Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3d9b9f3 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'bpf-hw-offload' 



Jakub Kicinski says:

====================
BPF hardware offload (cls_bpf for now)

Rebased and improved.

v7:
 - fix patch 4.
v6 (patch 8 only):
 - explicitly check for registers >= MAX_BPF_REG;
 - fix leaky error path.
v5:
 - fix names of guard defines in bpf_verfier.h.
v4:
 - rename parser -> analyzer;
 - reorganize the analyzer patches a bit;
 - use bitfield.h directly.

--- merge blurb:
In the last year a lot of progress have been made on offloading
simpler TC classifiers.  There is also growing interest in using
BPF for generic high-speed packet processing in the kernel.
It seems beneficial to tie those two trends together and think
about hardware offloads of BPF programs.  This patch set presents
such offload to Netronome smart NICs.  cls_bpf is extended with
hardware offload capabilities and NFP driver gets a JIT translator
which in presence of capable firmware can be used to offload
the BPF program onto the card.

BPF JIT implementation is not 100% complete (e.g. missing instructions)
but it is functional.  Encouragingly it should be possible to
offload most (if not all) advanced BPF features onto the NIC -
including packet modification, maps, tunnel encap/decap etc.

Example of basic tests I used:
  __section_cls_entry
  int cls_entry(struct __sk_buff *skb)
  {
	if (load_byte(skb, 0) != 0x0)
		return 0;

	if (load_byte(skb, 4) != 0x1)
		return 0;

	skb->mark = 0xcafe;

	if (load_byte(skb, 50) != 0xff)
		return 0;

	return ~0U;
  }

Above code can be compiled with Clang and loaded like this:

	ethtool -K p1p1 hw-tc-offload on
	tc qdisc add dev p1p1 ingress
	tc filter add dev p1p1 parent ffff:  bpf obj prog.o action drop

This set implements the basic transparent offload, the skip_{sw,hw}
flags and reporting statistics for cls_bpf.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 2d7a8926 e3b8baf0

drivers/net/ethernet/netronome/nfp/Makefile

+7 −0
Original line number Diff line number Diff line
@@ -3,6 +3,13 @@ obj-$(CONFIG_NFP_NETVF) += nfp_netvf.o 
nfp_netvf-objs := \

	    nfp_net_common.o \

	    nfp_net_ethtool.o \

	    nfp_net_offload.o \

	    nfp_netvf_main.o



ifeq ($(CONFIG_BPF_SYSCALL),y)

nfp_netvf-objs += \

	    nfp_bpf_verifier.o \

	    nfp_bpf_jit.o

endif



nfp_netvf-$(CONFIG_NFP_NET_DEBUG) += nfp_net_debugfs.o

drivers/net/ethernet/netronome/nfp/nfp_asm.h

0 → 100644
+233 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2016 Netronome Systems, Inc.

 *

 * This software is dual licensed under the GNU General License Version 2,

 * June 1991 as shown in the file COPYING in the top-level directory of this

 * source tree or the BSD 2-Clause License provided below.  You have the

 * option to license this software under the complete terms of either license.

 *

 * The BSD 2-Clause License:

 *

 *     Redistribution and use in source and binary forms, with or

 *     without modification, are permitted provided that the following

 *     conditions are met:

 *

 *      1. Redistributions of source code must retain the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer.

 *

 *      2. Redistributions in binary form must reproduce the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer in the documentation and/or other materials

 *         provided with the distribution.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 */



#ifndef __NFP_ASM_H__

#define __NFP_ASM_H__ 1



#include "nfp_bpf.h"



#define REG_NONE	0



#define RE_REG_NO_DST	0x020

#define RE_REG_IMM	0x020

#define RE_REG_IMM_encode(x)					\

	(RE_REG_IMM | ((x) & 0x1f) | (((x) & 0x60) << 1))

#define RE_REG_IMM_MAX	 0x07fULL

#define RE_REG_XFR	0x080



#define UR_REG_XFR	0x180

#define UR_REG_NN	0x280

#define UR_REG_NO_DST	0x300

#define UR_REG_IMM	UR_REG_NO_DST

#define UR_REG_IMM_encode(x) (UR_REG_IMM | (x))

