projects / openwrt / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
kernel: bump 5.10 to 5.10.173
[openwrt/openwrt.git] / target / linux / generic / backport-5.10 / 050-v5.16-02-mips-bpf-Add-eBPF-JIT-for-32-bit-MIPS.patch
1 From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
2 Date: Tue, 5 Oct 2021 18:54:04 +0200
3 Subject: [PATCH] mips: bpf: Add eBPF JIT for 32-bit MIPS
4
5 This is an implementation of an eBPF JIT for 32-bit MIPS I-V and MIPS32.
6 The implementation supports all 32-bit and 64-bit ALU and JMP operations,
7 including the recently-added atomics. 64-bit div/mod and 64-bit atomics
8 are implemented using function calls to math64 and atomic64 functions,
9 respectively. All 32-bit operations are implemented natively by the JIT,
10 except if the CPU lacks ll/sc instructions.
11
12 Register mapping
13 ================
14 All 64-bit eBPF registers are mapped to native 32-bit MIPS register pairs,
15 and does not use any stack scratch space for register swapping. This means
16 that all eBPF register data is kept in CPU registers all the time, and
17 this simplifies the register management a lot. It also reduces the JIT's
18 pressure on temporary registers since we do not have to move data around.
19
20 Native register pairs are ordered according to CPU endiannes, following
21 the O32 calling convention for passing 64-bit arguments and return values.
22 The eBPF return value, arguments and callee-saved registers are mapped to
23 their native MIPS equivalents.
24
25 Since the 32 highest bits in the eBPF FP (frame pointer) register are
26 always zero, only one general-purpose register is actually needed for the
27 mapping. The MIPS fp register is used for this purpose. The high bits are
28 mapped to MIPS register r0. This saves us one CPU register, which is much
29 needed for temporaries, while still allowing us to treat the R10 (FP)
30 register just like any other eBPF register in the JIT.
31
32 The MIPS gp (global pointer) and at (assembler temporary) registers are
33 used as internal temporary registers for constant blinding. CPU registers
34 t6-t9 are used internally by the JIT when constructing more complex 64-bit
35 operations. This is precisely what is needed - two registers to store an
36 operand value, and two more as scratch registers when performing the
37 operation.
38
39 The register mapping is shown below.
40
41 R0 - $v1, $v0 return value
42 R1 - $a1, $a0 argument 1, passed in registers
43 R2 - $a3, $a2 argument 2, passed in registers
44 R3 - $t1, $t0 argument 3, passed on stack
45 R4 - $t3, $t2 argument 4, passed on stack
46 R5 - $t4, $t3 argument 5, passed on stack
47 R6 - $s1, $s0 callee-saved
48 R7 - $s3, $s2 callee-saved
49 R8 - $s5, $s4 callee-saved
50 R9 - $s7, $s6 callee-saved
51 FP - $r0, $fp 32-bit frame pointer
52 AX - $gp, $at constant-blinding
53 $t6 - $t9 unallocated, JIT temporaries
54
55 Jump offsets
56 ============
57 The JIT tries to map all conditional JMP operations to MIPS conditional
58 PC-relative branches. The MIPS branch offset field is 18 bits, in bytes,
59 which is equivalent to the eBPF 16-bit instruction offset. However, since
60 the JIT may emit more than one CPU instruction per eBPF instruction, the
61 field width may overflow. If that happens, the JIT converts the long
62 conditional jump to a short PC-relative branch with the condition
63 inverted, jumping over a long unconditional absolute jmp (j).
64
65 This conversion will change the instruction offset mapping used for jumps,
66 and may in turn result in more branch offset overflows. The JIT therefore
67 dry-runs the translation until no more branches are converted and the
68 offsets do not change anymore. There is an upper bound on this of course,
69 and if the JIT hits that limit, the last two iterations are run with all
70 branches being converted.
71
72 Tail call count
73 ===============
74 The current tail call count is stored in the 16-byte area of the caller's
75 stack frame that is reserved for the callee in the o32 ABI. The value is
76 initialized in the prologue, and propagated to the tail-callee by skipping
77 the initialization instructions when emitting the tail call.
78
79 Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
80 ---
81 create mode 100644 arch/mips/net/bpf_jit_comp.c
82 create mode 100644 arch/mips/net/bpf_jit_comp.h
83 create mode 100644 arch/mips/net/bpf_jit_comp32.c
84
85 --- a/arch/mips/net/Makefile
86 +++ b/arch/mips/net/Makefile
87 @@ -2,4 +2,9 @@
88 # MIPS networking code
89
90 obj-$(CONFIG_MIPS_CBPF_JIT) += bpf_jit.o bpf_jit_asm.o
91 -obj-$(CONFIG_MIPS_EBPF_JIT) += ebpf_jit.o
92 +
93 +ifeq ($(CONFIG_32BIT),y)
94 + obj-$(CONFIG_MIPS_EBPF_JIT) += bpf_jit_comp.o bpf_jit_comp32.o
95 +else
96 + obj-$(CONFIG_MIPS_EBPF_JIT) += ebpf_jit.o
97 +endif
98 --- /dev/null
99 +++ b/arch/mips/net/bpf_jit_comp.c
100 @@ -0,0 +1,1020 @@
101 +// SPDX-License-Identifier: GPL-2.0-only
102 +/*
103 + * Just-In-Time compiler for eBPF bytecode on MIPS.
104 + * Implementation of JIT functions common to 32-bit and 64-bit CPUs.
105 + *
106 + * Copyright (c) 2021 Anyfi Networks AB.
107 + * Author: Johan Almbladh <johan.almbladh@gmail.com>
108 + *
109 + * Based on code and ideas from
110 + * Copyright (c) 2017 Cavium, Inc.
111 + * Copyright (c) 2017 Shubham Bansal <illusionist.neo@gmail.com>
112 + * Copyright (c) 2011 Mircea Gherzan <mgherzan@gmail.com>
113 + */
114 +
115 +/*
116 + * Code overview
117 + * =============
118 + *
119 + * - bpf_jit_comp.h
120 + * Common definitions and utilities.
121 + *
122 + * - bpf_jit_comp.c
123 + * Implementation of JIT top-level logic and exported JIT API functions.
124 + * Implementation of internal operations shared by 32-bit and 64-bit code.
125 + * JMP and ALU JIT control code, register control code, shared ALU and
126 + * JMP/JMP32 JIT operations.
127 + *
128 + * - bpf_jit_comp32.c
129 + * Implementation of functions to JIT prologue, epilogue and a single eBPF
130 + * instruction for 32-bit MIPS CPUs. The functions use shared operations
131 + * where possible, and implement the rest for 32-bit MIPS such as ALU64
132 + * operations.
133 + *
134 + * - bpf_jit_comp64.c
135 + * Ditto, for 64-bit MIPS CPUs.
136 + *
137 + * Zero and sign extension
138 + * ========================
139 + * 32-bit MIPS instructions on 64-bit MIPS registers use sign extension,
140 + * but the eBPF instruction set mandates zero extension. We let the verifier
141 + * insert explicit zero-extensions after 32-bit ALU operations, both for
142 + * 32-bit and 64-bit MIPS JITs. Conditional JMP32 operations on 64-bit MIPs
143 + * are JITed with sign extensions inserted when so expected.
144 + *
145 + * ALU operations
146 + * ==============
147 + * ALU operations on 32/64-bit MIPS and ALU64 operations on 64-bit MIPS are
148 + * JITed in the following steps. ALU64 operations on 32-bit MIPS are more
149 + * complicated and therefore only processed by special implementations in
150 + * step (3).
151 + *
152 + * 1) valid_alu_i:
153 + * Determine if an immediate operation can be emitted as such, or if
154 + * we must fall back to the register version.
155 + *
156 + * 2) rewrite_alu_i:
157 + * Convert BPF operation and immediate value to a canonical form for
158 + * JITing. In some degenerate cases this form may be a no-op.
159 + *
160 + * 3) emit_alu_{i,i64,r,64}:
161 + * Emit instructions for an ALU or ALU64 immediate or register operation.
162 + *
163 + * JMP operations
164 + * ==============
165 + * JMP and JMP32 operations require an JIT instruction offset table for
166 + * translating the jump offset. This table is computed by dry-running the
167 + * JIT without actually emitting anything. However, the computed PC-relative
168 + * offset may overflow the 18-bit offset field width of the native MIPS
169 + * branch instruction. In such cases, the long jump is converted into the
170 + * following sequence.
171 + *
172 + * <branch> !<cond> +2 Inverted PC-relative branch
173 + * nop Delay slot
174 + * j <offset> Unconditional absolute long jump
175 + * nop Delay slot
176 + *
177 + * Since this converted sequence alters the offset table, all offsets must
178 + * be re-calculated. This may in turn trigger new branch conversions, so
179 + * the process is repeated until no further changes are made. Normally it
180 + * completes in 1-2 iterations. If JIT_MAX_ITERATIONS should reached, we
181 + * fall back to converting every remaining jump operation. The branch
182 + * conversion is independent of how the JMP or JMP32 condition is JITed.
183 + *
184 + * JMP32 and JMP operations are JITed as follows.
185 + *
186 + * 1) setup_jmp_{i,r}:
187 + * Convert jump conditional and offset into a form that can be JITed.
188 + * This form may be a no-op, a canonical form, or an inverted PC-relative
189 + * jump if branch conversion is necessary.
190 + *
191 + * 2) valid_jmp_i:
192 + * Determine if an immediate operations can be emitted as such, or if
193 + * we must fall back to the register version. Applies to JMP32 for 32-bit
194 + * MIPS, and both JMP and JMP32 for 64-bit MIPS.
195 + *
196 + * 3) emit_jmp_{i,i64,r,r64}:
197 + * Emit instructions for an JMP or JMP32 immediate or register operation.
198 + *
199 + * 4) finish_jmp_{i,r}:
200 + * Emit any instructions needed to finish the jump. This includes a nop
201 + * for the delay slot if a branch was emitted, and a long absolute jump
202 + * if the branch was converted.
203 + */
204 +
205 +#include <linux/limits.h>
206 +#include <linux/bitops.h>
207 +#include <linux/errno.h>
208 +#include <linux/filter.h>
209 +#include <linux/bpf.h>
210 +#include <linux/slab.h>
211 +#include <asm/bitops.h>
212 +#include <asm/cacheflush.h>
213 +#include <asm/cpu-features.h>
214 +#include <asm/isa-rev.h>
215 +#include <asm/uasm.h>
216 +
217 +#include "bpf_jit_comp.h"
218 +
219 +/* Convenience macros for descriptor access */
220 +#define CONVERTED(desc) ((desc) & JIT_DESC_CONVERT)
221 +#define INDEX(desc) ((desc) & ~JIT_DESC_CONVERT)
222 +
223 +/*
224 + * Push registers on the stack, starting at a given depth from the stack
225 + * pointer and increasing. The next depth to be written is returned.
226 + */
227 +int push_regs(struct jit_context *ctx, u32 mask, u32 excl, int depth)
228 +{
229 + int reg;
230 +
231 + for (reg = 0; reg < BITS_PER_BYTE * sizeof(mask); reg++)
232 + if (mask & BIT(reg)) {
233 + if ((excl & BIT(reg)) == 0) {
234 + if (sizeof(long) == 4)
235 + emit(ctx, sw, reg, depth, MIPS_R_SP);
236 + else /* sizeof(long) == 8 */
237 + emit(ctx, sd, reg, depth, MIPS_R_SP);
238 + }
239 + depth += sizeof(long);
240 + }
241 +
242 + ctx->stack_used = max((int)ctx->stack_used, depth);
243 + return depth;
244 +}
245 +
246 +/*
247 + * Pop registers from the stack, starting at a given depth from the stack
248 + * pointer and increasing. The next depth to be read is returned.
249 + */
250 +int pop_regs(struct jit_context *ctx, u32 mask, u32 excl, int depth)
251 +{
252 + int reg;
253 +
254 + for (reg = 0; reg < BITS_PER_BYTE * sizeof(mask); reg++)
255 + if (mask & BIT(reg)) {
256 + if ((excl & BIT(reg)) == 0) {
257 + if (sizeof(long) == 4)
258 + emit(ctx, lw, reg, depth, MIPS_R_SP);
259 + else /* sizeof(long) == 8 */
260 + emit(ctx, ld, reg, depth, MIPS_R_SP);
261 + }
262 + depth += sizeof(long);
263 + }
264 +
265 + return depth;
266 +}
267 +
268 +/* Compute the 28-bit jump target address from a BPF program location */
269 +int get_target(struct jit_context *ctx, u32 loc)
270 +{
271 + u32 index = INDEX(ctx->descriptors[loc]);
272 + unsigned long pc = (unsigned long)&ctx->target[ctx->jit_index];
273 + unsigned long addr = (unsigned long)&ctx->target[index];
274 +
275 + if (!ctx->target)
276 + return 0;
277 +
278 + if ((addr ^ pc) & ~MIPS_JMP_MASK)
279 + return -1;
280 +
281 + return addr & MIPS_JMP_MASK;
282 +}
283 +
284 +/* Compute the PC-relative offset to relative BPF program offset */
285 +int get_offset(const struct jit_context *ctx, int off)
286 +{
287 + return (INDEX(ctx->descriptors[ctx->bpf_index + off]) -
288 + ctx->jit_index - 1) * sizeof(u32);
289 +}
290 +
291 +/* dst = imm (register width) */
292 +void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm)
293 +{
294 + if (imm >= -0x8000 && imm <= 0x7fff) {
295 + emit(ctx, addiu, dst, MIPS_R_ZERO, imm);
296 + } else {
297 + emit(ctx, lui, dst, (s16)((u32)imm >> 16));
298 + emit(ctx, ori, dst, dst, (u16)(imm & 0xffff));
299 + }
300 + clobber_reg(ctx, dst);
301 +}
302 +
303 +/* dst = src (register width) */
304 +void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src)
305 +{
306 + emit(ctx, ori, dst, src, 0);
307 + clobber_reg(ctx, dst);
308 +}
309 +
