1/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
2/* Copyright (C) 2016-2018 Netronome Systems, Inc. */
3
4#ifndef __NFP_BPF_H__
5#define __NFP_BPF_H__ 1
6
7#include <linux/bitfield.h>
8#include <linux/bpf.h>
9#include <linux/bpf_verifier.h>
10#include <linux/kernel.h>
11#include <linux/list.h>
12#include <linux/rhashtable.h>
13#include <linux/skbuff.h>
14#include <linux/types.h>
15#include <linux/wait.h>
16
17#include "../ccm.h"
18#include "../nfp_asm.h"
19#include "fw.h"
20
21#define cmsg_warn(bpf, msg...) nn_dp_warn(&(bpf)->app->ctrl->dp, msg)
22
23/* For relocation logic use up-most byte of branch instruction as scratch
24 * area. Remember to clear this before sending instructions to HW!
25 */
26#define OP_RELO_TYPE 0xff00000000000000ULL
27
28enum nfp_relo_type {
29 RELO_NONE = 0,
30 /* standard internal jumps */
31 RELO_BR_REL,
32 /* internal jumps to parts of the outro */
33 RELO_BR_GO_OUT,
34 RELO_BR_GO_ABORT,
35 RELO_BR_GO_CALL_PUSH_REGS,
36 RELO_BR_GO_CALL_POP_REGS,
37 /* external jumps to fixed addresses */
38 RELO_BR_NEXT_PKT,
39 RELO_BR_HELPER,
40 /* immediate relocation against load address */
41 RELO_IMMED_REL,
42};
43
44/* To make absolute relocated branches (branches other than RELO_BR_REL)
45 * distinguishable in user space dumps from normal jumps, add a large offset
46 * to them.
47 */
48#define BR_OFF_RELO 15000
49
50enum static_regs {
51 STATIC_REG_IMMA = 20, /* Bank AB */
52 STATIC_REG_IMM = 21, /* Bank AB */
53 STATIC_REG_STACK = 22, /* Bank A */
54 STATIC_REG_PKT_LEN = 22, /* Bank B */
55};
56
57enum pkt_vec {
58 PKT_VEC_PKT_LEN = 0,
59 PKT_VEC_PKT_PTR = 2,
60 PKT_VEC_QSEL_SET = 4,
61 PKT_VEC_QSEL_VAL = 6,
62};
63
64#define PKT_VEL_QSEL_SET_BIT 4
65
66#define pv_len(np) reg_lm(1, PKT_VEC_PKT_LEN)
67#define pv_ctm_ptr(np) reg_lm(1, PKT_VEC_PKT_PTR)
68#define pv_qsel_set(np) reg_lm(1, PKT_VEC_QSEL_SET)
69#define pv_qsel_val(np) reg_lm(1, PKT_VEC_QSEL_VAL)
70
71#define stack_reg(np) reg_a(STATIC_REG_STACK)
72#define stack_imm(np) imm_b(np)
73#define plen_reg(np) reg_b(STATIC_REG_PKT_LEN)
74#define pptr_reg(np) pv_ctm_ptr(np)
75#define imm_a(np) reg_a(STATIC_REG_IMM)
76#define imm_b(np) reg_b(STATIC_REG_IMM)
77#define imma_a(np) reg_a(STATIC_REG_IMMA)
78#define imma_b(np) reg_b(STATIC_REG_IMMA)
79#define imm_both(np) reg_both(STATIC_REG_IMM)
80#define ret_reg(np) imm_a(np)
81
82#define NFP_BPF_ABI_FLAGS reg_imm(0)
83#define NFP_BPF_ABI_FLAG_MARK 1
84
85/**
86 * struct nfp_app_bpf - bpf app priv structure
87 * @app: backpointer to the app
88 * @ccm: common control message handler data
89 *
90 * @bpf_dev: BPF offload device handle
91 *
92 * @cmsg_key_sz: size of key in cmsg element array
93 * @cmsg_val_sz: size of value in cmsg element array
94 *
95 * @map_list: list of offloaded maps
96 * @maps_in_use: number of currently offloaded maps
97 * @map_elems_in_use: number of elements allocated to offloaded maps
98 *
99 * @maps_neutral: hash table of offload-neutral maps (on pointer)
100 *
101 * @abi_version: global BPF ABI version
102 * @cmsg_cache_cnt: number of entries to read for caching
103 *
104 * @adjust_head: adjust head capability
105 * @adjust_head.flags: extra flags for adjust head
