->idx * 4))))
101 PPC_JMP(ctx->alt_exit_addr);
103 ctx->alt_exit_addr = ctx->idx * 4;
104 bpf_jit_build_epilogue(image, ctx);
110 struct powerpc64_jit_data {
111 struct bpf_binary_header *header;
115 struct codegen_context ctx;
118 bool bpf_jit_needs_zext(void)
123 struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
130 struct powerpc64_jit_data *jit_data;
131 struct codegen_context cgctx;
134 struct bpf_binary_header *bpf_hdr;
135 struct bpf_prog *org_fp = fp;
136 struct bpf_prog *tmp_fp;
137 bool bpf_blinded = false;
138 bool extra_pass = false;
142 if (!fp->jit_requested)
145 tmp_fp = bpf_jit_blind_constants(org_fp);
149 if (tmp_fp != org_fp) {
154 jit_data = fp->aux->jit_data;
156 jit_data = kzalloc(sizeof(*jit_data), GFP_KERNEL);
161 fp->aux->jit_data = jit_data;
165 addrs = jit_data->addrs;
167 cgctx = jit_data->ctx;
168 image = jit_data->image;
169 bpf_hdr = jit_data->header;
170 proglen = jit_data->proglen;
175 addrs = kcalloc(flen + 1, sizeof(*addrs), GFP_KERNEL);
181 memset(&cgctx, 0, sizeof(struct codegen_context));
182 bpf_jit_init_reg_mapping(&cgctx);
184 /* Make sure that the stack is quadword aligned. */
185 cgctx.stack_size = round_up(fp->aux->stack_depth, 16);
187 /* Scouting faux-generate pass 0 */
188 if (bpf_jit_build_body(fp, 0, &cgctx, addrs, 0)) {
189 /* We hit something illegal or unsupported. */
195 * If we have seen a tail call, we need a second pass.
196 * This is because bpf_jit_emit_common_epilogue() is called
197 * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
198 * We also need a second pass if we ended up with too large
199 * a program so as to ensure BPF_EXIT branches are in range.
201 if (cgctx.seen & SEEN_TAILCALL || !is_offset_in_branch_range((long)cgctx.idx * 4)) {
203 if (bpf_jit_build_body(fp, 0, &cgctx, addrs, 0)) {
209 bpf_jit_realloc_regs(&cgctx);
211 * Pretend to build prologue, given the features we've seen. This will
212 * update ctgtx.idx as it pretends to output instructions, then we can
213 * calculate total size from idx.
215 bpf_jit_build_prologue(0, &cgctx);
216 addrs[fp->len] = cgctx.idx * 4;
217 bpf_jit_build_epilogue(0, &cgctx);
219 fixup_len = fp->aux->num_exentries * BPF_FIXUP_LEN * 4;
220 extable_len = fp->aux->num_exentries * sizeof(struct exception_table_entry);
222 proglen = cgctx.idx * 4;
223 alloclen = proglen + FUNCTION_DESCR_SIZE + fixup_len + extable_len;
225 bpf_hdr = bpf_jit_binary_alloc(alloclen, &image, 4, bpf_jit_fill_ill_insns);
232 fp->aux->extable = (void *)image + FUNCTION_DESCR_SIZE + proglen + fixup_len;
235 code_base = (u32 *)(image + FUNCTION_DESCR_SIZE);
239 * Do not touch the prologue and epilogue as they will remain
240 * unchanged. Only fix the branch target address for subprog
241 * calls in the body, and ldimm64 instructions.
243 * This does not change the offsets and lengths of the subprog
244 * call instruction sequences and hence, the size of the JITed
247 bpf_jit_fixup_addresses(fp, code_base, &cgctx, addrs);
249 /* There is no need to perform the usual passes. */
250 goto skip_codegen_passes;
253 /* Code generation passes 1-2 */
254 for (pass = 1; pass < 3; pass++) {
255 /* Now build the prologue, body code & epilogue for real. */
257 cgctx.alt_exit_addr = 0;
258 bpf_jit_build_prologue(code_base, &cgctx);
259 if (bpf_jit_build_body(fp, code_base, &cgctx, addrs, pass)) {
260 bpf_jit_binary_free(bpf_hdr);
264 bpf_jit_build_epilogue(code_base, &cgctx);
266 if (bpf_jit_enable > 1)
267 pr_info("Pass %d: shrink = %d, seen = 0x%x\n", pass,
268 proglen - (cgctx.idx * 4), cgctx.seen);
272 if (bpf_jit_enable > 1)
274 * Note that we output the base address of the code_base
275 * rather than image, since opcodes are in code_base.
277 bpf_jit_dump(flen, proglen, pass, code_base);
279 #ifdef CONFIG_PPC64_ELF_ABI_V1
280 /* Function descriptor nastiness: Address + TOC */
281 ((u64 *)image)[0] = (u64)code_base;
282 ((u64 *)image)[1] = local_paca->kernel_toc;
285 fp->bpf_func = (void *)image;
287 fp->jited_len = proglen + FUNCTION_DESCR_SIZE;
289 bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + bpf_hdr->size);
290 if (!fp->is_func || extra_pass) {
291 bpf_jit_binary_lock_ro(bpf_hdr);
292 bpf_prog_fill_jited_linfo(fp, addrs);
296 fp->aux->jit_data = NULL;
298 jit_data->addrs = addrs;
299 jit_data->ctx = cgctx;
300 jit_data->proglen = proglen;
301 jit_data->image = image;
302 jit_data->header = bpf_hdr;
307 bpf_jit_prog_release_other(fp, fp == org_fp ? tmp_fp : org_fp);
313 * The caller should check for (BPF_MODE(code) == BPF_PROBE_MEM) before calling
314 * this function, as this only applies to BPF_PROBE_MEM, for now.
316 int bpf_add_extable_entry(struct bpf_prog *fp, u32 *image, int pass, struct codegen_context *ctx,
317 int insn_idx, int jmp_off, int dst_reg)
321 struct exception_table_entry *ex;
324 /* Populate extable entries only in the last pass */
328 if (!fp->aux->extable ||
329 WARN_ON_ONCE(ctx->exentry_idx >= fp->aux->num_exentries))
332 pc = (unsigned long)&image[insn_idx];
334 fixup = (void *)fp->aux->extable -
335 (fp->aux->num_exentries * BPF_FIXUP_LEN * 4) +
336 (ctx->exentry_idx * BPF_FIXUP_LEN * 4);
338 fixup[0] = PPC_RAW_LI(dst_reg, 0);
339 if (IS_ENABLED(CONFIG_PPC32))
340 fixup[1] = PPC_RAW_LI(dst_reg - 1, 0); /* clear higher 32-bit register too */
342 fixup[BPF_FIXUP_LEN - 1] =
343 PPC_RAW_BRANCH((long)(pc + jmp_off) - (long)&fixup[BPF_FIXUP_LEN - 1]);
345 ex = &fp->aux->extable[ctx->exentry_idx];
347 offset = pc - (long)&ex->insn;
348 if (WARN_ON_ONCE(offset >= 0 || offset < INT_MIN))
352 offset = (long)fixup - (long)&ex->fixup;
353 if (WARN_ON_ONCE(offset >= 0 || offset < INT_MIN))