310 +/* Validate ALU immediate range */
311 +bool valid_alu_i(u8 op, s32 imm)
312 +{
313 + switch (BPF_OP(op)) {
314 + case BPF_NEG:
315 + case BPF_LSH:
316 + case BPF_RSH:
317 + case BPF_ARSH:
318 + /* All legal eBPF values are valid */
319 + return true;
320 + case BPF_ADD:
321 + /* imm must be 16 bits */
322 + return imm >= -0x8000 && imm <= 0x7fff;
323 + case BPF_SUB:
324 + /* -imm must be 16 bits */
325 + return imm >= -0x7fff && imm <= 0x8000;
326 + case BPF_AND:
327 + case BPF_OR:
328 + case BPF_XOR:
329 + /* imm must be 16 bits unsigned */
330 + return imm >= 0 && imm <= 0xffff;
331 + case BPF_MUL:
332 + /* imm must be zero or a positive power of two */
333 + return imm == 0 || (imm > 0 && is_power_of_2(imm));
334 + case BPF_DIV:
335 + case BPF_MOD:
336 + /* imm must be an 17-bit power of two */
337 + return (u32)imm <= 0x10000 && is_power_of_2((u32)imm);
338 + }
339 + return false;
340 +}
341 +
342 +/* Rewrite ALU immediate operation */
343 +bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val)
344 +{
345 + bool act = true;
346 +
347 + switch (BPF_OP(op)) {
348 + case BPF_LSH:
349 + case BPF_RSH:
350 + case BPF_ARSH:
351 + case BPF_ADD:
352 + case BPF_SUB:
353 + case BPF_OR:
354 + case BPF_XOR:
355 + /* imm == 0 is a no-op */
356 + act = imm != 0;
357 + break;
358 + case BPF_MUL:
359 + if (imm == 1) {
360 + /* dst * 1 is a no-op */
361 + act = false;
362 + } else if (imm == 0) {
363 + /* dst * 0 is dst & 0 */
364 + op = BPF_AND;
365 + } else {
366 + /* dst * (1 << n) is dst << n */
367 + op = BPF_LSH;
368 + imm = ilog2(abs(imm));
369 + }
370 + break;
371 + case BPF_DIV:
372 + if (imm == 1) {
373 + /* dst / 1 is a no-op */
374 + act = false;
375 + } else {
376 + /* dst / (1 << n) is dst >> n */
377 + op = BPF_RSH;
378 + imm = ilog2(imm);
379 + }
380 + break;
381 + case BPF_MOD:
382 + /* dst % (1 << n) is dst & ((1 << n) - 1) */
383 + op = BPF_AND;
384 + imm--;
385 + break;
386 + }
387 +
388 + *alu = op;
389 + *val = imm;
390 + return act;
391 +}
392 +
393 +/* ALU immediate operation (32-bit) */
394 +void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op)
395 +{
396 + switch (BPF_OP(op)) {
397 + /* dst = -dst */
398 + case BPF_NEG:
399 + emit(ctx, subu, dst, MIPS_R_ZERO, dst);
400 + break;
401 + /* dst = dst & imm */
402 + case BPF_AND:
403 + emit(ctx, andi, dst, dst, (u16)imm);
404 + break;
405 + /* dst = dst | imm */
406 + case BPF_OR:
407 + emit(ctx, ori, dst, dst, (u16)imm);
408 + break;
409 + /* dst = dst ^ imm */
410 + case BPF_XOR:
411 + emit(ctx, xori, dst, dst, (u16)imm);
412 + break;
413 + /* dst = dst << imm */
414 + case BPF_LSH:
415 + emit(ctx, sll, dst, dst, imm);
416 + break;
417 + /* dst = dst >> imm */
418 + case BPF_RSH:
419 + emit(ctx, srl, dst, dst, imm);
420 + break;
421 + /* dst = dst >> imm (arithmetic) */
422 + case BPF_ARSH:
423 + emit(ctx, sra, dst, dst, imm);
424 + break;
425 + /* dst = dst + imm */
426 + case BPF_ADD:
427 + emit(ctx, addiu, dst, dst, imm);
428 + break;
429 + /* dst = dst - imm */
430 + case BPF_SUB:
431 + emit(ctx, addiu, dst, dst, -imm);
432 + break;
433 + }
434 + clobber_reg(ctx, dst);
435 +}
436 +
437 +/* ALU register operation (32-bit) */
438 +void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op)
439 +{
440 + switch (BPF_OP(op)) {
441 + /* dst = dst & src */
442 + case BPF_AND:
443 + emit(ctx, and, dst, dst, src);
444 + break;
445 + /* dst = dst | src */
446 + case BPF_OR:
447 + emit(ctx, or, dst, dst, src);
448 + break;
449 + /* dst = dst ^ src */
450 + case BPF_XOR:
451 + emit(ctx, xor, dst, dst, src);
452 + break;
453 + /* dst = dst << src */
454 + case BPF_LSH:
455 + emit(ctx, sllv, dst, dst, src);
456 + break;
457 + /* dst = dst >> src */
458 + case BPF_RSH:
459 + emit(ctx, srlv, dst, dst, src);
460 + break;
461 + /* dst = dst >> src (arithmetic) */
462 + case BPF_ARSH:
463 + emit(ctx, srav, dst, dst, src);
464 + break;
465 + /* dst = dst + src */
466 + case BPF_ADD:
467 + emit(ctx, addu, dst, dst, src);
468 + break;
469 + /* dst = dst - src */
470 + case BPF_SUB:
471 + emit(ctx, subu, dst, dst, src);
472 + break;
473 + /* dst = dst * src */
474 + case BPF_MUL:
475 + if (cpu_has_mips32r1 || cpu_has_mips32r6) {
476 + emit(ctx, mul, dst, dst, src);
477 + } else {
478 + emit(ctx, multu, dst, src);
479 + emit(ctx, mflo, dst);
480 + }
481 + break;
482 + /* dst = dst / src */
483 + case BPF_DIV:
484 + if (cpu_has_mips32r6) {
485 + emit(ctx, divu_r6, dst, dst, src);
486 + } else {
487 + emit(ctx, divu, dst, src);
488 + emit(ctx, mflo, dst);
489 + }
490 + break;
491 + /* dst = dst % src */
492 + case BPF_MOD:
493 + if (cpu_has_mips32r6) {
494 + emit(ctx, modu, dst, dst, src);
495 + } else {
496 + emit(ctx, divu, dst, src);
497 + emit(ctx, mfhi, dst);
498 + }
499 + break;
500 + }
501 + clobber_reg(ctx, dst);
502 +}
503 +
504 +/* Atomic read-modify-write (32-bit) */
505 +void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code)
506 +{
507 + emit(ctx, ll, MIPS_R_T9, off, dst);
508 + switch (code) {
509 + case BPF_ADD:
510 + emit(ctx, addu, MIPS_R_T8, MIPS_R_T9, src);
511 + break;
512 + case BPF_AND:
513 + emit(ctx, and, MIPS_R_T8, MIPS_R_T9, src);
514 + break;
515 + case BPF_OR:
516 + emit(ctx, or, MIPS_R_T8, MIPS_R_T9, src);
517 + break;
518 + case BPF_XOR:
519 + emit(ctx, xor, MIPS_R_T8, MIPS_R_T9, src);
520 + break;
521 + }
522 + emit(ctx, sc, MIPS_R_T8, off, dst);
523 + emit(ctx, beqz, MIPS_R_T8, -16);
524 + emit(ctx, nop); /* Delay slot */
525 +}
526 +
527 +/* Atomic compare-and-exchange (32-bit) */
528 +void emit_cmpxchg_r(struct jit_context *ctx, u8 dst, u8 src, u8 res, s16 off)
529 +{
530 + emit(ctx, ll, MIPS_R_T9, off, dst);
531 + emit(ctx, bne, MIPS_R_T9, res, 12);
532 + emit(ctx, move, MIPS_R_T8, src); /* Delay slot */
533 + emit(ctx, sc, MIPS_R_T8, off, dst);
534 + emit(ctx, beqz, MIPS_R_T8, -20);
535 + emit(ctx, move, res, MIPS_R_T9); /* Delay slot */
536 + clobber_reg(ctx, res);
537 +}
538 +
539 +/* Swap bytes and truncate a register word or half word */
540 +void emit_bswap_r(struct jit_context *ctx, u8 dst, u32 width)
541 +{
542 + u8 tmp = MIPS_R_T8;
543 + u8 msk = MIPS_R_T9;
544 +
545 + switch (width) {
546 + /* Swap bytes in a word */
547 + case 32:
548 + if (cpu_has_mips32r2 || cpu_has_mips32r6) {
549 + emit(ctx, wsbh, dst, dst);
550 + emit(ctx, rotr, dst, dst, 16);
551 + } else {
552 + emit(ctx, sll, tmp, dst, 16); /* tmp = dst << 16 */
553 + emit(ctx, srl, dst, dst, 16); /* dst = dst >> 16 */
554 + emit(ctx, or, dst, dst, tmp); /* dst = dst | tmp */
555 +
556 + emit(ctx, lui, msk, 0xff); /* msk = 0x00ff0000 */
557 + emit(ctx, ori, msk, msk, 0xff); /* msk = msk | 0xff */
558 +
559 + emit(ctx, and, tmp, dst, msk); /* tmp = dst & msk */
560 + emit(ctx, sll, tmp, tmp, 8); /* tmp = tmp << 8 */
561 + emit(ctx, srl, dst, dst, 8); /* dst = dst >> 8 */
562 + emit(ctx, and, dst, dst, msk); /* dst = dst & msk */
563 + emit(ctx, or, dst, dst, tmp); /* reg = dst | tmp */
564 + }
565 + break;
566 + /* Swap bytes in a half word */
567 + case 16:
568 + if (cpu_has_mips32r2 || cpu_has_mips32r6) {
569 + emit(ctx, wsbh, dst, dst);
570 + emit(ctx, andi, dst, dst, 0xffff);
571 + } else {
572 + emit(ctx, andi, tmp, dst, 0xff00); /* t = d & 0xff00 */
573 + emit(ctx, srl, tmp, tmp, 8); /* t = t >> 8 */
574 + emit(ctx, andi, dst, dst, 0x00ff); /* d = d & 0x00ff */
575 + emit(ctx, sll, dst, dst, 8); /* d = d << 8 */
576 + emit(ctx, or, dst, dst, tmp); /* d = d | t */
577 + }
578 + break;
579 + }
580 + clobber_reg(ctx, dst);
581 +}
582 +
583 +/* Validate jump immediate range */
584 +bool valid_jmp_i(u8 op, s32 imm)
585 +{
586 + switch (op) {
587 + case JIT_JNOP:
588 + /* Immediate value not used */
589 + return true;
590 + case BPF_JEQ:
591 + case BPF_JNE:
592 + /* No immediate operation */
593 + return false;
594 + case BPF_JSET:
595 + case JIT_JNSET:
596 + /* imm must be 16 bits unsigned */
597 + return imm >= 0 && imm <= 0xffff;
598 + case BPF_JGE:
599 + case BPF_JLT:
600 + case BPF_JSGE:
601 + case BPF_JSLT:
602 + /* imm must be 16 bits */
603 + return imm >= -0x8000 && imm <= 0x7fff;
604 + case BPF_JGT:
605 + case BPF_JLE:
606 + case BPF_JSGT:
607 + case BPF_JSLE:
608 + /* imm + 1 must be 16 bits */
609 + return imm >= -0x8001 && imm <= 0x7ffe;
610 + }
611 + return false;
612 +}
613 +
614 +/* Invert a conditional jump operation */
615 +static u8 invert_jmp(u8 op)
616 +{
617 + switch (op) {
618 + case BPF_JA: return JIT_JNOP;
619 + case BPF_JEQ: return BPF_JNE;
620 + case BPF_JNE: return BPF_JEQ;
621 + case BPF_JSET: return JIT_JNSET;
622 + case BPF_JGT: return BPF_JLE;
623 + case BPF_JGE: return BPF_JLT;
624 + case BPF_JLT: return BPF_JGE;
625 + case BPF_JLE: return BPF_JGT;
626 + case BPF_JSGT: return BPF_JSLE;
627 + case BPF_JSGE: return BPF_JSLT;
628 + case BPF_JSLT: return BPF_JSGE;
629 + case BPF_JSLE: return BPF_JSGT;
630 + }
631 + return 0;
632 +}
633 +
634 +/* Prepare a PC-relative jump operation */
635 +static void setup_jmp(struct jit_context *ctx, u8 bpf_op,
636 + s16 bpf_off, u8 *jit_op, s32 *jit_off)
637 +{
638 + u32 *descp = &ctx->descriptors[ctx->bpf_index];
639 + int op = bpf_op;
640 + int offset = 0;
641 +
642 + /* Do not compute offsets on the first pass */
643 + if (INDEX(*descp) == 0)
644 + goto done;
645 +
646 + /* Skip jumps never taken */
647 + if (bpf_op == JIT_JNOP)
648 + goto done;
649 +
650 + /* Convert jumps always taken */
651 + if (bpf_op == BPF_JA)
652 + *descp |= JIT_DESC_CONVERT;
653 +
654 + /*
655 + * Current ctx->jit_index points to the start of the branch preamble.
656 + * Since the preamble differs among different branch conditionals,
657 + * the current index cannot be used to compute the branch offset.
658 + * Instead, we use the offset table value for the next instruction,
659 + * which gives the index immediately after the branch delay slot.
660 + */
661 + if (!CONVERTED(*descp)) {
662 + int target = ctx->bpf_index + bpf_off + 1;
663 + int origin = ctx->bpf_index + 1;
664 +
665 + offset = (INDEX(ctx->descriptors[target]) -
666 + INDEX(ctx->descriptors[origin]) + 1) * sizeof(u32);
667 + }
668 +
669 + /*
670 + * The PC-relative branch offset field on MIPS is 18 bits signed,
671 + * so if the computed offset is larger than this we generate a an
672 + * absolute jump that we skip with an inverted conditional branch.
673 + */
674 + if (CONVERTED(*descp) || offset < -0x20000 || offset > 0x1ffff) {
675 + offset = 3 * sizeof(u32);
676 + op = invert_jmp(bpf_op);
677 + ctx->changes += !CONVERTED(*descp);
678 + *descp |= JIT_DESC_CONVERT;
679 + }
680 +
681 +done:
682 + *jit_off = offset;
683 + *jit_op = op;
684 +}
685 +
686 +/* Prepare a PC-relative jump operation with immediate conditional */
687 +void setup_jmp_i(struct jit_context *ctx, s32 imm, u8 width,
688 + u8 bpf_op, s16 bpf_off, u8 *jit_op, s32 *jit_off)
689 +{
690 + bool always = false;
691 + bool never = false;
692 +
693 + switch (bpf_op) {
694 + case BPF_JEQ:
695 + case BPF_JNE:
696 + break;
697 + case BPF_JSET:
698 + case BPF_JLT:
699 + never = imm == 0;
700 + break;
701 + case BPF_JGE:
702 + always = imm == 0;
703 + break;
704 + case BPF_JGT:
705 + never = (u32)imm == U32_MAX;
706 + break;
707 + case BPF_JLE:
708 + always = (u32)imm == U32_MAX;
709 + break;
710 + case BPF_JSGT:
711 + never = imm == S32_MAX && width == 32;
712 + break;
713 + case BPF_JSGE:
714 + always = imm == S32_MIN && width == 32;
715 + break;
716 + case BPF_JSLT:
717 + never = imm == S32_MIN && width == 32;
718 + break;
719 + case BPF_JSLE:
720 + always = imm == S32_MAX && width == 32;
721 + break;
722 + }
723 +
724 + if (never)
725 + bpf_op = JIT_JNOP;
726 + if (always)
727 + bpf_op = BPF_JA;
728 + setup_jmp(ctx, bpf_op, bpf_off, jit_op, jit_off);
729 +}
730 +
731 +/* Prepare a PC-relative jump operation with register conditional */
732 +void setup_jmp_r(struct jit_context *ctx, bool same_reg,
733 + u8 bpf_op, s16 bpf_off, u8 *jit_op, s32 *jit_off)
734 +{
735 + switch (bpf_op) {
736 + case BPF_JSET:
737 + break;
738 + case BPF_JEQ:
739 + case BPF_JGE:
740 + case BPF_JLE:
741 + case BPF_JSGE:
742 + case BPF_JSLE:
743 + if (same_reg)
744 + bpf_op = BPF_JA;
745 + break;
746 + case BPF_JNE:
747 + case BPF_JLT:
748 + case BPF_JGT:
749 + case BPF_JSGT:
750 + case BPF_JSLT:
751 + if (same_reg)
752 + bpf_op = JIT_JNOP;
753 + break;
754 + }
755 + setup_jmp(ctx, bpf_op, bpf_off, jit_op, jit_off);
756 +}
757 +
758 +/* Finish a PC-relative jump operation */
759 +int finish_jmp(struct jit_context *ctx, u8 jit_op, s16 bpf_off)
760 +{
761 + /* Emit conditional branch delay slot */
762 + if (jit_op != JIT_JNOP)
763 + emit(ctx, nop);
764 + /*
765 + * Emit an absolute long jump with delay slot,
766 + * if the PC-relative branch was converted.