106 * @adjust_head.off_min: minimal packet offset within buffer required
107 * @adjust_head.off_max: maximum packet offset within buffer required
108 * @adjust_head.guaranteed_sub: negative adjustment guaranteed possible
109 * @adjust_head.guaranteed_add: positive adjustment guaranteed possible
110 *
111 * @maps: map capability
112 * @maps.types: supported map types
113 * @maps.max_maps: max number of maps supported
114 * @maps.max_elems: max number of entries in each map
115 * @maps.max_key_sz: max size of map key
116 * @maps.max_val_sz: max size of map value
117 * @maps.max_elem_sz: max size of map entry (key + value)
118 *
119 * @helpers: helper addressess for various calls
120 * @helpers.map_lookup: map lookup helper address
121 * @helpers.map_update: map update helper address
122 * @helpers.map_delete: map delete helper address
123 * @helpers.perf_event_output: output perf event to a ring buffer
124 *
125 * @pseudo_random: FW initialized the pseudo-random machinery (CSRs)
126 * @queue_select: BPF can set the RX queue ID in packet vector
127 * @adjust_tail: BPF can simply trunc packet size for adjust tail
128 * @cmsg_multi_ent: FW can pack multiple map entries in a single cmsg
129 */
130struct nfp_app_bpf {
131 struct nfp_app *app;
132 struct nfp_ccm ccm;
133
134 struct bpf_offload_dev *bpf_dev;
135
136 unsigned int cmsg_key_sz;
137 unsigned int cmsg_val_sz;
138
139 unsigned int cmsg_cache_cnt;
140
141 struct list_head map_list;
142 unsigned int maps_in_use;
143 unsigned int map_elems_in_use;
144
145 struct rhashtable maps_neutral;
146
147 u32 abi_version;
148
149 struct nfp_bpf_cap_adjust_head {
150 u32 flags;
151 int off_min;
152 int off_max;
153 int guaranteed_sub;
154 int guaranteed_add;
155 } adjust_head;
156
157 struct {
158 u32 types;
159 u32 max_maps;
160 u32 max_elems;
161 u32 max_key_sz;
162 u32 max_val_sz;
163 u32 max_elem_sz;
164 } maps;
165
166 struct {
167 u32 map_lookup;
168 u32 map_update;
169 u32 map_delete;
170 u32 perf_event_output;
171 } helpers;
172
173 bool pseudo_random;
174 bool queue_select;
175 bool adjust_tail;
176 bool cmsg_multi_ent;
177};
178
179enum nfp_bpf_map_use {
180 NFP_MAP_UNUSED = 0,
181 NFP_MAP_USE_READ,
182 NFP_MAP_USE_WRITE,
183 NFP_MAP_USE_ATOMIC_CNT,
184};
185
186struct nfp_bpf_map_word {
187 unsigned char type :4;
188 unsigned char non_zero_update :1;
189};
190
191#define NFP_BPF_MAP_CACHE_CNT 4U
192#define NFP_BPF_MAP_CACHE_TIME_NS (250 * 1000)
193
194/**
195 * struct nfp_bpf_map - private per-map data attached to BPF maps for offload
196 * @offmap: pointer to the offloaded BPF map
197 * @bpf: back pointer to bpf app private structure
198 * @tid: table id identifying map on datapath
199 *
200 * @cache_lock: protects @cache_blockers, @cache_to, @cache
201 * @cache_blockers: number of ops in flight which block caching
202 * @cache_gen: counter incremented by every blocker on exit
203 * @cache_to: time when cache will no longer be valid (ns)
204 * @cache: skb with cached response
205 *
206 * @l: link on the nfp_app_bpf->map_list list
207 * @use_map: map of how the value is used (in 4B chunks)
208 */
209struct nfp_bpf_map {
210 struct bpf_offloaded_map *offmap;