767 + */
768 + if (CONVERTED(ctx->descriptors[ctx->bpf_index])) {
769 + int target = get_target(ctx, ctx->bpf_index + bpf_off + 1);
770 +
771 + if (target < 0)
772 + return -1;
773 + emit(ctx, j, target);
774 + emit(ctx, nop);
775 + }
776 + return 0;
777 +}
778 +
779 +/* Jump immediate (32-bit) */
780 +void emit_jmp_i(struct jit_context *ctx, u8 dst, s32 imm, s32 off, u8 op)
781 +{
782 + switch (op) {
783 + /* No-op, used internally for branch optimization */
784 + case JIT_JNOP:
785 + break;
786 + /* PC += off if dst & imm */
787 + case BPF_JSET:
788 + emit(ctx, andi, MIPS_R_T9, dst, (u16)imm);
789 + emit(ctx, bnez, MIPS_R_T9, off);
790 + break;
791 + /* PC += off if (dst & imm) == 0 (not in BPF, used for long jumps) */
792 + case JIT_JNSET:
793 + emit(ctx, andi, MIPS_R_T9, dst, (u16)imm);
794 + emit(ctx, beqz, MIPS_R_T9, off);
795 + break;
796 + /* PC += off if dst > imm */
797 + case BPF_JGT:
798 + emit(ctx, sltiu, MIPS_R_T9, dst, imm + 1);
799 + emit(ctx, beqz, MIPS_R_T9, off);
800 + break;
801 + /* PC += off if dst >= imm */
802 + case BPF_JGE:
803 + emit(ctx, sltiu, MIPS_R_T9, dst, imm);
804 + emit(ctx, beqz, MIPS_R_T9, off);
805 + break;
806 + /* PC += off if dst < imm */
807 + case BPF_JLT:
808 + emit(ctx, sltiu, MIPS_R_T9, dst, imm);
809 + emit(ctx, bnez, MIPS_R_T9, off);
810 + break;
811 + /* PC += off if dst <= imm */
812 + case BPF_JLE:
813 + emit(ctx, sltiu, MIPS_R_T9, dst, imm + 1);
814 + emit(ctx, bnez, MIPS_R_T9, off);
815 + break;
816 + /* PC += off if dst > imm (signed) */
817 + case BPF_JSGT:
818 + emit(ctx, slti, MIPS_R_T9, dst, imm + 1);
819 + emit(ctx, beqz, MIPS_R_T9, off);
820 + break;
821 + /* PC += off if dst >= imm (signed) */
822 + case BPF_JSGE:
823 + emit(ctx, slti, MIPS_R_T9, dst, imm);
824 + emit(ctx, beqz, MIPS_R_T9, off);
825 + break;
826 + /* PC += off if dst < imm (signed) */
827 + case BPF_JSLT:
828 + emit(ctx, slti, MIPS_R_T9, dst, imm);
829 + emit(ctx, bnez, MIPS_R_T9, off);
830 + break;
831 + /* PC += off if dst <= imm (signed) */
832 + case BPF_JSLE:
833 + emit(ctx, slti, MIPS_R_T9, dst, imm + 1);
834 + emit(ctx, bnez, MIPS_R_T9, off);
835 + break;
836 + }
837 +}
838 +
839 +/* Jump register (32-bit) */
840 +void emit_jmp_r(struct jit_context *ctx, u8 dst, u8 src, s32 off, u8 op)
841 +{
842 + switch (op) {
843 + /* No-op, used internally for branch optimization */
844 + case JIT_JNOP:
845 + break;
846 + /* PC += off if dst == src */
847 + case BPF_JEQ:
848 + emit(ctx, beq, dst, src, off);
849 + break;
850 + /* PC += off if dst != src */
851 + case BPF_JNE:
852 + emit(ctx, bne, dst, src, off);
853 + break;
854 + /* PC += off if dst & src */
855 + case BPF_JSET:
856 + emit(ctx, and, MIPS_R_T9, dst, src);
857 + emit(ctx, bnez, MIPS_R_T9, off);
858 + break;
859 + /* PC += off if (dst & imm) == 0 (not in BPF, used for long jumps) */
860 + case JIT_JNSET:
861 + emit(ctx, and, MIPS_R_T9, dst, src);
862 + emit(ctx, beqz, MIPS_R_T9, off);
863 + break;
864 + /* PC += off if dst > src */
865 + case BPF_JGT:
866 + emit(ctx, sltu, MIPS_R_T9, src, dst);
867 + emit(ctx, bnez, MIPS_R_T9, off);
868 + break;
869 + /* PC += off if dst >= src */
870 + case BPF_JGE:
871 + emit(ctx, sltu, MIPS_R_T9, dst, src);
872 + emit(ctx, beqz, MIPS_R_T9, off);
873 + break;
874 + /* PC += off if dst < src */
875 + case BPF_JLT:
876 + emit(ctx, sltu, MIPS_R_T9, dst, src);
877 + emit(ctx, bnez, MIPS_R_T9, off);
878 + break;
879 + /* PC += off if dst <= src */
880 + case BPF_JLE:
881 + emit(ctx, sltu, MIPS_R_T9, src, dst);
882 + emit(ctx, beqz, MIPS_R_T9, off);
883 + break;
884 + /* PC += off if dst > src (signed) */
885 + case BPF_JSGT:
886 + emit(ctx, slt, MIPS_R_T9, src, dst);
887 + emit(ctx, bnez, MIPS_R_T9, off);
888 + break;
889 + /* PC += off if dst >= src (signed) */
890 + case BPF_JSGE:
891 + emit(ctx, slt, MIPS_R_T9, dst, src);
892 + emit(ctx, beqz, MIPS_R_T9, off);
893 + break;
894 + /* PC += off if dst < src (signed) */
895 + case BPF_JSLT:
896 + emit(ctx, slt, MIPS_R_T9, dst, src);
897 + emit(ctx, bnez, MIPS_R_T9, off);
898 + break;
899 + /* PC += off if dst <= src (signed) */
900 + case BPF_JSLE:
901 + emit(ctx, slt, MIPS_R_T9, src, dst);
902 + emit(ctx, beqz, MIPS_R_T9, off);
903 + break;
904 + }
905 +}
906 +
907 +/* Jump always */
908 +int emit_ja(struct jit_context *ctx, s16 off)
909 +{
910 + int target = get_target(ctx, ctx->bpf_index + off + 1);
911 +
912 + if (target < 0)
913 + return -1;
914 + emit(ctx, j, target);
915 + emit(ctx, nop);
916 + return 0;
917 +}
918 +
919 +/* Jump to epilogue */
920 +int emit_exit(struct jit_context *ctx)
921 +{
922 + int target = get_target(ctx, ctx->program->len);
923 +
924 + if (target < 0)
925 + return -1;
926 + emit(ctx, j, target);
927 + emit(ctx, nop);
928 + return 0;
929 +}
930 +
931 +/* Build the program body from eBPF bytecode */
932 +static int build_body(struct jit_context *ctx)
933 +{
934 + const struct bpf_prog *prog = ctx->program;
935 + unsigned int i;
936 +
937 + ctx->stack_used = 0;
938 + for (i = 0; i < prog->len; i++) {
939 + const struct bpf_insn *insn = &prog->insnsi[i];
940 + u32 *descp = &ctx->descriptors[i];
941 + int ret;
942 +
943 + access_reg(ctx, insn->src_reg);
944 + access_reg(ctx, insn->dst_reg);
945 +
946 + ctx->bpf_index = i;
947 + if (ctx->target == NULL) {
948 + ctx->changes += INDEX(*descp) != ctx->jit_index;
949 + *descp &= JIT_DESC_CONVERT;
950 + *descp |= ctx->jit_index;
951 + }
952 +
953 + ret = build_insn(insn, ctx);
954 + if (ret < 0)
955 + return ret;
956 +
957 + if (ret > 0) {
958 + i++;
959 + if (ctx->target == NULL)
960 + descp[1] = ctx->jit_index;
961 + }
962 + }
963 +
964 + /* Store the end offset, where the epilogue begins */
965 + ctx->descriptors[prog->len] = ctx->jit_index;
966 + return 0;
967 +}
968 +
969 +/* Set the branch conversion flag on all instructions */
970 +static void set_convert_flag(struct jit_context *ctx, bool enable)
971 +{
972 + const struct bpf_prog *prog = ctx->program;
973 + u32 flag = enable ? JIT_DESC_CONVERT : 0;
974 + unsigned int i;
975 +
976 + for (i = 0; i <= prog->len; i++)
977 + ctx->descriptors[i] = INDEX(ctx->descriptors[i]) | flag;
978 +}
979 +
980 +static void jit_fill_hole(void *area, unsigned int size)
981 +{
982 + u32 *p;
983 +
984 + /* We are guaranteed to have aligned memory. */
985 + for (p = area; size >= sizeof(u32); size -= sizeof(u32))
986 + uasm_i_break(&p, BRK_BUG); /* Increments p */
987 +}
988 +
989 +bool bpf_jit_needs_zext(void)
990 +{
991 + return true;
992 +}
993 +
994 +struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
995 +{
996 + struct bpf_prog *tmp, *orig_prog = prog;
997 + struct bpf_binary_header *header = NULL;
998 + struct jit_context ctx;
999 + bool tmp_blinded = false;
1000 + unsigned int tmp_idx;
1001 + unsigned int image_size;
1002 + u8 *image_ptr;
1003 + int tries;
1004 +
1005 + /*
1006 + * If BPF JIT was not enabled then we must fall back to
1007 + * the interpreter.
1008 + */
1009 + if (!prog->jit_requested)
1010 + return orig_prog;
1011 + /*
1012 + * If constant blinding was enabled and we failed during blinding
1013 + * then we must fall back to the interpreter. Otherwise, we save
1014 + * the new JITed code.
1015 + */
1016 + tmp = bpf_jit_blind_constants(prog);
1017 + if (IS_ERR(tmp))
1018 + return orig_prog;
1019 + if (tmp != prog) {
1020 + tmp_blinded = true;
1021 + prog = tmp;
1022 + }
1023 +
1024 + memset(&ctx, 0, sizeof(ctx));
1025 + ctx.program = prog;
1026 +
1027 + /*
1028 + * Not able to allocate memory for descriptors[], then
1029 + * we must fall back to the interpreter
1030 + */
1031 + ctx.descriptors = kcalloc(prog->len + 1, sizeof(*ctx.descriptors),
1032 + GFP_KERNEL);
1033 + if (ctx.descriptors == NULL)
1034 + goto out_err;
1035 +
1036 + /* First pass discovers used resources */
1037 + if (build_body(&ctx) < 0)
1038 + goto out_err;
1039 + /*
1040 + * Second pass computes instruction offsets.
1041 + * If any PC-relative branches are out of range, a sequence of
1042 + * a PC-relative branch + a jump is generated, and we have to
1043 + * try again from the beginning to generate the new offsets.
1044 + * This is done until no additional conversions are necessary.
1045 + * The last two iterations are done with all branches being
1046 + * converted, to guarantee offset table convergence within a
1047 + * fixed number of iterations.
1048 + */
1049 + ctx.jit_index = 0;
1050 + build_prologue(&ctx);
1051 + tmp_idx = ctx.jit_index;
1052 +
1053 + tries = JIT_MAX_ITERATIONS;
1054 + do {
1055 + ctx.jit_index = tmp_idx;
1056 + ctx.changes = 0;
1057 + if (tries == 2)
1058 + set_convert_flag(&ctx, true);
1059 + if (build_body(&ctx) < 0)
1060 + goto out_err;
1061 + } while (ctx.changes > 0 && --tries > 0);
1062 +
1063 + if (WARN_ONCE(ctx.changes > 0, "JIT offsets failed to converge"))
1064 + goto out_err;
1065 +
1066 + build_epilogue(&ctx, MIPS_R_RA);
1067 +
1068 + /* Now we know the size of the structure to make */
1069 + image_size = sizeof(u32) * ctx.jit_index;
1070 + header = bpf_jit_binary_alloc(image_size, &image_ptr,
1071 + sizeof(u32), jit_fill_hole);
1072 + /*
1073 + * Not able to allocate memory for the structure then
1074 + * we must fall back to the interpretation
1075 + */
1076 + if (header == NULL)
1077 + goto out_err;
1078 +
1079 + /* Actual pass to generate final JIT code */
1080 + ctx.target = (u32 *)image_ptr;
1081 + ctx.jit_index = 0;
1082 +
1083 + /*
1084 + * If building the JITed code fails somehow,
1085 + * we fall back to the interpretation.
1086 + */
1087 + build_prologue(&ctx);
1088 + if (build_body(&ctx) < 0)
1089 + goto out_err;
1090 + build_epilogue(&ctx, MIPS_R_RA);
1091 +
1092 + /* Populate line info meta data */
1093 + set_convert_flag(&ctx, false);
1094 + bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]);
1095 +
1096 + /* Set as read-only exec and flush instruction cache */
1097 + bpf_jit_binary_lock_ro(header);
1098 + flush_icache_range((unsigned long)header,
1099 + (unsigned long)&ctx.target[ctx.jit_index]);
1100 +
1101 + if (bpf_jit_enable > 1)
1102 + bpf_jit_dump(prog->len, image_size, 2, ctx.target);
1103 +
1104 + prog->bpf_func = (void *)ctx.target;
1105 + prog->jited = 1;
1106 + prog->jited_len = image_size;
1107 +
1108 +out:
1109 + if (tmp_blinded)
1110 + bpf_jit_prog_release_other(prog, prog == orig_prog ?
1111 + tmp : orig_prog);
1112 + kfree(ctx.descriptors);
1113 + return prog;
1114 +
1115 +out_err:
1116 + prog = orig_prog;
1117 + if (header)
1118 + bpf_jit_binary_free(header);
1119 + goto out;
1120 +}
1121 --- /dev/null
1122 +++ b/arch/mips/net/bpf_jit_comp.h
1123 @@ -0,0 +1,211 @@
1124 +/* SPDX-License-Identifier: GPL-2.0-only */
1125 +/*
1126 + * Just-In-Time compiler for eBPF bytecode on 32-bit and 64-bit MIPS.
1127 + *
1128 + * Copyright (c) 2021 Anyfi Networks AB.
1129 + * Author: Johan Almbladh <johan.almbladh@gmail.com>
1130 + *
1131 + * Based on code and ideas from
1132 + * Copyright (c) 2017 Cavium, Inc.
1133 + * Copyright (c) 2017 Shubham Bansal <illusionist.neo@gmail.com>
1134 + * Copyright (c) 2011 Mircea Gherzan <mgherzan@gmail.com>
1135 + */
1136 +
1137 +#ifndef _BPF_JIT_COMP_H
1138 +#define _BPF_JIT_COMP_H
1139 +
1140 +/* MIPS registers */
1141 +#define MIPS_R_ZERO 0 /* Const zero */
1142 +#define MIPS_R_AT 1 /* Asm temp */
1143 +#define MIPS_R_V0 2 /* Result */
1144 +#define MIPS_R_V1 3 /* Result */
1145 +#define MIPS_R_A0 4 /* Argument */
1146 +#define MIPS_R_A1 5 /* Argument */
1147 +#define MIPS_R_A2 6 /* Argument */
1148 +#define MIPS_R_A3 7 /* Argument */
1149 +#define MIPS_R_A4 8 /* Arg (n64) */
1150 +#define MIPS_R_A5 9 /* Arg (n64) */
1151 +#define MIPS_R_A6 10 /* Arg (n64) */
1152 +#define MIPS_R_A7 11 /* Arg (n64) */
1153 +#define MIPS_R_T0 8 /* Temp (o32) */
1154 +#define MIPS_R_T1 9 /* Temp (o32) */
1155 +#define MIPS_R_T2 10 /* Temp (o32) */
1156 +#define MIPS_R_T3 11 /* Temp (o32) */
1157 +#define MIPS_R_T4 12 /* Temporary */
1158 +#define MIPS_R_T5 13 /* Temporary */
1159 +#define MIPS_R_T6 14 /* Temporary */
1160 +#define MIPS_R_T7 15 /* Temporary */
1161 +#define MIPS_R_S0 16 /* Saved */
1162 +#define MIPS_R_S1 17 /* Saved */
1163 +#define MIPS_R_S2 18 /* Saved */
1164 +#define MIPS_R_S3 19 /* Saved */
1165 +#define MIPS_R_S4 20 /* Saved */
1166 +#define MIPS_R_S5 21 /* Saved */
1167 +#define MIPS_R_S6 22 /* Saved */
1168 +#define MIPS_R_S7 23 /* Saved */
1169 +#define MIPS_R_T8 24 /* Temporary */
1170 +#define MIPS_R_T9 25 /* Temporary */
1171 +/* MIPS_R_K0 26 Reserved */
1172 +/* MIPS_R_K1 27 Reserved */
1173 +#define MIPS_R_GP 28 /* Global ptr */
1174 +#define MIPS_R_SP 29 /* Stack ptr */
1175 +#define MIPS_R_FP 30 /* Frame ptr */
1176 +#define MIPS_R_RA 31 /* Return */
1177 +
1178 +/*
1179 + * Jump address mask for immediate jumps. The four most significant bits
1180 + * must be equal to PC.
1181 + */
1182 +#define MIPS_JMP_MASK 0x0fffffffUL
1183 +
1184 +/* Maximum number of iterations in offset table computation */
1185 +#define JIT_MAX_ITERATIONS 8
1186 +
1187 +/*
1188 + * Jump pseudo-instructions used internally
1189 + * for branch conversion and branch optimization.
1190 + */
1191 +#define JIT_JNSET 0xe0
1192 +#define JIT_JNOP 0xf0
1193 +
1194 +/* Descriptor flag for PC-relative branch conversion */
1195 +#define JIT_DESC_CONVERT BIT(31)
1196 +
1197 +/* JIT context for an eBPF program */
1198 +struct jit_context {
1199 + struct bpf_prog *program; /* The eBPF program being JITed */
1200 + u32 *descriptors; /* eBPF to JITed CPU insn descriptors */
1201 + u32 *target; /* JITed code buffer */
1202 + u32 bpf_index; /* Index of current BPF program insn */
1203 + u32 jit_index; /* Index of current JIT target insn */
1204 + u32 changes; /* Number of PC-relative branch conv */
1205 + u32 accessed; /* Bit mask of read eBPF registers */
1206 + u32 clobbered; /* Bit mask of modified CPU registers */
1207 + u32 stack_size; /* Total allocated stack size in bytes */
1208 + u32 saved_size; /* Size of callee-saved registers */
1209 + u32 stack_used; /* Stack size used for function calls */
1210 +};
1211 +
1212 +/* Emit the instruction if the JIT memory space has been allocated */
1213 +#define emit(ctx, func, ...) \
1214 +do { \
1215 + if ((ctx)->target != NULL) { \
1216 + u32 *p = &(ctx)->target[ctx->jit_index]; \
1217 + uasm_i_##func(&p, ##__VA_ARGS__); \
1218 + } \
1219 + (ctx)->jit_index++; \
1220 +} while (0)
1221 +
1222 +/*
1223 + * Mark a BPF register as accessed, it needs to be
1224 + * initialized by the program if expected, e.g. FP.
1225 + */
1226 +static inline void access_reg(struct jit_context *ctx, u8 reg)
1227 +{
1228 + ctx->accessed |= BIT(reg);
1229 +}
1230 +
1231 +/*
1232 + * Mark a CPU register as clobbered, it needs to be
1233 + * saved/restored by the program if callee-saved.
1234 + */
1235 +static inline void clobber_reg(struct jit_context *ctx, u8 reg)
1236 +{
1237 + ctx->clobbered |= BIT(reg);
1238 +}
1239 +
1240 +/*
1241 + * Push registers on the stack, starting at a given depth from the stack
1242 + * pointer and increasing. The next depth to be written is returned.
1243 + */
1244 +int push_regs(struct jit_context *ctx, u32 mask, u32 excl, int depth);
1245 +
1246 +/*
1247 + * Pop registers from the stack, starting at a given depth from the stack
1248 + * pointer and increasing. The next depth to be read is returned.