211 struct nfp_app_bpf *bpf;
212 u32 tid;
213
214 spinlock_t cache_lock;
215 u32 cache_blockers;
216 u32 cache_gen;
217 u64 cache_to;
218 struct sk_buff *cache;
219
220 struct list_head l;
221 struct nfp_bpf_map_word use_map[];
222};
223
224struct nfp_bpf_neutral_map {
225 struct rhash_head l;
226 struct bpf_map *ptr;
227 u32 map_id;
228 u32 count;
229};
230
231extern const struct rhashtable_params nfp_bpf_maps_neutral_params;
232
233struct nfp_prog;
234struct nfp_insn_meta;
235typedef int (*instr_cb_t)(struct nfp_prog *, struct nfp_insn_meta *);
236
237#define nfp_prog_first_meta(nfp_prog) \
238 list_first_entry(&(nfp_prog)->insns, struct nfp_insn_meta, l)
239#define nfp_prog_last_meta(nfp_prog) \
240 list_last_entry(&(nfp_prog)->insns, struct nfp_insn_meta, l)
241#define nfp_meta_next(meta) list_next_entry(meta, l)
242#define nfp_meta_prev(meta) list_prev_entry(meta, l)
243
244/**
245 * struct nfp_bpf_reg_state - register state for calls
246 * @reg: BPF register state from latest path
247 * @var_off: for stack arg - changes stack offset on different paths
248 */
249struct nfp_bpf_reg_state {
250 struct bpf_reg_state reg;
251 bool var_off;
252};
253
254#define FLAG_INSN_IS_JUMP_DST BIT(0)
255#define FLAG_INSN_IS_SUBPROG_START BIT(1)
256#define FLAG_INSN_PTR_CALLER_STACK_FRAME BIT(2)
257/* Instruction is pointless, noop even on its own */
258#define FLAG_INSN_SKIP_NOOP BIT(3)
259/* Instruction is optimized out based on preceding instructions */
260#define FLAG_INSN_SKIP_PREC_DEPENDENT BIT(4)
261/* Instruction is optimized by the verifier */
262#define FLAG_INSN_SKIP_VERIFIER_OPT BIT(5)
263/* Instruction needs to zero extend to high 32-bit */
264#define FLAG_INSN_DO_ZEXT BIT(6)
265
266#define FLAG_INSN_SKIP_MASK (FLAG_INSN_SKIP_NOOP | \
267 FLAG_INSN_SKIP_PREC_DEPENDENT | \
268 FLAG_INSN_SKIP_VERIFIER_OPT)
269
270/**
271 * struct nfp_insn_meta - BPF instruction wrapper
272 * @insn: BPF instruction
273 * @ptr: pointer type for memory operations
274 * @ldst_gather_len: memcpy length gathered from load/store sequence
275 * @paired_st: the paired store insn at the head of the sequence
276 * @ptr_not_const: pointer is not always constant
277 * @pkt_cache: packet data cache information
278 * @pkt_cache.range_start: start offset for associated packet data cache
279 * @pkt_cache.range_end: end offset for associated packet data cache
280 * @pkt_cache.do_init: this read needs to initialize packet data cache
281 * @xadd_over_16bit: 16bit immediate is not guaranteed
282 * @xadd_maybe_16bit: 16bit immediate is possible
283 * @jmp_dst: destination info for jump instructions
284 * @jump_neg_op: jump instruction has inverted immediate, use ADD instead of SUB
285 * @num_insns_after_br: number of insns following a branch jump, used for fixup
286 * @func_id: function id for call instructions
287 * @arg1: arg1 for call instructions
288 * @arg2: arg2 for call instructions
289 * @umin_src: copy of core verifier umin_value for src opearnd.
290 * @umax_src: copy of core verifier umax_value for src operand.
291 * @umin_dst: copy of core verifier umin_value for dst opearnd.
292 * @umax_dst: copy of core verifier umax_value for dst operand.