1249 + */
1250 +int pop_regs(struct jit_context *ctx, u32 mask, u32 excl, int depth);
1251 +
1252 +/* Compute the 28-bit jump target address from a BPF program location */
1253 +int get_target(struct jit_context *ctx, u32 loc);
1254 +
1255 +/* Compute the PC-relative offset to relative BPF program offset */
1256 +int get_offset(const struct jit_context *ctx, int off);
1257 +
1258 +/* dst = imm (32-bit) */
1259 +void emit_mov_i(struct jit_context *ctx, u8 dst, s32 imm);
1260 +
1261 +/* dst = src (32-bit) */
1262 +void emit_mov_r(struct jit_context *ctx, u8 dst, u8 src);
1263 +
1264 +/* Validate ALU/ALU64 immediate range */
1265 +bool valid_alu_i(u8 op, s32 imm);
1266 +
1267 +/* Rewrite ALU/ALU64 immediate operation */
1268 +bool rewrite_alu_i(u8 op, s32 imm, u8 *alu, s32 *val);
1269 +
1270 +/* ALU immediate operation (32-bit) */
1271 +void emit_alu_i(struct jit_context *ctx, u8 dst, s32 imm, u8 op);
1272 +
1273 +/* ALU register operation (32-bit) */
1274 +void emit_alu_r(struct jit_context *ctx, u8 dst, u8 src, u8 op);
1275 +
1276 +/* Atomic read-modify-write (32-bit) */
1277 +void emit_atomic_r(struct jit_context *ctx, u8 dst, u8 src, s16 off, u8 code);
1278 +
1279 +/* Atomic compare-and-exchange (32-bit) */
1280 +void emit_cmpxchg_r(struct jit_context *ctx, u8 dst, u8 src, u8 res, s16 off);
1281 +
1282 +/* Swap bytes and truncate a register word or half word */
1283 +void emit_bswap_r(struct jit_context *ctx, u8 dst, u32 width);
1284 +
1285 +/* Validate JMP/JMP32 immediate range */
1286 +bool valid_jmp_i(u8 op, s32 imm);
1287 +
1288 +/* Prepare a PC-relative jump operation with immediate conditional */
1289 +void setup_jmp_i(struct jit_context *ctx, s32 imm, u8 width,
1290 + u8 bpf_op, s16 bpf_off, u8 *jit_op, s32 *jit_off);
1291 +
1292 +/* Prepare a PC-relative jump operation with register conditional */
1293 +void setup_jmp_r(struct jit_context *ctx, bool same_reg,
1294 + u8 bpf_op, s16 bpf_off, u8 *jit_op, s32 *jit_off);
1295 +
1296 +/* Finish a PC-relative jump operation */
1297 +int finish_jmp(struct jit_context *ctx, u8 jit_op, s16 bpf_off);
1298 +
1299 +/* Conditional JMP/JMP32 immediate */
1300 +void emit_jmp_i(struct jit_context *ctx, u8 dst, s32 imm, s32 off, u8 op);
1301 +
1302 +/* Conditional JMP/JMP32 register */
1303 +void emit_jmp_r(struct jit_context *ctx, u8 dst, u8 src, s32 off, u8 op);
1304 +
1305 +/* Jump always */
1306 +int emit_ja(struct jit_context *ctx, s16 off);
1307 +
1308 +/* Jump to epilogue */
1309 +int emit_exit(struct jit_context *ctx);
1310 +
1311 +/*
1312 + * Build program prologue to set up the stack and registers.
1313 + * This function is implemented separately for 32-bit and 64-bit JITs.
1314 + */
1315 +void build_prologue(struct jit_context *ctx);
1316 +
1317 +/*
1318 + * Build the program epilogue to restore the stack and registers.
1319 + * This function is implemented separately for 32-bit and 64-bit JITs.
1320 + */
1321 +void build_epilogue(struct jit_context *ctx, int dest_reg);
1322 +
1323 +/*
1324 + * Convert an eBPF instruction to native instruction, i.e
1325 + * JITs an eBPF instruction.
1326 + * Returns :
1327 + * 0 - Successfully JITed an 8-byte eBPF instruction
1328 + * >0 - Successfully JITed a 16-byte eBPF instruction
1329 + * <0 - Failed to JIT.
1330 + * This function is implemented separately for 32-bit and 64-bit JITs.
1331 + */
1332 +int build_insn(const struct bpf_insn *insn, struct jit_context *ctx);
1333 +
1334 +#endif /* _BPF_JIT_COMP_H */
1335 --- /dev/null
1336 +++ b/arch/mips/net/bpf_jit_comp32.c
1337 @@ -0,0 +1,1741 @@
1338 +// SPDX-License-Identifier: GPL-2.0-only
1339 +/*
1340 + * Just-In-Time compiler for eBPF bytecode on MIPS.
1341 + * Implementation of JIT functions for 32-bit CPUs.
1342 + *
1343 + * Copyright (c) 2021 Anyfi Networks AB.
1344 + * Author: Johan Almbladh <johan.almbladh@gmail.com>
1345 + *
1346 + * Based on code and ideas from
1347 + * Copyright (c) 2017 Cavium, Inc.
1348 + * Copyright (c) 2017 Shubham Bansal <illusionist.neo@gmail.com>
1349 + * Copyright (c) 2011 Mircea Gherzan <mgherzan@gmail.com>
1350 + */
1351 +
1352 +#include <linux/math64.h>
1353 +#include <linux/errno.h>
1354 +#include <linux/filter.h>
1355 +#include <linux/bpf.h>
1356 +#include <asm/cpu-features.h>
1357 +#include <asm/isa-rev.h>
1358 +#include <asm/uasm.h>
1359 +
1360 +#include "bpf_jit_comp.h"
1361 +
1362 +/* MIPS a4-a7 are not available in the o32 ABI */
1363 +#undef MIPS_R_A4
1364 +#undef MIPS_R_A5
1365 +#undef MIPS_R_A6
1366 +#undef MIPS_R_A7
1367 +
1368 +/* Stack is 8-byte aligned in o32 ABI */
1369 +#define MIPS_STACK_ALIGNMENT 8
1370 +
1371 +/*
1372 + * The top 16 bytes of a stack frame is reserved for the callee in O32 ABI.
1373 + * This corresponds to stack space for register arguments a0-a3.
1374 + */
1375 +#define JIT_RESERVED_STACK 16
1376 +
1377 +/* Temporary 64-bit register used by JIT */
1378 +#define JIT_REG_TMP MAX_BPF_JIT_REG
1379 +
1380 +/*
1381 + * Number of prologue bytes to skip when doing a tail call.
1382 + * Tail call count (TCC) initialization (8 bytes) always, plus
1383 + * R0-to-v0 assignment (4 bytes) if big endian.
1384 + */
1385 +#ifdef __BIG_ENDIAN
1386 +#define JIT_TCALL_SKIP 12
1387 +#else
1388 +#define JIT_TCALL_SKIP 8
1389 +#endif
1390 +
1391 +/* CPU registers holding the callee return value */
1392 +#define JIT_RETURN_REGS \
1393 + (BIT(MIPS_R_V0) | \
1394 + BIT(MIPS_R_V1))
1395 +
1396 +/* CPU registers arguments passed to callee directly */
1397 +#define JIT_ARG_REGS \
1398 + (BIT(MIPS_R_A0) | \
1399 + BIT(MIPS_R_A1) | \
1400 + BIT(MIPS_R_A2) | \
1401 + BIT(MIPS_R_A3))
1402 +
1403 +/* CPU register arguments passed to callee on stack */
1404 +#define JIT_STACK_REGS \
1405 + (BIT(MIPS_R_T0) | \
1406 + BIT(MIPS_R_T1) | \
1407 + BIT(MIPS_R_T2) | \
1408 + BIT(MIPS_R_T3) | \
1409 + BIT(MIPS_R_T4) | \
1410 + BIT(MIPS_R_T5))
1411 +
1412 +/* Caller-saved CPU registers */
1413 +#define JIT_CALLER_REGS \
1414 + (JIT_RETURN_REGS | \
1415 + JIT_ARG_REGS | \
1416 + JIT_STACK_REGS)
1417 +
1418 +/* Callee-saved CPU registers */
1419 +#define JIT_CALLEE_REGS \
1420 + (BIT(MIPS_R_S0) | \
1421 + BIT(MIPS_R_S1) | \
1422 + BIT(MIPS_R_S2) | \
1423 + BIT(MIPS_R_S3) | \
1424 + BIT(MIPS_R_S4) | \
1425 + BIT(MIPS_R_S5) | \
1426 + BIT(MIPS_R_S6) | \
1427 + BIT(MIPS_R_S7) | \
1428 + BIT(MIPS_R_GP) | \
1429 + BIT(MIPS_R_FP) | \
1430 + BIT(MIPS_R_RA))
1431 +
1432 +/*
1433 + * Mapping of 64-bit eBPF registers to 32-bit native MIPS registers.
1434 + *
1435 + * 1) Native register pairs are ordered according to CPU endiannes, following
1436 + * the MIPS convention for passing 64-bit arguments and return values.
1437 + * 2) The eBPF return value, arguments and callee-saved registers are mapped
1438 + * to their native MIPS equivalents.
1439 + * 3) Since the 32 highest bits in the eBPF FP register are always zero,
1440 + * only one general-purpose register is actually needed for the mapping.
1441 + * We use the fp register for this purpose, and map the highest bits to
1442 + * the MIPS register r0 (zero).
1443 + * 4) We use the MIPS gp and at registers as internal temporary registers
1444 + * for constant blinding. The gp register is callee-saved.
1445 + * 5) One 64-bit temporary register is mapped for use when sign-extending
1446 + * immediate operands. MIPS registers t6-t9 are available to the JIT
1447 + * for as temporaries when implementing complex 64-bit operations.
1448 + *
1449 + * With this scheme all eBPF registers are being mapped to native MIPS
1450 + * registers without having to use any stack scratch space. The direct
1451 + * register mapping (2) simplifies the handling of function calls.
1452 + */
1453 +static const u8 bpf2mips32[][2] = {
1454 + /* Return value from in-kernel function, and exit value from eBPF */
1455 + [BPF_REG_0] = {MIPS_R_V1, MIPS_R_V0},
1456 + /* Arguments from eBPF program to in-kernel function */
1457 + [BPF_REG_1] = {MIPS_R_A1, MIPS_R_A0},
1458 + [BPF_REG_2] = {MIPS_R_A3, MIPS_R_A2},
1459 + /* Remaining arguments, to be passed on the stack per O32 ABI */
1460 + [BPF_REG_3] = {MIPS_R_T1, MIPS_R_T0},
1461 + [BPF_REG_4] = {MIPS_R_T3, MIPS_R_T2},
1462 + [BPF_REG_5] = {MIPS_R_T5, MIPS_R_T4},
1463 + /* Callee-saved registers that in-kernel function will preserve */
1464 + [BPF_REG_6] = {MIPS_R_S1, MIPS_R_S0},
1465 + [BPF_REG_7] = {MIPS_R_S3, MIPS_R_S2},
1466 + [BPF_REG_8] = {MIPS_R_S5, MIPS_R_S4},
1467 + [BPF_REG_9] = {MIPS_R_S7, MIPS_R_S6},
1468 + /* Read-only frame pointer to access the eBPF stack */
1469 +#ifdef __BIG_ENDIAN
1470 + [BPF_REG_FP] = {MIPS_R_FP, MIPS_R_ZERO},
1471 +#else
1472 + [BPF_REG_FP] = {MIPS_R_ZERO, MIPS_R_FP},
1473 +#endif
1474 + /* Temporary register for blinding constants */
1475 + [BPF_REG_AX] = {MIPS_R_GP, MIPS_R_AT},
1476 + /* Temporary register for internal JIT use */
1477 + [JIT_REG_TMP] = {MIPS_R_T7, MIPS_R_T6},
1478 +};
1479 +
1480 +/* Get low CPU register for a 64-bit eBPF register mapping */
1481 +static inline u8 lo(const u8 reg[])
1482 +{
1483 +#ifdef __BIG_ENDIAN
1484 + return reg[0];
1485 +#else
1486 + return reg[1];
1487 +#endif
1488 +}
1489 +
1490 +/* Get high CPU register for a 64-bit eBPF register mapping */
1491 +static inline u8 hi(const u8 reg[])
1492 +{
1493 +#ifdef __BIG_ENDIAN
1494 + return reg[1];
1495 +#else
1496 + return reg[0];
1497 +#endif
1498 +}
1499 +
1500 +/*
1501 + * Mark a 64-bit CPU register pair as clobbered, it needs to be
1502 + * saved/restored by the program if callee-saved.
1503 + */
1504 +static void clobber_reg64(struct jit_context *ctx, const u8 reg[])
1505 +{
1506 + clobber_reg(ctx, reg[0]);
1507 + clobber_reg(ctx, reg[1]);
1508 +}
1509 +
1510 +/* dst = imm (sign-extended) */
1511 +static void emit_mov_se_i64(struct jit_context *ctx, const u8 dst[], s32 imm)
1512 +{
1513 + emit_mov_i(ctx, lo(dst), imm);
1514 + if (imm < 0)
1515 + emit(ctx, addiu, hi(dst), MIPS_R_ZERO, -1);
1516 + else
1517 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1518 + clobber_reg64(ctx, dst);
1519 +}
1520 +
1521 +/* Zero extension, if verifier does not do it for us */
1522 +static void emit_zext_ver(struct jit_context *ctx, const u8 dst[])
1523 +{
1524 + if (!ctx->program->aux->verifier_zext) {
1525 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1526 + clobber_reg(ctx, hi(dst));
1527 + }
1528 +}
1529 +
1530 +/* Load delay slot, if ISA mandates it */
1531 +static void emit_load_delay(struct jit_context *ctx)
1532 +{
1533 + if (!cpu_has_mips_2_3_4_5_r)
1534 + emit(ctx, nop);
1535 +}
1536 +
1537 +/* ALU immediate operation (64-bit) */
1538 +static void emit_alu_i64(struct jit_context *ctx,
1539 + const u8 dst[], s32 imm, u8 op)
1540 +{
1541 + u8 src = MIPS_R_T6;
1542 +
1543 + /*
1544 + * ADD/SUB with all but the max negative imm can be handled by
1545 + * inverting the operation and the imm value, saving one insn.
1546 + */
1547 + if (imm > S32_MIN && imm < 0)
1548 + switch (op) {
1549 + case BPF_ADD:
1550 + op = BPF_SUB;
1551 + imm = -imm;
1552 + break;
1553 + case BPF_SUB:
1554 + op = BPF_ADD;
1555 + imm = -imm;
1556 + break;
1557 + }
1558 +
1559 + /* Move immediate to temporary register */
1560 + emit_mov_i(ctx, src, imm);
1561 +
1562 + switch (op) {
1563 + /* dst = dst + imm */
1564 + case BPF_ADD:
1565 + emit(ctx, addu, lo(dst), lo(dst), src);
1566 + emit(ctx, sltu, MIPS_R_T9, lo(dst), src);
1567 + emit(ctx, addu, hi(dst), hi(dst), MIPS_R_T9);
1568 + if (imm < 0)
1569 + emit(ctx, addiu, hi(dst), hi(dst), -1);
1570 + break;
1571 + /* dst = dst - imm */
1572 + case BPF_SUB:
1573 + emit(ctx, sltu, MIPS_R_T9, lo(dst), src);
1574 + emit(ctx, subu, lo(dst), lo(dst), src);
1575 + emit(ctx, subu, hi(dst), hi(dst), MIPS_R_T9);
1576 + if (imm < 0)
1577 + emit(ctx, addiu, hi(dst), hi(dst), 1);
1578 + break;
1579 + /* dst = dst | imm */
1580 + case BPF_OR:
1581 + emit(ctx, or, lo(dst), lo(dst), src);
1582 + if (imm < 0)
1583 + emit(ctx, addiu, hi(dst), MIPS_R_ZERO, -1);
1584 + break;
1585 + /* dst = dst & imm */
1586 + case BPF_AND:
1587 + emit(ctx, and, lo(dst), lo(dst), src);
1588 + if (imm >= 0)
1589 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1590 + break;
1591 + /* dst = dst ^ imm */
1592 + case BPF_XOR:
1593 + emit(ctx, xor, lo(dst), lo(dst), src);
1594 + if (imm < 0) {
1595 + emit(ctx, subu, hi(dst), MIPS_R_ZERO, hi(dst));
1596 + emit(ctx, addiu, hi(dst), hi(dst), -1);
1597 + }
1598 + break;
1599 + }
1600 + clobber_reg64(ctx, dst);
1601 +}
1602 +
1603 +/* ALU register operation (64-bit) */
1604 +static void emit_alu_r64(struct jit_context *ctx,
1605 + const u8 dst[], const u8 src[], u8 op)
1606 +{
1607 + switch (BPF_OP(op)) {
1608 + /* dst = dst + src */
1609 + case BPF_ADD:
1610 + if (src == dst) {
1611 + emit(ctx, srl, MIPS_R_T9, lo(dst), 31);
1612 + emit(ctx, addu, lo(dst), lo(dst), lo(dst));
1613 + } else {
1614 + emit(ctx, addu, lo(dst), lo(dst), lo(src));
1615 + emit(ctx, sltu, MIPS_R_T9, lo(dst), lo(src));
1616 + }
1617 + emit(ctx, addu, hi(dst), hi(dst), hi(src));
1618 + emit(ctx, addu, hi(dst), hi(dst), MIPS_R_T9);
1619 + break;
1620 + /* dst = dst - src */
1621 + case BPF_SUB:
1622 + emit(ctx, sltu, MIPS_R_T9, lo(dst), lo(src));
1623 + emit(ctx, subu, lo(dst), lo(dst), lo(src));
1624 + emit(ctx, subu, hi(dst), hi(dst), hi(src));
1625 + emit(ctx, subu, hi(dst), hi(dst), MIPS_R_T9);
1626 + break;
1627 + /* dst = dst | src */
1628 + case BPF_OR:
1629 + emit(ctx, or, lo(dst), lo(dst), lo(src));
1630 + emit(ctx, or, hi(dst), hi(dst), hi(src));
1631 + break;
1632 + /* dst = dst & src */
1633 + case BPF_AND:
1634 + emit(ctx, and, lo(dst), lo(dst), lo(src));
1635 + emit(ctx, and, hi(dst), hi(dst), hi(src));
1636 + break;
1637 + /* dst = dst ^ src */
1638 + case BPF_XOR:
1639 + emit(ctx, xor, lo(dst), lo(dst), lo(src));
1640 + emit(ctx, xor, hi(dst), hi(dst), hi(src));
1641 + break;
1642 + }
1643 + clobber_reg64(ctx, dst);
1644 +}
1645 +
1646 +/* ALU invert (64-bit) */
1647 +static void emit_neg_i64(struct jit_context *ctx, const u8 dst[])
1648 +{
1649 + emit(ctx, sltu, MIPS_R_T9, MIPS_R_ZERO, lo(dst));
1650 + emit(ctx, subu, lo(dst), MIPS_R_ZERO, lo(dst));
1651 + emit(ctx, subu, hi(dst), MIPS_R_ZERO, hi(dst));
1652 + emit(ctx, subu, hi(dst), hi(dst), MIPS_R_T9);
1653 +
1654 + clobber_reg64(ctx, dst);
1655 +}
1656 +
1657 +/* ALU shift immediate (64-bit) */
1658 +static void emit_shift_i64(struct jit_context *ctx,
1659 + const u8 dst[], u32 imm, u8 op)
1660 +{
1661 + switch (BPF_OP(op)) {
1662 + /* dst = dst << imm */
1663 + case BPF_LSH:
1664 + if (imm < 32) {
1665 + emit(ctx, srl, MIPS_R_T9, lo(dst), 32 - imm);
1666 + emit(ctx, sll, lo(dst), lo(dst), imm);
1667 + emit(ctx, sll, hi(dst), hi(dst), imm);
1668 + emit(ctx, or, hi(dst), hi(dst), MIPS_R_T9);
1669 + } else {
1670 + emit(ctx, sll, hi(dst), lo(dst), imm - 32);
1671 + emit(ctx, move, lo(dst), MIPS_R_ZERO);
1672 + }
1673 + break;
1674 + /* dst = dst >> imm */
1675 + case BPF_RSH:
1676 + if (imm < 32) {
1677 + emit(ctx, sll, MIPS_R_T9, hi(dst), 32 - imm);
1678 + emit(ctx, srl, lo(dst), lo(dst), imm);
1679 + emit(ctx, srl, hi(dst), hi(dst), imm);
1680 + emit(ctx, or, lo(dst), lo(dst), MIPS_R_T9);
1681 + } else {
1682 + emit(ctx, srl, lo(dst), hi(dst), imm - 32);
1683 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1684 + }
1685 + break;
1686 + /* dst = dst >> imm (arithmetic) */
1687 + case BPF_ARSH:
1688 + if (imm < 32) {
1689 + emit(ctx, sll, MIPS_R_T9, hi(dst), 32 - imm);
1690 + emit(ctx, srl, lo(dst), lo(dst), imm);
1691 + emit(ctx, sra, hi(dst), hi(dst), imm);
1692 + emit(ctx, or, lo(dst), lo(dst), MIPS_R_T9);
1693 + } else {
1694 + emit(ctx, sra, lo(dst), hi(dst), imm - 32);
1695 + emit(ctx, sra, hi(dst), hi(dst), 31);
1696 + }
1697 + break;
1698 + }
1699 + clobber_reg64(ctx, dst);
1700 +}
1701 +
1702 +/* ALU shift register (64-bit) */
1703 +static void emit_shift_r64(struct jit_context *ctx,
1704 + const u8 dst[], u8 src, u8 op)
1705 +{
1706 + u8 t1 = MIPS_R_T8;
1707 + u8 t2 = MIPS_R_T9;
1708 +
1709 + emit(ctx, andi, t1, src, 32); /* t1 = src & 32 */
1710 + emit(ctx, beqz, t1, 16); /* PC += 16 if t1 == 0 */
1711 + emit(ctx, nor, t2, src, MIPS_R_ZERO); /* t2 = ~src (delay slot) */
1712 +
1713 + switch (BPF_OP(op)) {
1714 + /* dst = dst << src */
1715 + case BPF_LSH:
1716 + /* Next: shift >= 32 */
1717 + emit(ctx, sllv, hi(dst), lo(dst), src); /* dh = dl << src */
1718 + emit(ctx, move, lo(dst), MIPS_R_ZERO); /* dl = 0 */
1719 + emit(ctx, b, 20); /* PC += 20 */
1720 + /* +16: shift < 32 */
1721 + emit(ctx, srl, t1, lo(dst), 1); /* t1 = dl >> 1 */
1722 + emit(ctx, srlv, t1, t1, t2); /* t1 = t1 >> t2 */
1723 + emit(ctx, sllv, lo(dst), lo(dst), src); /* dl = dl << src */
1724 + emit(ctx, sllv, hi(dst), hi(dst), src); /* dh = dh << src */
1725 + emit(ctx, or, hi(dst), hi(dst), t1); /* dh = dh | t1 */
1726 + break;
1727 + /* dst = dst >> src */
1728 + case BPF_RSH:
1729 + /* Next: shift >= 32 */
1730 + emit(ctx, srlv, lo(dst), hi(dst), src); /* dl = dh >> src */
1731 + emit(ctx, move, hi(dst), MIPS_R_ZERO); /* dh = 0 */
1732 + emit(ctx, b, 20); /* PC += 20 */
1733 + /* +16: shift < 32 */
1734 + emit(ctx, sll, t1, hi(dst), 1); /* t1 = dl << 1 */
1735 + emit(ctx, sllv, t1, t1, t2); /* t1 = t1 << t2 */
1736 + emit(ctx, srlv, lo(dst), lo(dst), src); /* dl = dl >> src */
1737 + emit(ctx, srlv, hi(dst), hi(dst), src); /* dh = dh >> src */
1738 + emit(ctx, or, lo(dst), lo(dst), t1); /* dl = dl | t1 */
1739 + break;
1740 + /* dst = dst >> src (arithmetic) */
1741 + case BPF_ARSH:
1742 + /* Next: shift >= 32 */
1743 + emit(ctx, srav, lo(dst), hi(dst), src); /* dl = dh >>a src */
1744 + emit(ctx, sra, hi(dst), hi(dst), 31); /* dh = dh >>a 31 */
1745 + emit(ctx, b, 20); /* PC += 20 */
1746 + /* +16: shift < 32 */
1747 + emit(ctx, sll, t1, hi(dst), 1); /* t1 = dl << 1 */
1748 + emit(ctx, sllv, t1, t1, t2); /* t1 = t1 << t2 */
1749 + emit(ctx, srlv, lo(dst), lo(dst), src); /* dl = dl >>a src */
1750 + emit(ctx, srav, hi(dst), hi(dst), src); /* dh = dh >> src */
1751 + emit(ctx, or, lo(dst), lo(dst), t1); /* dl = dl | t1 */
1752 + break;
1753 + }
1754 +
1755 + /* +20: Done */
1756 + clobber_reg64(ctx, dst);
1757 +}
1758 +
1759 +/* ALU mul immediate (64x32-bit) */
1760 +static void emit_mul_i64(struct jit_context *ctx, const u8 dst[], s32 imm)
1761 +{
1762 + u8 src = MIPS_R_T6;
1763 + u8 tmp = MIPS_R_T9;
1764 +
1765 + switch (imm) {
1766 + /* dst = dst * 1 is a no-op */
1767 + case 1:
1768 + break;
1769 + /* dst = dst * -1 */
1770 + case -1:
1771 + emit_neg_i64(ctx, dst);
1772 + break;
1773 + case 0:
1774 + emit_mov_r(ctx, lo(dst), MIPS_R_ZERO);
1775 + emit_mov_r(ctx, hi(dst), MIPS_R_ZERO);
1776 + break;
1777 + /* Full 64x32 multiply */
1778 + default:
1779 + /* hi(dst) = hi(dst) * src(imm) */
1780 + emit_mov_i(ctx, src, imm);
1781 + if (cpu_has_mips32r1 || cpu_has_mips32r6) {
1782 + emit(ctx, mul, hi(dst), hi(dst), src);
1783 + } else {
1784 + emit(ctx, multu, hi(dst), src);
1785 + emit(ctx, mflo, hi(dst));
1786 + }
1787 +
1788 + /* hi(dst) = hi(dst) - lo(dst) */
1789 + if (imm < 0)
1790 + emit(ctx, subu, hi(dst), hi(dst), lo(dst));
1791 +
1792 + /* tmp = lo(dst) * src(imm) >> 32 */
1793 + /* lo(dst) = lo(dst) * src(imm) */
1794 + if (cpu_has_mips32r6) {
1795 + emit(ctx, muhu, tmp, lo(dst), src);
1796 + emit(ctx, mulu, lo(dst), lo(dst), src);
1797 + } else {
1798 + emit(ctx, multu, lo(dst), src);
1799 + emit(ctx, mflo, lo(dst));
1800 + emit(ctx, mfhi, tmp);
1801 + }
1802 +
1803 + /* hi(dst) += tmp */
1804 + emit(ctx, addu, hi(dst), hi(dst), tmp);
1805 + clobber_reg64(ctx, dst);
1806 + break;
1807 + }
1808 +}
1809 +
1810 +/* ALU mul register (64x64-bit) */
1811 +static void emit_mul_r64(struct jit_context *ctx,
1812 + const u8 dst[], const u8 src[])
1813 +{
1814 + u8 acc = MIPS_R_T8;
1815 + u8 tmp = MIPS_R_T9;
1816 +
1817 + /* acc = hi(dst) * lo(src) */
1818 + if (cpu_has_mips32r1 || cpu_has_mips32r6) {
1819 + emit(ctx, mul, acc, hi(dst), lo(src));
1820 + } else {
1821 + emit(ctx, multu, hi(dst), lo(src));
1822 + emit(ctx, mflo, acc);
1823 + }
1824 +
1825 + /* tmp = lo(dst) * hi(src) */
1826 + if (cpu_has_mips32r1 || cpu_has_mips32r6) {
1827 + emit(ctx, mul, tmp, lo(dst), hi(src));
1828 + } else {
1829 + emit(ctx, multu, lo(dst), hi(src));
1830 + emit(ctx, mflo, tmp);
1831 + }
1832 +
1833 + /* acc += tmp */
1834 + emit(ctx, addu, acc, acc, tmp);
1835 +
1836 + /* tmp = lo(dst) * lo(src) >> 32 */
1837 + /* lo(dst) = lo(dst) * lo(src) */
1838 + if (cpu_has_mips32r6) {
1839 + emit(ctx, muhu, tmp, lo(dst), lo(src));
1840 + emit(ctx, mulu, lo(dst), lo(dst), lo(src));
1841 + } else {
1842 + emit(ctx, multu, lo(dst), lo(src));
1843 + emit(ctx, mflo, lo(dst));
1844 + emit(ctx, mfhi, tmp);
1845 + }
1846 +
1847 + /* hi(dst) = acc + tmp */
1848 + emit(ctx, addu, hi(dst), acc, tmp);
1849 + clobber_reg64(ctx, dst);
1850 +}
1851 +
1852 +/* Helper function for 64-bit modulo */
1853 +static u64 jit_mod64(u64 a, u64 b)
1854 +{
1855 + u64 rem;
1856 +
1857 + div64_u64_rem(a, b, &rem);
1858 + return rem;
1859 +}
1860 +
1861 +/* ALU div/mod register (64-bit) */
1862 +static void emit_divmod_r64(struct jit_context *ctx,
1863 + const u8 dst[], const u8 src[], u8 op)
1864 +{
1865 + const u8 *r0 = bpf2mips32[BPF_REG_0]; /* Mapped to v0-v1 */
1866 + const u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */
1867 + const u8 *r2 = bpf2mips32[BPF_REG_2]; /* Mapped to a2-a3 */
1868 + int exclude, k;
1869 + u32 addr = 0;
1870 +
1871 + /* Push caller-saved registers on stack */
1872 + push_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
1873 + 0, JIT_RESERVED_STACK);
1874 +
1875 + /* Put 64-bit arguments 1 and 2 in registers a0-a3 */
1876 + for (k = 0; k < 2; k++) {
1877 + emit(ctx, move, MIPS_R_T9, src[k]);
1878 + emit(ctx, move, r1[k], dst[k]);
1879 + emit(ctx, move, r2[k], MIPS_R_T9);
1880 + }
1881 +
1882 + /* Emit function call */
1883 + switch (BPF_OP(op)) {
1884 + /* dst = dst / src */
1885 + case BPF_DIV:
1886 + addr = (u32)&div64_u64;
1887 + break;
1888 + /* dst = dst % src */
1889 + case BPF_MOD:
1890 + addr = (u32)&jit_mod64;
1891 + break;
1892 + }
1893 + emit_mov_i(ctx, MIPS_R_T9, addr);
1894 + emit(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
1895 + emit(ctx, nop); /* Delay slot */
1896 +
1897 + /* Store the 64-bit result in dst */
1898 + emit(ctx, move, dst[0], r0[0]);
1899 + emit(ctx, move, dst[1], r0[1]);
1900 +
1901 + /* Restore caller-saved registers, excluding the computed result */
1902 + exclude = BIT(lo(dst)) | BIT(hi(dst));
1903 + pop_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
1904 + exclude, JIT_RESERVED_STACK);
1905 + emit_load_delay(ctx);
1906 +
1907 + clobber_reg64(ctx, dst);
1908 + clobber_reg(ctx, MIPS_R_V0);
1909 + clobber_reg(ctx, MIPS_R_V1);
1910 + clobber_reg(ctx, MIPS_R_RA);
1911 +}
1912 +
1913 +/* Swap bytes in a register word */
1914 +static void emit_swap8_r(struct jit_context *ctx, u8 dst, u8 src, u8 mask)
1915 +{
1916 + u8 tmp = MIPS_R_T9;
1917 +
1918 + emit(ctx, and, tmp, src, mask); /* tmp = src & 0x00ff00ff */
1919 + emit(ctx, sll, tmp, tmp, 8); /* tmp = tmp << 8 */
1920 + emit(ctx, srl, dst, src, 8); /* dst = src >> 8 */
1921 + emit(ctx, and, dst, dst, mask); /* dst = dst & 0x00ff00ff */
1922 + emit(ctx, or, dst, dst, tmp); /* dst = dst | tmp */
1923 +}
1924 +
1925 +/* Swap half words in a register word */
1926 +static void emit_swap16_r(struct jit_context *ctx, u8 dst, u8 src)
1927 +{
1928 + u8 tmp = MIPS_R_T9;
1929 +
1930 + emit(ctx, sll, tmp, src, 16); /* tmp = src << 16 */
1931 + emit(ctx, srl, dst, src, 16); /* dst = src >> 16 */
1932 + emit(ctx, or, dst, dst, tmp); /* dst = dst | tmp */
1933 +}
1934 +
1935 +/* Swap bytes and truncate a register double word, word or half word */
1936 +static void emit_bswap_r64(struct jit_context *ctx, const u8 dst[], u32 width)
1937 +{
1938 + u8 tmp = MIPS_R_T8;
1939 +
1940 + switch (width) {
1941 + /* Swap bytes in a double word */
1942 + case 64:
1943 + if (cpu_has_mips32r2 || cpu_has_mips32r6) {
1944 + emit(ctx, rotr, tmp, hi(dst), 16);
1945 + emit(ctx, rotr, hi(dst), lo(dst), 16);
1946 + emit(ctx, wsbh, lo(dst), tmp);
1947 + emit(ctx, wsbh, hi(dst), hi(dst));
1948 + } else {
1949 + emit_swap16_r(ctx, tmp, lo(dst));
1950 + emit_swap16_r(ctx, lo(dst), hi(dst));
1951 + emit(ctx, move, hi(dst), tmp);
1952 +
1953 + emit(ctx, lui, tmp, 0xff); /* tmp = 0x00ff0000 */
1954 + emit(ctx, ori, tmp, tmp, 0xff); /* tmp = 0x00ff00ff */
1955 + emit_swap8_r(ctx, lo(dst), lo(dst), tmp);
1956 + emit_swap8_r(ctx, hi(dst), hi(dst), tmp);
1957 + }
1958 + break;
1959 + /* Swap bytes in a word */
1960 + /* Swap bytes in a half word */
1961 + case 32:
1962 + case 16:
1963 + emit_bswap_r(ctx, lo(dst), width);
1964 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1965 + break;
1966 + }
1967 + clobber_reg64(ctx, dst);
1968 +}
1969 +
1970 +/* Truncate a register double word, word or half word */