293 * @off: index of first generated machine instruction (in nfp_prog.prog)
294 * @n: eBPF instruction number
295 * @flags: eBPF instruction extra optimization flags
296 * @subprog_idx: index of subprogram to which the instruction belongs
297 * @double_cb: callback for second part of the instruction
298 * @l: link on nfp_prog->insns list
299 */
300struct nfp_insn_meta {
301 struct bpf_insn insn;
302 union {
303 /* pointer ops (ld/st/xadd) */
304 struct {
305 struct bpf_reg_state ptr;
306 struct bpf_insn *paired_st;
307 s16 ldst_gather_len;
308 bool ptr_not_const;
309 struct {
310 s16 range_start;
311 s16 range_end;
312 bool do_init;
313 } pkt_cache;
314 bool xadd_over_16bit;
315 bool xadd_maybe_16bit;
316 };
317 /* jump */
318 struct {
319 struct nfp_insn_meta *jmp_dst;
320 bool jump_neg_op;
321 u32 num_insns_after_br; /* only for BPF-to-BPF calls */
322 };
323 /* function calls */
324 struct {
325 u32 func_id;
326 struct bpf_reg_state arg1;
327 struct nfp_bpf_reg_state arg2;
328 };
329 /* We are interested in range info for operands of ALU
330 * operations. For example, shift amount, multiplicand and
331 * multiplier etc.
332 */
333 struct {
334 u64 umin_src;
335 u64 umax_src;
336 u64 umin_dst;
337 u64 umax_dst;
338 };
339 };
340 unsigned int off;
341 unsigned short n;
342 unsigned short flags;
343 unsigned short subprog_idx;
344 instr_cb_t double_cb;
345
346 struct list_head l;
347};
348
349#define BPF_SIZE_MASK 0x18
350
351static inline u8 mbpf_class(const struct nfp_insn_meta *meta)
352{
353 return BPF_CLASS(meta->insn.code);
354}
355
356static inline u8 mbpf_src(const struct nfp_insn_meta *meta)
357{
358 return BPF_SRC(meta->insn.code);
359}
360
361static inline u8 mbpf_op(const struct nfp_insn_meta *meta)
362{
363 return BPF_OP(meta->insn.code);
364}
365
366static inline u8 mbpf_mode(const struct nfp_insn_meta *meta)
367{
368 return BPF_MODE(meta->insn.code);
369}
370
371static inline bool is_mbpf_alu(const struct nfp_insn_meta *meta)
372{
373 return mbpf_class(meta) == BPF_ALU64 || mbpf_class(meta) == BPF_ALU;
374}
375
376static inline bool is_mbpf_load(const struct nfp_insn_meta *meta)
377{
378 return (meta->insn.code & ~BPF_SIZE_MASK) == (BPF_LDX | BPF_MEM);
379}
380
381static inline bool is_mbpf_jmp32(const struct nfp_insn_meta *meta)
382{
383 return mbpf_class(meta) == BPF_JMP32;
384}
385
386static inline bool is_mbpf_jmp64(const struct nfp_insn_meta *meta)
387{
388 return mbpf_class(meta) == BPF_JMP;
389}
390
391static inline bool is_mbpf_jmp(const struct nfp_insn_meta *meta)
392{
393 return is_mbpf_jmp32(meta) || is_mbpf_jmp64(meta);
394}
395
396static inline bool is_mbpf_store(const struct nfp_insn_meta *meta)
397{
398 return (meta->insn.code & ~BPF_SIZE_MASK) == (BPF_STX | BPF_MEM);
399}
400
401static inline bool is_mbpf_load_pkt(const struct nfp_insn_meta *meta)
402{
403 return is_mbpf_load(meta) && meta->ptr.type == PTR_TO_PACKET;
404}
405
406static inline bool is_mbpf_store_pkt(const struct nfp_insn_meta *meta)
407{
408 return is_mbpf_store(meta) && meta->ptr.type == PTR_TO_PACKET;
409}
410