1971 +static void emit_trunc_r64(struct jit_context *ctx, const u8 dst[], u32 width)
1972 +{
1973 + switch (width) {
1974 + case 64:
1975 + break;
1976 + /* Zero-extend a word */
1977 + case 32:
1978 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1979 + clobber_reg(ctx, hi(dst));
1980 + break;
1981 + /* Zero-extend a half word */
1982 + case 16:
1983 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1984 + emit(ctx, andi, lo(dst), lo(dst), 0xffff);
1985 + clobber_reg64(ctx, dst);
1986 + break;
1987 + }
1988 +}
1989 +
1990 +/* Load operation: dst = *(size*)(src + off) */
1991 +static void emit_ldx(struct jit_context *ctx,
1992 + const u8 dst[], u8 src, s16 off, u8 size)
1993 +{
1994 + switch (size) {
1995 + /* Load a byte */
1996 + case BPF_B:
1997 + emit(ctx, lbu, lo(dst), off, src);
1998 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
1999 + break;
2000 + /* Load a half word */
2001 + case BPF_H:
2002 + emit(ctx, lhu, lo(dst), off, src);
2003 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
2004 + break;
2005 + /* Load a word */
2006 + case BPF_W:
2007 + emit(ctx, lw, lo(dst), off, src);
2008 + emit(ctx, move, hi(dst), MIPS_R_ZERO);
2009 + break;
2010 + /* Load a double word */
2011 + case BPF_DW:
2012 + if (dst[1] == src) {
2013 + emit(ctx, lw, dst[0], off + 4, src);
2014 + emit(ctx, lw, dst[1], off, src);
2015 + } else {
2016 + emit(ctx, lw, dst[1], off, src);
2017 + emit(ctx, lw, dst[0], off + 4, src);
2018 + }
2019 + emit_load_delay(ctx);
2020 + break;
2021 + }
2022 + clobber_reg64(ctx, dst);
2023 +}
2024 +
2025 +/* Store operation: *(size *)(dst + off) = src */
2026 +static void emit_stx(struct jit_context *ctx,
2027 + const u8 dst, const u8 src[], s16 off, u8 size)
2028 +{
2029 + switch (size) {
2030 + /* Store a byte */
2031 + case BPF_B:
2032 + emit(ctx, sb, lo(src), off, dst);
2033 + break;
2034 + /* Store a half word */
2035 + case BPF_H:
2036 + emit(ctx, sh, lo(src), off, dst);
2037 + break;
2038 + /* Store a word */
2039 + case BPF_W:
2040 + emit(ctx, sw, lo(src), off, dst);
2041 + break;
2042 + /* Store a double word */
2043 + case BPF_DW:
2044 + emit(ctx, sw, src[1], off, dst);
2045 + emit(ctx, sw, src[0], off + 4, dst);
2046 + break;
2047 + }
2048 +}
2049 +
2050 +/* Atomic read-modify-write (32-bit, non-ll/sc fallback) */
2051 +static void emit_atomic_r32(struct jit_context *ctx,
2052 + u8 dst, u8 src, s16 off, u8 code)
2053 +{
2054 + u32 exclude = 0;
2055 + u32 addr = 0;
2056 +
2057 + /* Push caller-saved registers on stack */
2058 + push_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
2059 + 0, JIT_RESERVED_STACK);
2060 + /*
2061 + * Argument 1: dst+off if xchg, otherwise src, passed in register a0
2062 + * Argument 2: src if xchg, othersize dst+off, passed in register a1
2063 + */
2064 + emit(ctx, move, MIPS_R_T9, dst);
2065 + emit(ctx, move, MIPS_R_A0, src);
2066 + emit(ctx, addiu, MIPS_R_A1, MIPS_R_T9, off);
2067 +
2068 + /* Emit function call */
2069 + switch (code) {
2070 + case BPF_ADD:
2071 + addr = (u32)&atomic_add;
2072 + break;
2073 + case BPF_SUB:
2074 + addr = (u32)&atomic_sub;
2075 + break;
2076 + case BPF_OR:
2077 + addr = (u32)&atomic_or;
2078 + break;
2079 + case BPF_AND:
2080 + addr = (u32)&atomic_and;
2081 + break;
2082 + case BPF_XOR:
2083 + addr = (u32)&atomic_xor;
2084 + break;
2085 + }
2086 + emit_mov_i(ctx, MIPS_R_T9, addr);
2087 + emit(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
2088 + emit(ctx, nop); /* Delay slot */
2089 +
2090 + /* Restore caller-saved registers, except any fetched value */
2091 + pop_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
2092 + exclude, JIT_RESERVED_STACK);
2093 + emit_load_delay(ctx);
2094 + clobber_reg(ctx, MIPS_R_RA);
2095 +}
2096 +
2097 +/* Atomic read-modify-write (64-bit) */
2098 +static void emit_atomic_r64(struct jit_context *ctx,
2099 + u8 dst, const u8 src[], s16 off, u8 code)
2100 +{
2101 + const u8 *r1 = bpf2mips32[BPF_REG_1]; /* Mapped to a0-a1 */
2102 + u32 exclude = 0;
2103 + u32 addr = 0;
2104 +
2105 + /* Push caller-saved registers on stack */
2106 + push_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
2107 + 0, JIT_RESERVED_STACK);
2108 + /*
2109 + * Argument 1: 64-bit src, passed in registers a0-a1
2110 + * Argument 2: 32-bit dst+off, passed in register a2
2111 + */
2112 + emit(ctx, move, MIPS_R_T9, dst);
2113 + emit(ctx, move, r1[0], src[0]);
2114 + emit(ctx, move, r1[1], src[1]);
2115 + emit(ctx, addiu, MIPS_R_A2, MIPS_R_T9, off);
2116 +
2117 + /* Emit function call */
2118 + switch (code) {
2119 + case BPF_ADD:
2120 + addr = (u32)&atomic64_add;
2121 + break;
2122 + case BPF_SUB:
2123 + addr = (u32)&atomic64_sub;
2124 + break;
2125 + case BPF_OR:
2126 + addr = (u32)&atomic64_or;
2127 + break;
2128 + case BPF_AND:
2129 + addr = (u32)&atomic64_and;
2130 + break;
2131 + case BPF_XOR:
2132 + addr = (u32)&atomic64_xor;
2133 + break;
2134 + }
2135 + emit_mov_i(ctx, MIPS_R_T9, addr);
2136 + emit(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
2137 + emit(ctx, nop); /* Delay slot */
2138 +
2139 + /* Restore caller-saved registers, except any fetched value */
2140 + pop_regs(ctx, ctx->clobbered & JIT_CALLER_REGS,
2141 + exclude, JIT_RESERVED_STACK);
2142 + emit_load_delay(ctx);
2143 + clobber_reg(ctx, MIPS_R_RA);
2144 +}
2145 +
2146 +/*
2147 + * Conditional movz or an emulated equivalent.
2148 + * Note that the rs register may be modified.
2149 + */
2150 +static void emit_movz_r(struct jit_context *ctx, u8 rd, u8 rs, u8 rt)
2151 +{
2152 + if (cpu_has_mips_2) {
2153 + emit(ctx, movz, rd, rs, rt); /* rd = rt ? rd : rs */
2154 + } else if (cpu_has_mips32r6) {
2155 + if (rs != MIPS_R_ZERO)
2156 + emit(ctx, seleqz, rs, rs, rt); /* rs = 0 if rt == 0 */
2157 + emit(ctx, selnez, rd, rd, rt); /* rd = 0 if rt != 0 */
2158 + if (rs != MIPS_R_ZERO)
2159 + emit(ctx, or, rd, rd, rs); /* rd = rd | rs */
2160 + } else {
2161 + emit(ctx, bnez, rt, 8); /* PC += 8 if rd != 0 */
2162 + emit(ctx, nop); /* +0: delay slot */
2163 + emit(ctx, or, rd, rs, MIPS_R_ZERO); /* +4: rd = rs */
2164 + }
2165 + clobber_reg(ctx, rd);
2166 + clobber_reg(ctx, rs);
2167 +}
2168 +
2169 +/*
2170 + * Conditional movn or an emulated equivalent.
2171 + * Note that the rs register may be modified.
2172 + */
2173 +static void emit_movn_r(struct jit_context *ctx, u8 rd, u8 rs, u8 rt)
2174 +{
2175 + if (cpu_has_mips_2) {
2176 + emit(ctx, movn, rd, rs, rt); /* rd = rt ? rs : rd */
2177 + } else if (cpu_has_mips32r6) {
2178 + if (rs != MIPS_R_ZERO)
2179 + emit(ctx, selnez, rs, rs, rt); /* rs = 0 if rt == 0 */
2180 + emit(ctx, seleqz, rd, rd, rt); /* rd = 0 if rt != 0 */
2181 + if (rs != MIPS_R_ZERO)
2182 + emit(ctx, or, rd, rd, rs); /* rd = rd | rs */
2183 + } else {
2184 + emit(ctx, beqz, rt, 8); /* PC += 8 if rd == 0 */
2185 + emit(ctx, nop); /* +0: delay slot */
2186 + emit(ctx, or, rd, rs, MIPS_R_ZERO); /* +4: rd = rs */
2187 + }
2188 + clobber_reg(ctx, rd);
2189 + clobber_reg(ctx, rs);
2190 +}
2191 +
2192 +/* Emulation of 64-bit sltiu rd, rs, imm, where imm may be S32_MAX + 1 */
2193 +static void emit_sltiu_r64(struct jit_context *ctx, u8 rd,
2194 + const u8 rs[], s64 imm)
2195 +{
2196 + u8 tmp = MIPS_R_T9;
2197 +
2198 + if (imm < 0) {
2199 + emit_mov_i(ctx, rd, imm); /* rd = imm */
2200 + emit(ctx, sltu, rd, lo(rs), rd); /* rd = rsl < rd */
2201 + emit(ctx, sltiu, tmp, hi(rs), -1); /* tmp = rsh < ~0U */
2202 + emit(ctx, or, rd, rd, tmp); /* rd = rd | tmp */
2203 + } else { /* imm >= 0 */
2204 + if (imm > 0x7fff) {
2205 + emit_mov_i(ctx, rd, (s32)imm); /* rd = imm */
2206 + emit(ctx, sltu, rd, lo(rs), rd); /* rd = rsl < rd */
2207 + } else {
2208 + emit(ctx, sltiu, rd, lo(rs), imm); /* rd = rsl < imm */
2209 + }
2210 + emit_movn_r(ctx, rd, MIPS_R_ZERO, hi(rs)); /* rd = 0 if rsh */
2211 + }
2212 +}
2213 +
2214 +/* Emulation of 64-bit sltu rd, rs, rt */
2215 +static void emit_sltu_r64(struct jit_context *ctx, u8 rd,
2216 + const u8 rs[], const u8 rt[])
2217 +{
2218 + u8 tmp = MIPS_R_T9;
2219 +
2220 + emit(ctx, sltu, rd, lo(rs), lo(rt)); /* rd = rsl < rtl */
2221 + emit(ctx, subu, tmp, hi(rs), hi(rt)); /* tmp = rsh - rth */
2222 + emit_movn_r(ctx, rd, MIPS_R_ZERO, tmp); /* rd = 0 if tmp != 0 */
2223 + emit(ctx, sltu, tmp, hi(rs), hi(rt)); /* tmp = rsh < rth */
2224 + emit(ctx, or, rd, rd, tmp); /* rd = rd | tmp */
2225 +}
2226 +
2227 +/* Emulation of 64-bit slti rd, rs, imm, where imm may be S32_MAX + 1 */
2228 +static void emit_slti_r64(struct jit_context *ctx, u8 rd,
2229 + const u8 rs[], s64 imm)
2230 +{
2231 + u8 t1 = MIPS_R_T8;
2232 + u8 t2 = MIPS_R_T9;
2233 + u8 cmp;
2234 +
2235 + /*
2236 + * if ((rs < 0) ^ (imm < 0)) t1 = imm >u rsl
2237 + * else t1 = rsl <u imm
2238 + */
2239 + emit_mov_i(ctx, rd, (s32)imm);
2240 + emit(ctx, sltu, t1, lo(rs), rd); /* t1 = rsl <u imm */
2241 + emit(ctx, sltu, t2, rd, lo(rs)); /* t2 = imm <u rsl */
2242 + emit(ctx, srl, rd, hi(rs), 31); /* rd = rsh >> 31 */
2243 + if (imm < 0)
2244 + emit_movz_r(ctx, t1, t2, rd); /* t1 = rd ? t1 : t2 */
2245 + else
2246 + emit_movn_r(ctx, t1, t2, rd); /* t1 = rd ? t2 : t1 */
2247 + /*
2248 + * if ((imm < 0 && rsh != 0xffffffff) ||
2249 + * (imm >= 0 && rsh != 0))
2250 + * t1 = 0
2251 + */
2252 + if (imm < 0) {
2253 + emit(ctx, addiu, rd, hi(rs), 1); /* rd = rsh + 1 */
2254 + cmp = rd;
2255 + } else { /* imm >= 0 */
2256 + cmp = hi(rs);
2257 + }
2258 + emit_movn_r(ctx, t1, MIPS_R_ZERO, cmp); /* t1 = 0 if cmp != 0 */
2259 +
2260 + /*
2261 + * if (imm < 0) rd = rsh < -1
2262 + * else rd = rsh != 0
2263 + * rd = rd | t1
2264 + */
2265 + emit(ctx, slti, rd, hi(rs), imm < 0 ? -1 : 0); /* rd = rsh < hi(imm) */
2266 + emit(ctx, or, rd, rd, t1); /* rd = rd | t1 */
2267 +}
2268 +
2269 +/* Emulation of 64-bit(slt rd, rs, rt) */
2270 +static void emit_slt_r64(struct jit_context *ctx, u8 rd,
2271 + const u8 rs[], const u8 rt[])
2272 +{
2273 + u8 t1 = MIPS_R_T7;
2274 + u8 t2 = MIPS_R_T8;
2275 + u8 t3 = MIPS_R_T9;
2276 +
2277 + /*
2278 + * if ((rs < 0) ^ (rt < 0)) t1 = rtl <u rsl
2279 + * else t1 = rsl <u rtl
2280 + * if (rsh == rth) t1 = 0
2281 + */
2282 + emit(ctx, sltu, t1, lo(rs), lo(rt)); /* t1 = rsl <u rtl */
2283 + emit(ctx, sltu, t2, lo(rt), lo(rs)); /* t2 = rtl <u rsl */
2284 + emit(ctx, xor, t3, hi(rs), hi(rt)); /* t3 = rlh ^ rth */
2285 + emit(ctx, srl, rd, t3, 31); /* rd = t3 >> 31 */
2286 + emit_movn_r(ctx, t1, t2, rd); /* t1 = rd ? t2 : t1 */
2287 + emit_movn_r(ctx, t1, MIPS_R_ZERO, t3); /* t1 = 0 if t3 != 0 */
2288 +
2289 + /* rd = (rsh < rth) | t1 */
2290 + emit(ctx, slt, rd, hi(rs), hi(rt)); /* rd = rsh <s rth */
2291 + emit(ctx, or, rd, rd, t1); /* rd = rd | t1 */
2292 +}
2293 +
2294 +/* Jump immediate (64-bit) */
2295 +static void emit_jmp_i64(struct jit_context *ctx,
2296 + const u8 dst[], s32 imm, s32 off, u8 op)
2297 +{
2298 + u8 tmp = MIPS_R_T6;
2299 +
2300 + switch (op) {
2301 + /* No-op, used internally for branch optimization */
2302 + case JIT_JNOP:
2303 + break;
2304 + /* PC += off if dst == imm */
2305 + /* PC += off if dst != imm */
2306 + case BPF_JEQ:
2307 + case BPF_JNE:
2308 + if (imm >= -0x7fff && imm <= 0x8000) {
2309 + emit(ctx, addiu, tmp, lo(dst), -imm);
2310 + } else if ((u32)imm <= 0xffff) {
2311 + emit(ctx, xori, tmp, lo(dst), imm);
2312 + } else { /* Register fallback */
2313 + emit_mov_i(ctx, tmp, imm);
2314 + emit(ctx, xor, tmp, lo(dst), tmp);
2315 + }
2316 + if (imm < 0) { /* Compare sign extension */
2317 + emit(ctx, addu, MIPS_R_T9, hi(dst), 1);
2318 + emit(ctx, or, tmp, tmp, MIPS_R_T9);
2319 + } else { /* Compare zero extension */
2320 + emit(ctx, or, tmp, tmp, hi(dst));
2321 + }
2322 + if (op == BPF_JEQ)
2323 + emit(ctx, beqz, tmp, off);
2324 + else /* BPF_JNE */
2325 + emit(ctx, bnez, tmp, off);
2326 + break;
2327 + /* PC += off if dst & imm */
2328 + /* PC += off if (dst & imm) == 0 (not in BPF, used for long jumps) */
2329 + case BPF_JSET:
2330 + case JIT_JNSET:
2331 + if ((u32)imm <= 0xffff) {
2332 + emit(ctx, andi, tmp, lo(dst), imm);
2333 + } else { /* Register fallback */
2334 + emit_mov_i(ctx, tmp, imm);
2335 + emit(ctx, and, tmp, lo(dst), tmp);
2336 + }
2337 + if (imm < 0) /* Sign-extension pulls in high word */
2338 + emit(ctx, or, tmp, tmp, hi(dst));
2339 + if (op == BPF_JSET)
2340 + emit(ctx, bnez, tmp, off);
2341 + else /* JIT_JNSET */
2342 + emit(ctx, beqz, tmp, off);
2343 + break;
2344 + /* PC += off if dst > imm */
2345 + case BPF_JGT:
2346 + emit_sltiu_r64(ctx, tmp, dst, (s64)imm + 1);
2347 + emit(ctx, beqz, tmp, off);
2348 + break;
2349 + /* PC += off if dst >= imm */
2350 + case BPF_JGE:
2351 + emit_sltiu_r64(ctx, tmp, dst, imm);
2352 + emit(ctx, beqz, tmp, off);
2353 + break;
2354 + /* PC += off if dst < imm */
2355 + case BPF_JLT:
2356 + emit_sltiu_r64(ctx, tmp, dst, imm);
2357 + emit(ctx, bnez, tmp, off);
2358 + break;
2359 + /* PC += off if dst <= imm */
2360 + case BPF_JLE:
2361 + emit_sltiu_r64(ctx, tmp, dst, (s64)imm + 1);
2362 + emit(ctx, bnez, tmp, off);
2363 + break;
2364 + /* PC += off if dst > imm (signed) */
2365 + case BPF_JSGT:
2366 + emit_slti_r64(ctx, tmp, dst, (s64)imm + 1);
2367 + emit(ctx, beqz, tmp, off);
2368 + break;
2369 + /* PC += off if dst >= imm (signed) */
2370 + case BPF_JSGE:
2371 + emit_slti_r64(ctx, tmp, dst, imm);
2372 + emit(ctx, beqz, tmp, off);
2373 + break;
2374 + /* PC += off if dst < imm (signed) */
2375 + case BPF_JSLT:
2376 + emit_slti_r64(ctx, tmp, dst, imm);
2377 + emit(ctx, bnez, tmp, off);
2378 + break;
2379 + /* PC += off if dst <= imm (signed) */
2380 + case BPF_JSLE:
2381 + emit_slti_r64(ctx, tmp, dst, (s64)imm + 1);
2382 + emit(ctx, bnez, tmp, off);
2383 + break;
2384 + }
2385 +}
2386 +
2387 +/* Jump register (64-bit) */
2388 +static void emit_jmp_r64(struct jit_context *ctx,
2389 + const u8 dst[], const u8 src[], s32 off, u8 op)
2390 +{
2391 + u8 t1 = MIPS_R_T6;
2392 + u8 t2 = MIPS_R_T7;
2393 +
2394 + switch (op) {
2395 + /* No-op, used internally for branch optimization */
2396 + case JIT_JNOP:
2397 + break;
2398 + /* PC += off if dst == src */
2399 + /* PC += off if dst != src */
2400 + case BPF_JEQ:
2401 + case BPF_JNE:
2402 + emit(ctx, subu, t1, lo(dst), lo(src));
2403 + emit(ctx, subu, t2, hi(dst), hi(src));
2404 + emit(ctx, or, t1, t1, t2);
2405 + if (op == BPF_JEQ)
2406 + emit(ctx, beqz, t1, off);
2407 + else /* BPF_JNE */
2408 + emit(ctx, bnez, t1, off);
2409 + break;
2410 + /* PC += off if dst & src */
2411 + /* PC += off if (dst & imm) == 0 (not in BPF, used for long jumps) */
2412 + case BPF_JSET:
2413 + case JIT_JNSET:
2414 + emit(ctx, and, t1, lo(dst), lo(src));
2415 + emit(ctx, and, t2, hi(dst), hi(src));
2416 + emit(ctx, or, t1, t1, t2);
2417 + if (op == BPF_JSET)
2418 + emit(ctx, bnez, t1, off);
2419 + else /* JIT_JNSET */
2420 + emit(ctx, beqz, t1, off);
2421 + break;
2422 + /* PC += off if dst > src */
2423 + case BPF_JGT:
2424 + emit_sltu_r64(ctx, t1, src, dst);
2425 + emit(ctx, bnez, t1, off);
2426 + break;
2427 + /* PC += off if dst >= src */
2428 + case BPF_JGE:
2429 + emit_sltu_r64(ctx, t1, dst, src);
2430 + emit(ctx, beqz, t1, off);
2431 + break;
2432 + /* PC += off if dst < src */
2433 + case BPF_JLT:
2434 + emit_sltu_r64(ctx, t1, dst, src);
2435 + emit(ctx, bnez, t1, off);
2436 + break;
2437 + /* PC += off if dst <= src */
2438 + case BPF_JLE:
2439 + emit_sltu_r64(ctx, t1, src, dst);
2440 + emit(ctx, beqz, t1, off);
2441 + break;
2442 + /* PC += off if dst > src (signed) */
2443 + case BPF_JSGT:
2444 + emit_slt_r64(ctx, t1, src, dst);
2445 + emit(ctx, bnez, t1, off);
2446 + break;
2447 + /* PC += off if dst >= src (signed) */
2448 + case BPF_JSGE:
2449 + emit_slt_r64(ctx, t1, dst, src);
2450 + emit(ctx, beqz, t1, off);
2451 + break;
2452 + /* PC += off if dst < src (signed) */
2453 + case BPF_JSLT:
2454 + emit_slt_r64(ctx, t1, dst, src);
2455 + emit(ctx, bnez, t1, off);
2456 + break;
2457 + /* PC += off if dst <= src (signed) */
2458 + case BPF_JSLE:
2459 + emit_slt_r64(ctx, t1, src, dst);
2460 + emit(ctx, beqz, t1, off);
2461 + break;
2462 + }
2463 +}
2464 +
2465 +/* Function call */
2466 +static int emit_call(struct jit_context *ctx, const struct bpf_insn *insn)
2467 +{
2468 + bool fixed;
2469 + u64 addr;
2470 +
2471 + /* Decode the call address */
2472 + if (bpf_jit_get_func_addr(ctx->program, insn, false,
2473 + &addr, &fixed) < 0)
2474 + return -1;
2475 + if (!fixed)
2476 + return -1;
2477 +
2478 + /* Push stack arguments */
2479 + push_regs(ctx, JIT_STACK_REGS, 0, JIT_RESERVED_STACK);
2480 +
2481 + /* Emit function call */
2482 + emit_mov_i(ctx, MIPS_R_T9, addr);
2483 + emit(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
2484 + emit(ctx, nop); /* Delay slot */
2485 +
2486 + clobber_reg(ctx, MIPS_R_RA);
2487 + clobber_reg(ctx, MIPS_R_V0);
2488 + clobber_reg(ctx, MIPS_R_V1);
2489 + return 0;
2490 +}
2491 +
2492 +/* Function tail call */
2493 +static int emit_tail_call(struct jit_context *ctx)
2494 +{
2495 + u8 ary = lo(bpf2mips32[BPF_REG_2]);
2496 + u8 ind = lo(bpf2mips32[BPF_REG_3]);
2497 + u8 t1 = MIPS_R_T8;
2498 + u8 t2 = MIPS_R_T9;
2499 + int off;
2500 +
2501 + /*
2502 + * Tail call:
2503 + * eBPF R1 - function argument (context ptr), passed in a0-a1
2504 + * eBPF R2 - ptr to object with array of function entry points
2505 + * eBPF R3 - array index of function to be called
2506 + * stack[sz] - remaining tail call count, initialized in prologue
2507 + */
2508 +
2509 + /* if (ind >= ary->map.max_entries) goto out */
2510 + off = offsetof(struct bpf_array, map.max_entries);
2511 + if (off > 0x7fff)
2512 + return -1;
2513 + emit(ctx, lw, t1, off, ary); /* t1 = ary->map.max_entries*/
2514 + emit_load_delay(ctx); /* Load delay slot */
2515 + emit(ctx, sltu, t1, ind, t1); /* t1 = ind < t1 */
2516 + emit(ctx, beqz, t1, get_offset(ctx, 1)); /* PC += off(1) if t1 == 0 */
2517 + /* (next insn delay slot) */
2518 + /* if (TCC-- <= 0) goto out */
2519 + emit(ctx, lw, t2, ctx->stack_size, MIPS_R_SP); /* t2 = *(SP + size) */
2520 + emit_load_delay(ctx); /* Load delay slot */
2521 + emit(ctx, blez, t2, get_offset(ctx, 1)); /* PC += off(1) if t2 < 0 */
2522 + emit(ctx, addiu, t2, t2, -1); /* t2-- (delay slot) */
2523 + emit(ctx, sw, t2, ctx->stack_size, MIPS_R_SP); /* *(SP + size) = t2 */
2524 +
2525 + /* prog = ary->ptrs[ind] */
2526 + off = offsetof(struct bpf_array, ptrs);
2527 + if (off > 0x7fff)
2528 + return -1;
2529 + emit(ctx, sll, t1, ind, 2); /* t1 = ind << 2 */
2530 + emit(ctx, addu, t1, t1, ary); /* t1 += ary */
2531 + emit(ctx, lw, t2, off, t1); /* t2 = *(t1 + off) */
2532 + emit_load_delay(ctx); /* Load delay slot */
2533 +
2534 + /* if (prog == 0) goto out */
2535 + emit(ctx, beqz, t2, get_offset(ctx, 1)); /* PC += off(1) if t2 == 0 */
2536 + emit(ctx, nop); /* Delay slot */
2537 +
2538 + /* func = prog->bpf_func + 8 (prologue skip offset) */
2539 + off = offsetof(struct bpf_prog, bpf_func);
2540 + if (off > 0x7fff)
2541 + return -1;
2542 + emit(ctx, lw, t1, off, t2); /* t1 = *(t2 + off) */
2543 + emit_load_delay(ctx); /* Load delay slot */
2544 + emit(ctx, addiu, t1, t1, JIT_TCALL_SKIP); /* t1 += skip (8 or 12) */
2545 +
2546 + /* goto func */
2547 + build_epilogue(ctx, t1);
2548 + return 0;
2549 +}
2550 +
2551 +/*
2552 + * Stack frame layout for a JITed program (stack grows down).
2553 + *
2554 + * Higher address : Caller's stack frame :
2555 + * :----------------------------:
2556 + * : 64-bit eBPF args r3-r5 :
2557 + * :----------------------------:
2558 + * : Reserved / tail call count :
2559 + * +============================+ <--- MIPS sp before call
2560 + * | Callee-saved registers, |
2561 + * | including RA and FP |
2562 + * +----------------------------+ <--- eBPF FP (MIPS zero,fp)
2563 + * | Local eBPF variables |
2564 + * | allocated by program |
2565 + * +----------------------------+
2566 + * | Reserved for caller-saved |
2567 + * | registers |
2568 + * +----------------------------+
2569 + * | Reserved for 64-bit eBPF |
2570 + * | args r3-r5 & args passed |
2571 + * | on stack in kernel calls |
2572 + * Lower address +============================+ <--- MIPS sp
2573 + */
2574 +
2575 +/* Build program prologue to set up the stack and registers */
2576 +void build_prologue(struct jit_context *ctx)
2577 +{
2578 + const u8 *r1 = bpf2mips32[BPF_REG_1];
2579 + const u8 *fp = bpf2mips32[BPF_REG_FP];
2580 + int stack, saved, locals, reserved;
2581 +
2582 + /*
2583 + * The first two instructions initialize TCC in the reserved (for us)
2584 + * 16-byte area in the parent's stack frame. On a tail call, the
2585 + * calling function jumps into the prologue after these instructions.
2586 + */
2587 + emit(ctx, ori, MIPS_R_T9, MIPS_R_ZERO,
2588 + min(MAX_TAIL_CALL_CNT + 1, 0xffff));
2589 + emit(ctx, sw, MIPS_R_T9, 0, MIPS_R_SP);
2590 +
2591 + /*
2592 + * Register eBPF R1 contains the 32-bit context pointer argument.
2593 + * A 32-bit argument is always passed in MIPS register a0, regardless
2594 + * of CPU endianness. Initialize R1 accordingly and zero-extend.
2595 + */
2596 +#ifdef __BIG_ENDIAN
2597 + emit(ctx, move, lo(r1), MIPS_R_A0);
2598 +#endif
2599 +
2600 + /* === Entry-point for tail calls === */
2601 +
2602 + /* Zero-extend the 32-bit argument */
2603 + emit(ctx, move, hi(r1), MIPS_R_ZERO);
2604 +
2605 + /* If the eBPF frame pointer was accessed it must be saved */
2606 + if (ctx->accessed & BIT(BPF_REG_FP))
2607 + clobber_reg64(ctx, fp);
2608 +
2609 + /* Compute the stack space needed for callee-saved registers */
2610 + saved = hweight32(ctx->clobbered & JIT_CALLEE_REGS) * sizeof(u32);
2611 + saved = ALIGN(saved, MIPS_STACK_ALIGNMENT);
2612 +
2613 + /* Stack space used by eBPF program local data */
2614 + locals = ALIGN(ctx->program->aux->stack_depth, MIPS_STACK_ALIGNMENT);
2615 +
2616 + /*
2617 + * If we are emitting function calls, reserve extra stack space for
2618 + * caller-saved registers and function arguments passed on the stack.
2619 + * The required space is computed automatically during resource
2620 + * usage discovery (pass 1).
2621 + */
2622 + reserved = ctx->stack_used;
2623 +
2624 + /* Allocate the stack frame */
2625 + stack = ALIGN(saved + locals + reserved, MIPS_STACK_ALIGNMENT);
2626 + emit(ctx, addiu, MIPS_R_SP, MIPS_R_SP, -stack);
2627 +
2628 + /* Store callee-saved registers on stack */
2629 + push_regs(ctx, ctx->clobbered & JIT_CALLEE_REGS, 0, stack - saved);
2630 +
2631 + /* Initialize the eBPF frame pointer if accessed */
2632 + if (ctx->accessed & BIT(BPF_REG_FP))
2633 + emit(ctx, addiu, lo(fp), MIPS_R_SP, stack - saved);
2634 +
2635 + ctx->saved_size = saved;
2636 + ctx->stack_size = stack;
2637 +}
2638 +
2639 +/* Build the program epilogue to restore the stack and registers */
2640 +void build_epilogue(struct jit_context *ctx, int dest_reg)
2641 +{
2642 + /* Restore callee-saved registers from stack */
2643 + pop_regs(ctx, ctx->clobbered & JIT_CALLEE_REGS, 0,
2644 + ctx->stack_size - ctx->saved_size);
2645 + /*
2646 + * A 32-bit return value is always passed in MIPS register v0,
2647 + * but on big-endian targets the low part of R0 is mapped to v1.
2648 + */
2649 +#ifdef __BIG_ENDIAN
2650 + emit(ctx, move, MIPS_R_V0, MIPS_R_V1);
2651 +#endif
2652 +
2653 + /* Jump to the return address and adjust the stack pointer */
2654 + emit(ctx, jr, dest_reg);
2655 + emit(ctx, addiu, MIPS_R_SP, MIPS_R_SP, ctx->stack_size);
2656 +}
2657 +
2658 +/* Build one eBPF instruction */
2659 +int build_insn(const struct bpf_insn *insn, struct jit_context *ctx)
2660 +{
2661 + const u8 *dst = bpf2mips32[insn->dst_reg];
2662 + const u8 *src = bpf2mips32[insn->src_reg];
2663 + const u8 *tmp = bpf2mips32[JIT_REG_TMP];
2664 + u8 code = insn->code;
2665 + s16 off = insn->off;
2666 + s32 imm = insn->imm;
2667 + s32 val, rel;
2668 + u8 alu, jmp;
2669 +
2670 + switch (code) {
2671 + /* ALU operations */
2672 + /* dst = imm */
2673 + case BPF_ALU | BPF_MOV | BPF_K:
2674 + emit_mov_i(ctx, lo(dst), imm);
2675 + emit_zext_ver(ctx, dst);
2676 + break;
2677 + /* dst = src */
2678 + case BPF_ALU | BPF_MOV | BPF_X:
2679 + if (imm == 1) {
2680 + /* Special mov32 for zext */
2681 + emit_mov_i(ctx, hi(dst), 0);
2682 + } else {
2683 + emit_mov_r(ctx, lo(dst), lo(src));
2684 + emit_zext_ver(ctx, dst);
2685 + }
2686 + break;
2687 + /* dst = -dst */
2688 + case BPF_ALU | BPF_NEG:
2689 + emit_alu_i(ctx, lo(dst), 0, BPF_NEG);
2690 + emit_zext_ver(ctx, dst);
2691 + break;
2692 + /* dst = dst & imm */
2693 + /* dst = dst | imm */
2694 + /* dst = dst ^ imm */
2695 + /* dst = dst << imm */
2696 + /* dst = dst >> imm */
2697 + /* dst = dst >> imm (arithmetic) */
2698 + /* dst = dst + imm */
2699 + /* dst = dst - imm */
2700 + /* dst = dst * imm */
2701 + /* dst = dst / imm */
2702 + /* dst = dst % imm */
2703 + case BPF_ALU | BPF_OR | BPF_K:
2704 + case BPF_ALU | BPF_AND | BPF_K:
2705 + case BPF_ALU | BPF_XOR | BPF_K:
2706 + case BPF_ALU | BPF_LSH | BPF_K:
2707 + case BPF_ALU | BPF_RSH | BPF_K:
2708 + case BPF_ALU | BPF_ARSH | BPF_K:
2709 + case BPF_ALU | BPF_ADD | BPF_K:
2710 + case BPF_ALU | BPF_SUB | BPF_K:
2711 + case BPF_ALU | BPF_MUL | BPF_K:
2712 + case BPF_ALU | BPF_DIV | BPF_K:
2713 + case BPF_ALU | BPF_MOD | BPF_K:
2714 + if (!valid_alu_i(BPF_OP(code), imm)) {
2715 + emit_mov_i(ctx, MIPS_R_T6, imm);
2716 + emit_alu_r(ctx, lo(dst), MIPS_R_T6, BPF_OP(code));
2717 + } else if (rewrite_alu_i(BPF_OP(code), imm, &alu, &val)) {
2718 + emit_alu_i(ctx, lo(dst), val, alu);
2719 + }
2720 + emit_zext_ver(ctx, dst);
2721 + break;
2722 + /* dst = dst & src */
2723 + /* dst = dst | src */
2724 + /* dst = dst ^ src */
2725 + /* dst = dst << src */
2726 + /* dst = dst >> src */
2727 + /* dst = dst >> src (arithmetic) */
2728 + /* dst = dst + src */
2729 + /* dst = dst - src */
2730 + /* dst = dst * src */
2731 + /* dst = dst / src */
2732 + /* dst = dst % src */
2733 + case BPF_ALU | BPF_AND | BPF_X:
2734 + case BPF_ALU | BPF_OR | BPF_X:
2735 + case BPF_ALU | BPF_XOR | BPF_X:
2736 + case BPF_ALU | BPF_LSH | BPF_X:
2737 + case BPF_ALU | BPF_RSH | BPF_X:
2738 + case BPF_ALU | BPF_ARSH | BPF_X:
2739 + case BPF_ALU | BPF_ADD | BPF_X:
2740 + case BPF_ALU | BPF_SUB | BPF_X:
2741 + case BPF_ALU | BPF_MUL | BPF_X:
2742 + case BPF_ALU | BPF_DIV | BPF_X:
2743 + case BPF_ALU | BPF_MOD | BPF_X:
2744 + emit_alu_r(ctx, lo(dst), lo(src), BPF_OP(code));
2745 + emit_zext_ver(ctx, dst);
2746 + break;
2747 + /* dst = imm (64-bit) */
2748 + case BPF_ALU64 | BPF_MOV | BPF_K:
2749 + emit_mov_se_i64(ctx, dst, imm);
2750 + break;
2751 + /* dst = src (64-bit) */
2752 + case BPF_ALU64 | BPF_MOV | BPF_X:
2753 + emit_mov_r(ctx, lo(dst), lo(src));
2754 + emit_mov_r(ctx, hi(dst), hi(src));
2755 + break;
2756 + /* dst = -dst (64-bit) */
2757 + case BPF_ALU64 | BPF_NEG:
2758 + emit_neg_i64(ctx, dst);
2759 + break;
2760 + /* dst = dst & imm (64-bit) */
2761 + case BPF_ALU64 | BPF_AND | BPF_K:
2762 + emit_alu_i64(ctx, dst, imm, BPF_OP(code));
2763 + break;
2764 + /* dst = dst | imm (64-bit) */
2765 + /* dst = dst ^ imm (64-bit) */
2766 + /* dst = dst + imm (64-bit) */
2767 + /* dst = dst - imm (64-bit) */
2768 + case BPF_ALU64 | BPF_OR | BPF_K:
2769 + case BPF_ALU64 | BPF_XOR | BPF_K:
2770 + case BPF_ALU64 | BPF_ADD | BPF_K:
2771 + case BPF_ALU64 | BPF_SUB | BPF_K:
2772 + if (imm)
2773 + emit_alu_i64(ctx, dst, imm, BPF_OP(code));
2774 + break;
2775 + /* dst = dst << imm (64-bit) */
2776 + /* dst = dst >> imm (64-bit) */
2777 + /* dst = dst >> imm (64-bit, arithmetic) */
2778 + case BPF_ALU64 | BPF_LSH | BPF_K:
2779 + case BPF_ALU64 | BPF_RSH | BPF_K:
2780 + case BPF_ALU64 | BPF_ARSH | BPF_K:
2781 + if (imm)
2782 + emit_shift_i64(ctx, dst, imm, BPF_OP(code));
2783 + break;
2784 + /* dst = dst * imm (64-bit) */
2785 + case BPF_ALU64 | BPF_MUL | BPF_K:
2786 + emit_mul_i64(ctx, dst, imm);
2787 + break;
2788 + /* dst = dst / imm (64-bit) */
2789 + /* dst = dst % imm (64-bit) */
2790 + case BPF_ALU64 | BPF_DIV | BPF_K:
2791 + case BPF_ALU64 | BPF_MOD | BPF_K:
2792 + /*
2793 + * Sign-extend the immediate value into a temporary register,
2794 + * and then do the operation on this register.