411static inline bool is_mbpf_classic_load(const struct nfp_insn_meta *meta)
412{
413 u8 code = meta->insn.code;
414
415 return BPF_CLASS(code) == BPF_LD &&
416 (BPF_MODE(code) == BPF_ABS || BPF_MODE(code) == BPF_IND);
417}
418
419static inline bool is_mbpf_classic_store(const struct nfp_insn_meta *meta)
420{
421 u8 code = meta->insn.code;
422
423 return BPF_CLASS(code) == BPF_ST && BPF_MODE(code) == BPF_MEM;
424}
425
426static inline bool is_mbpf_classic_store_pkt(const struct nfp_insn_meta *meta)
427{
428 return is_mbpf_classic_store(meta) && meta->ptr.type == PTR_TO_PACKET;
429}
430
431static inline bool is_mbpf_atomic(const struct nfp_insn_meta *meta)
432{
433 return (meta->insn.code & ~BPF_SIZE_MASK) == (BPF_STX | BPF_ATOMIC);
434}
435
436static inline bool is_mbpf_mul(const struct nfp_insn_meta *meta)
437{
438 return is_mbpf_alu(meta) && mbpf_op(meta) == BPF_MUL;
439}
440
441static inline bool is_mbpf_div(const struct nfp_insn_meta *meta)
442{
443 return is_mbpf_alu(meta) && mbpf_op(meta) == BPF_DIV;
444}
445
446static inline bool is_mbpf_cond_jump(const struct nfp_insn_meta *meta)
447{
448 u8 op;
449
450 if (is_mbpf_jmp32(meta))
451 return true;
452
453 if (!is_mbpf_jmp64(meta))
454 return false;
455
456 op = mbpf_op(meta);
457 return op != BPF_JA && op != BPF_EXIT && op != BPF_CALL;
458}
459
460static inline bool is_mbpf_helper_call(const struct nfp_insn_meta *meta)
461{
462 struct bpf_insn insn = meta->insn;
463
464 return insn.code == (BPF_JMP | BPF_CALL) &&
465 insn.src_reg != BPF_PSEUDO_CALL;
466}
467
468static inline bool is_mbpf_pseudo_call(const struct nfp_insn_meta *meta)
469{
470 struct bpf_insn insn = meta->insn;
471
472 return insn.code == (BPF_JMP | BPF_CALL) &&
473 insn.src_reg == BPF_PSEUDO_CALL;
474}
475
476#define STACK_FRAME_ALIGN 64
477
478/**
479 * struct nfp_bpf_subprog_info - nfp BPF sub-program (a.k.a. function) info
480 * @stack_depth: maximum stack depth used by this sub-program
481 * @needs_reg_push: whether sub-program uses callee-saved registers
482 */
483struct nfp_bpf_subprog_info {
484 u16 stack_depth;
485 u8 needs_reg_push : 1;
486};
487
488/**
489 * struct nfp_prog - nfp BPF program
490 * @bpf: backpointer to the bpf app priv structure
491 * @prog: machine code
492 * @prog_len: number of valid instructions in @prog array
493 * @__prog_alloc_len: alloc size of @prog array
494 * @stack_size: total amount of stack used
495 * @verifier_meta: temporary storage for verifier's insn meta
496 * @type: BPF program type
497 * @last_bpf_off: address of the last instruction translated from BPF
498 * @tgt_out: jump target for normal exit
499 * @tgt_abort: jump target for abort (e.g. access outside of packet buffer)
500 * @tgt_call_push_regs: jump target for subroutine for saving R6~R9 to stack
501 * @tgt_call_pop_regs: jump target for subroutine used for restoring R6~R9
502 * @n_translated: number of successfully translated instructions (for errors)
503 * @error: error code if something went wrong
504 * @stack_frame_depth: max stack depth for current frame
505 * @adjust_head_location: if program has single adjust head call - the insn no.
506 * @map_records_cnt: the number of map pointers recorded for this prog
507 * @subprog_cnt: number of sub-programs, including main function
508 * @map_records: the map record pointers from bpf->maps_neutral
509 * @subprog: pointer to an array of objects holding info about sub-programs
510 * @n_insns: number of instructions on @insns list
511 * @insns: list of BPF instruction wrappers (struct nfp_insn_meta)
512 */
513struct nfp_prog {
514 struct nfp_app_bpf *bpf;
515
516 u64 *prog;
517 unsigned int prog_len;
518 unsigned int __prog_alloc_len;
519
520 unsigned int stack_size;
521
522 struct nfp_insn_meta *verifier_meta;
523
524 enum bpf_prog_type type;
525
526 unsigned int last_bpf_off;
527 unsigned int tgt_out;
528 unsigned int tgt_abort;
529 unsigned int tgt_call_push_regs;
530 unsigned int tgt_call_pop_regs;
531
532 unsigned int n_translated;
533 int error;
534
535 unsigned int stack_frame_depth;
536 unsigned int adjust_head_location;
537
538 unsigned int map_records_cnt;
539 unsigned int subprog_cnt;
540 struct nfp_bpf_neutral_map **map_records;
541 struct nfp_bpf_subprog_info *subprog;
542
543 unsigned int n_insns;
544 struct list_head insns;
545};
546
547/**
548 * struct nfp_bpf_vnic - per-vNIC BPF priv structure
549 * @tc_prog: currently loaded cls_bpf program
550 * @start_off: address of the first instruction in the memory
551 * @tgt_done: jump target to get the next packet
552 */
553struct nfp_bpf_vnic {
554 struct bpf_prog *tc_prog;
555 unsigned int start_off;
556 unsigned int tgt_done;
557};
558
559bool nfp_is_subprog_start(struct nfp_insn_meta *meta);
560void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog);
561int nfp_bpf_jit(struct nfp_prog *prog);
562bool nfp_bpf_supported_opcode(u8 code);
563bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog,
564 unsigned int mtu);
565
566int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx,
567 int prev_insn_idx);
568int nfp_bpf_finalize(struct bpf_verifier_env *env);
569
570int nfp_bpf_opt_replace_insn(struct bpf_verifier_env *env, u32 off,
571 struct bpf_insn *insn);
572int nfp_bpf_opt_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt);
573
574extern const struct bpf_prog_offload_ops nfp_bpf_dev_ops;
575
576struct netdev_bpf;
577struct nfp_app;
578struct nfp_net;
579
580int nfp_ndo_bpf(struct nfp_app *app, struct nfp_net *nn,
581 struct netdev_bpf *bpf);
582int nfp_net_bpf_offload(struct nfp_net *nn, struct bpf_prog *prog,
583 bool old_prog, struct netlink_ext_ack *extack);
584
585struct nfp_insn_meta *
586nfp_bpf_goto_meta(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
587 unsigned int insn_idx);
588
589void *nfp_bpf_relo_for_vnic(struct nfp_prog *nfp_prog, struct nfp_bpf_vnic *bv);
590
591unsigned int nfp_bpf_ctrl_cmsg_min_mtu(struct nfp_app_bpf *bpf);
592unsigned int nfp_bpf_ctrl_cmsg_mtu(struct nfp_app_bpf *bpf);
593unsigned int nfp_bpf_ctrl_cmsg_cache_cnt(struct nfp_app_bpf *bpf);
594long long int
595nfp_bpf_ctrl_alloc_map(struct nfp_app_bpf *bpf, struct bpf_map *map);
596void
597nfp_bpf_ctrl_free_map(struct nfp_app_bpf *bpf, struct nfp_bpf_map *nfp_map);
598int nfp_bpf_ctrl_getfirst_entry(struct bpf_offloaded_map *offmap,
599 void *next_key);
600int nfp_bpf_ctrl_update_entry(struct bpf_offloaded_map *offmap,
601 void *key, void *value, u64 flags);
602int nfp_bpf_ctrl_del_entry(struct bpf_offloaded_map *offmap, void *key);
603int nfp_bpf_ctrl_lookup_entry(struct bpf_offloaded_map *offmap,
604 void *key, void *value);
605int nfp_bpf_ctrl_getnext_entry(struct bpf_offloaded_map *offmap,
606 void *key, void *next_key);
607
608int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data,
609 unsigned int len);
610
611void nfp_bpf_ctrl_msg_rx(struct nfp_app *app, struct sk_buff *skb);
612void
613nfp_bpf_ctrl_msg_rx_raw(struct nfp_app *app, const void *data,
614 unsigned int len);
615#endif
616

source code of linux/drivers/net/ethernet/netronome/nfp/bpf/main.h