2795 + */
2796 + emit_mov_se_i64(ctx, tmp, imm);
2797 + emit_divmod_r64(ctx, dst, tmp, BPF_OP(code));
2798 + break;
2799 + /* dst = dst & src (64-bit) */
2800 + /* dst = dst | src (64-bit) */
2801 + /* dst = dst ^ src (64-bit) */
2802 + /* dst = dst + src (64-bit) */
2803 + /* dst = dst - src (64-bit) */
2804 + case BPF_ALU64 | BPF_AND | BPF_X:
2805 + case BPF_ALU64 | BPF_OR | BPF_X:
2806 + case BPF_ALU64 | BPF_XOR | BPF_X:
2807 + case BPF_ALU64 | BPF_ADD | BPF_X:
2808 + case BPF_ALU64 | BPF_SUB | BPF_X:
2809 + emit_alu_r64(ctx, dst, src, BPF_OP(code));
2810 + break;
2811 + /* dst = dst << src (64-bit) */
2812 + /* dst = dst >> src (64-bit) */
2813 + /* dst = dst >> src (64-bit, arithmetic) */
2814 + case BPF_ALU64 | BPF_LSH | BPF_X:
2815 + case BPF_ALU64 | BPF_RSH | BPF_X:
2816 + case BPF_ALU64 | BPF_ARSH | BPF_X:
2817 + emit_shift_r64(ctx, dst, lo(src), BPF_OP(code));
2818 + break;
2819 + /* dst = dst * src (64-bit) */
2820 + case BPF_ALU64 | BPF_MUL | BPF_X:
2821 + emit_mul_r64(ctx, dst, src);
2822 + break;
2823 + /* dst = dst / src (64-bit) */
2824 + /* dst = dst % src (64-bit) */
2825 + case BPF_ALU64 | BPF_DIV | BPF_X:
2826 + case BPF_ALU64 | BPF_MOD | BPF_X:
2827 + emit_divmod_r64(ctx, dst, src, BPF_OP(code));
2828 + break;
2829 + /* dst = htole(dst) */
2830 + /* dst = htobe(dst) */
2831 + case BPF_ALU | BPF_END | BPF_FROM_LE:
2832 + case BPF_ALU | BPF_END | BPF_FROM_BE:
2833 + if (BPF_SRC(code) ==
2834 +#ifdef __BIG_ENDIAN
2835 + BPF_FROM_LE
2836 +#else
2837 + BPF_FROM_BE
2838 +#endif
2839 + )
2840 + emit_bswap_r64(ctx, dst, imm);
2841 + else
2842 + emit_trunc_r64(ctx, dst, imm);
2843 + break;
2844 + /* dst = imm64 */
2845 + case BPF_LD | BPF_IMM | BPF_DW:
2846 + emit_mov_i(ctx, lo(dst), imm);
2847 + emit_mov_i(ctx, hi(dst), insn[1].imm);
2848 + return 1;
2849 + /* LDX: dst = *(size *)(src + off) */
2850 + case BPF_LDX | BPF_MEM | BPF_W:
2851 + case BPF_LDX | BPF_MEM | BPF_H:
2852 + case BPF_LDX | BPF_MEM | BPF_B:
2853 + case BPF_LDX | BPF_MEM | BPF_DW:
2854 + emit_ldx(ctx, dst, lo(src), off, BPF_SIZE(code));
2855 + break;
2856 + /* ST: *(size *)(dst + off) = imm */
2857 + case BPF_ST | BPF_MEM | BPF_W:
2858 + case BPF_ST | BPF_MEM | BPF_H:
2859 + case BPF_ST | BPF_MEM | BPF_B:
2860 + case BPF_ST | BPF_MEM | BPF_DW:
2861 + switch (BPF_SIZE(code)) {
2862 + case BPF_DW:
2863 + /* Sign-extend immediate value into temporary reg */
2864 + emit_mov_se_i64(ctx, tmp, imm);
2865 + break;
2866 + case BPF_W:
2867 + case BPF_H:
2868 + case BPF_B:
2869 + emit_mov_i(ctx, lo(tmp), imm);
2870 + break;
2871 + }
2872 + emit_stx(ctx, lo(dst), tmp, off, BPF_SIZE(code));
2873 + break;
2874 + /* STX: *(size *)(dst + off) = src */
2875 + case BPF_STX | BPF_MEM | BPF_W:
2876 + case BPF_STX | BPF_MEM | BPF_H:
2877 + case BPF_STX | BPF_MEM | BPF_B:
2878 + case BPF_STX | BPF_MEM | BPF_DW:
2879 + emit_stx(ctx, lo(dst), src, off, BPF_SIZE(code));
2880 + break;
2881 + /* Speculation barrier */
2882 + case BPF_ST | BPF_NOSPEC:
2883 + break;
2884 + /* Atomics */
2885 + case BPF_STX | BPF_XADD | BPF_W:
2886 + switch (imm) {
2887 + case BPF_ADD:
2888 + case BPF_AND:
2889 + case BPF_OR:
2890 + case BPF_XOR:
2891 + if (cpu_has_llsc)
2892 + emit_atomic_r(ctx, lo(dst), lo(src), off, imm);
2893 + else /* Non-ll/sc fallback */
2894 + emit_atomic_r32(ctx, lo(dst), lo(src),
2895 + off, imm);
2896 + break;
2897 + default:
2898 + goto notyet;
2899 + }
2900 + break;
2901 + /* Atomics (64-bit) */
2902 + case BPF_STX | BPF_XADD | BPF_DW:
2903 + switch (imm) {
2904 + case BPF_ADD:
2905 + case BPF_AND:
2906 + case BPF_OR:
2907 + case BPF_XOR:
2908 + emit_atomic_r64(ctx, lo(dst), src, off, imm);
2909 + break;
2910 + default:
2911 + goto notyet;
2912 + }
2913 + break;
2914 + /* PC += off if dst == src */
2915 + /* PC += off if dst != src */
2916 + /* PC += off if dst & src */
2917 + /* PC += off if dst > src */
2918 + /* PC += off if dst >= src */
2919 + /* PC += off if dst < src */
2920 + /* PC += off if dst <= src */
2921 + /* PC += off if dst > src (signed) */
2922 + /* PC += off if dst >= src (signed) */
2923 + /* PC += off if dst < src (signed) */
2924 + /* PC += off if dst <= src (signed) */
2925 + case BPF_JMP32 | BPF_JEQ | BPF_X:
2926 + case BPF_JMP32 | BPF_JNE | BPF_X:
2927 + case BPF_JMP32 | BPF_JSET | BPF_X:
2928 + case BPF_JMP32 | BPF_JGT | BPF_X:
2929 + case BPF_JMP32 | BPF_JGE | BPF_X:
2930 + case BPF_JMP32 | BPF_JLT | BPF_X:
2931 + case BPF_JMP32 | BPF_JLE | BPF_X:
2932 + case BPF_JMP32 | BPF_JSGT | BPF_X:
2933 + case BPF_JMP32 | BPF_JSGE | BPF_X:
2934 + case BPF_JMP32 | BPF_JSLT | BPF_X:
2935 + case BPF_JMP32 | BPF_JSLE | BPF_X:
2936 + if (off == 0)
2937 + break;
2938 + setup_jmp_r(ctx, dst == src, BPF_OP(code), off, &jmp, &rel);
2939 + emit_jmp_r(ctx, lo(dst), lo(src), rel, jmp);
2940 + if (finish_jmp(ctx, jmp, off) < 0)
2941 + goto toofar;
2942 + break;
2943 + /* PC += off if dst == imm */
2944 + /* PC += off if dst != imm */
2945 + /* PC += off if dst & imm */
2946 + /* PC += off if dst > imm */
2947 + /* PC += off if dst >= imm */
2948 + /* PC += off if dst < imm */
2949 + /* PC += off if dst <= imm */
2950 + /* PC += off if dst > imm (signed) */
2951 + /* PC += off if dst >= imm (signed) */
2952 + /* PC += off if dst < imm (signed) */
2953 + /* PC += off if dst <= imm (signed) */
2954 + case BPF_JMP32 | BPF_JEQ | BPF_K:
2955 + case BPF_JMP32 | BPF_JNE | BPF_K:
2956 + case BPF_JMP32 | BPF_JSET | BPF_K:
2957 + case BPF_JMP32 | BPF_JGT | BPF_K:
2958 + case BPF_JMP32 | BPF_JGE | BPF_K:
2959 + case BPF_JMP32 | BPF_JLT | BPF_K:
2960 + case BPF_JMP32 | BPF_JLE | BPF_K:
2961 + case BPF_JMP32 | BPF_JSGT | BPF_K:
2962 + case BPF_JMP32 | BPF_JSGE | BPF_K:
2963 + case BPF_JMP32 | BPF_JSLT | BPF_K:
2964 + case BPF_JMP32 | BPF_JSLE | BPF_K:
2965 + if (off == 0)
2966 + break;
2967 + setup_jmp_i(ctx, imm, 32, BPF_OP(code), off, &jmp, &rel);
2968 + if (valid_jmp_i(jmp, imm)) {
2969 + emit_jmp_i(ctx, lo(dst), imm, rel, jmp);
2970 + } else {
2971 + /* Move large immediate to register */
2972 + emit_mov_i(ctx, MIPS_R_T6, imm);
2973 + emit_jmp_r(ctx, lo(dst), MIPS_R_T6, rel, jmp);
2974 + }
2975 + if (finish_jmp(ctx, jmp, off) < 0)
2976 + goto toofar;
2977 + break;
2978 + /* PC += off if dst == src */
2979 + /* PC += off if dst != src */
2980 + /* PC += off if dst & src */
2981 + /* PC += off if dst > src */
2982 + /* PC += off if dst >= src */
2983 + /* PC += off if dst < src */
2984 + /* PC += off if dst <= src */
2985 + /* PC += off if dst > src (signed) */
2986 + /* PC += off if dst >= src (signed) */
2987 + /* PC += off if dst < src (signed) */
2988 + /* PC += off if dst <= src (signed) */
2989 + case BPF_JMP | BPF_JEQ | BPF_X:
2990 + case BPF_JMP | BPF_JNE | BPF_X:
2991 + case BPF_JMP | BPF_JSET | BPF_X:
2992 + case BPF_JMP | BPF_JGT | BPF_X:
2993 + case BPF_JMP | BPF_JGE | BPF_X:
2994 + case BPF_JMP | BPF_JLT | BPF_X:
2995 + case BPF_JMP | BPF_JLE | BPF_X:
2996 + case BPF_JMP | BPF_JSGT | BPF_X:
2997 + case BPF_JMP | BPF_JSGE | BPF_X:
2998 + case BPF_JMP | BPF_JSLT | BPF_X:
2999 + case BPF_JMP | BPF_JSLE | BPF_X:
3000 + if (off == 0)
3001 + break;
3002 + setup_jmp_r(ctx, dst == src, BPF_OP(code), off, &jmp, &rel);
3003 + emit_jmp_r64(ctx, dst, src, rel, jmp);
3004 + if (finish_jmp(ctx, jmp, off) < 0)
3005 + goto toofar;
3006 + break;
3007 + /* PC += off if dst == imm */
3008 + /* PC += off if dst != imm */
3009 + /* PC += off if dst & imm */
3010 + /* PC += off if dst > imm */
3011 + /* PC += off if dst >= imm */
3012 + /* PC += off if dst < imm */
3013 + /* PC += off if dst <= imm */
3014 + /* PC += off if dst > imm (signed) */
3015 + /* PC += off if dst >= imm (signed) */
3016 + /* PC += off if dst < imm (signed) */
3017 + /* PC += off if dst <= imm (signed) */
3018 + case BPF_JMP | BPF_JEQ | BPF_K:
3019 + case BPF_JMP | BPF_JNE | BPF_K:
3020 + case BPF_JMP | BPF_JSET | BPF_K:
3021 + case BPF_JMP | BPF_JGT | BPF_K:
3022 + case BPF_JMP | BPF_JGE | BPF_K:
3023 + case BPF_JMP | BPF_JLT | BPF_K:
3024 + case BPF_JMP | BPF_JLE | BPF_K:
3025 + case BPF_JMP | BPF_JSGT | BPF_K:
3026 + case BPF_JMP | BPF_JSGE | BPF_K:
3027 + case BPF_JMP | BPF_JSLT | BPF_K:
3028 + case BPF_JMP | BPF_JSLE | BPF_K:
3029 + if (off == 0)
3030 + break;
3031 + setup_jmp_i(ctx, imm, 64, BPF_OP(code), off, &jmp, &rel);
3032 + emit_jmp_i64(ctx, dst, imm, rel, jmp);
3033 + if (finish_jmp(ctx, jmp, off) < 0)
3034 + goto toofar;
3035 + break;
3036 + /* PC += off */
3037 + case BPF_JMP | BPF_JA:
3038 + if (off == 0)
3039 + break;
3040 + if (emit_ja(ctx, off) < 0)
3041 + goto toofar;
3042 + break;
3043 + /* Tail call */
3044 + case BPF_JMP | BPF_TAIL_CALL:
3045 + if (emit_tail_call(ctx) < 0)
3046 + goto invalid;
3047 + break;
3048 + /* Function call */
3049 + case BPF_JMP | BPF_CALL:
3050 + if (emit_call(ctx, insn) < 0)
3051 + goto invalid;
3052 + break;
3053 + /* Function return */
3054 + case BPF_JMP | BPF_EXIT:
3055 + /*
3056 + * Optimization: when last instruction is EXIT
3057 + * simply continue to epilogue.
3058 + */
3059 + if (ctx->bpf_index == ctx->program->len - 1)
3060 + break;
3061 + if (emit_exit(ctx) < 0)
3062 + goto toofar;
3063 + break;
3064 +
3065 + default:
3066 +invalid:
3067 + pr_err_once("unknown opcode %02x\n", code);
3068 + return -EINVAL;
3069 +notyet:
3070 + pr_info_once("*** NOT YET: opcode %02x ***\n", code);
3071 + return -EFAULT;
3072 +toofar:
3073 + pr_info_once("*** TOO FAR: jump at %u opcode %02x ***\n",
3074 + ctx->bpf_index, code);
3075 + return -E2BIG;
3076 + }
3077 + return 0;
3078 +}
OpenWrt Source Repository