#define UR_REG_IMM_MAX	 0x0ffULL



#define OP_BR_BASE	0x0d800000020ULL

#define OP_BR_BASE_MASK	0x0f8000c3ce0ULL

#define OP_BR_MASK	0x0000000001fULL

#define OP_BR_EV_PIP	0x00000000300ULL

#define OP_BR_CSS	0x0000003c000ULL

#define OP_BR_DEFBR	0x00000300000ULL

#define OP_BR_ADDR_LO	0x007ffc00000ULL

#define OP_BR_ADDR_HI	0x10000000000ULL



#define nfp_is_br(_insn)				\

	(((_insn) & OP_BR_BASE_MASK) == OP_BR_BASE)



enum br_mask {

	BR_BEQ = 0x00,

	BR_BNE = 0x01,

	BR_BHS = 0x04,

	BR_BLO = 0x05,

	BR_BGE = 0x08,

	BR_UNC = 0x18,

};



enum br_ev_pip {

	BR_EV_PIP_UNCOND = 0,

	BR_EV_PIP_COND = 1,

};



enum br_ctx_signal_state {

	BR_CSS_NONE = 2,

};



#define OP_BBYTE_BASE	0x0c800000000ULL

#define OP_BB_A_SRC	0x000000000ffULL

#define OP_BB_BYTE	0x00000000300ULL

#define OP_BB_B_SRC	0x0000003fc00ULL

#define OP_BB_I8	0x00000040000ULL

#define OP_BB_EQ	0x00000080000ULL

#define OP_BB_DEFBR	0x00000300000ULL

#define OP_BB_ADDR_LO	0x007ffc00000ULL

#define OP_BB_ADDR_HI	0x10000000000ULL



#define OP_BALU_BASE	0x0e800000000ULL

#define OP_BA_A_SRC	0x000000003ffULL

#define OP_BA_B_SRC	0x000000ffc00ULL

#define OP_BA_DEFBR	0x00000300000ULL

#define OP_BA_ADDR_HI	0x0007fc00000ULL



#define OP_IMMED_A_SRC	0x000000003ffULL

#define OP_IMMED_B_SRC	0x000000ffc00ULL

#define OP_IMMED_IMM	0x0000ff00000ULL

#define OP_IMMED_WIDTH	0x00060000000ULL

#define OP_IMMED_INV	0x00080000000ULL

#define OP_IMMED_SHIFT	0x00600000000ULL

#define OP_IMMED_BASE	0x0f000000000ULL

#define OP_IMMED_WR_AB	0x20000000000ULL



enum immed_width {

	IMMED_WIDTH_ALL = 0,

	IMMED_WIDTH_BYTE = 1,

	IMMED_WIDTH_WORD = 2,

};



enum immed_shift {

	IMMED_SHIFT_0B = 0,

	IMMED_SHIFT_1B = 1,

	IMMED_SHIFT_2B = 2,

};



#define OP_SHF_BASE	0x08000000000ULL

#define OP_SHF_A_SRC	0x000000000ffULL

#define OP_SHF_SC	0x00000000300ULL

#define OP_SHF_B_SRC	0x0000003fc00ULL

#define OP_SHF_I8	0x00000040000ULL

#define OP_SHF_SW	0x00000080000ULL

#define OP_SHF_DST	0x0000ff00000ULL

#define OP_SHF_SHIFT	0x001f0000000ULL

#define OP_SHF_OP	0x00e00000000ULL

#define OP_SHF_DST_AB	0x01000000000ULL

#define OP_SHF_WR_AB	0x20000000000ULL



enum shf_op {

	SHF_OP_NONE = 0,

	SHF_OP_AND = 2,

	SHF_OP_OR = 5,

};



enum shf_sc {

	SHF_SC_R_ROT = 0,

	SHF_SC_R_SHF = 1,

	SHF_SC_L_SHF = 2,

	SHF_SC_R_DSHF = 3,

};



#define OP_ALU_A_SRC	0x000000003ffULL

#define OP_ALU_B_SRC	0x000000ffc00ULL

#define OP_ALU_DST	0x0003ff00000ULL

#define OP_ALU_SW	0x00040000000ULL

#define OP_ALU_OP	0x00f80000000ULL

#define OP_ALU_DST_AB	0x01000000000ULL

#define OP_ALU_BASE	0x0a000000000ULL

#define OP_ALU_WR_AB	0x20000000000ULL



enum alu_op {

	ALU_OP_NONE	= 0x00,

	ALU_OP_ADD	= 0x01,

	ALU_OP_NEG	= 0x04,

	ALU_OP_AND	= 0x08,

	ALU_OP_SUB_C	= 0x0d,

	ALU_OP_ADD_C	= 0x11,

	ALU_OP_OR	= 0x14,

	ALU_OP_SUB	= 0x15,

	ALU_OP_XOR	= 0x18,

};



enum alu_dst_ab {

	ALU_DST_A = 0,

	ALU_DST_B = 1,

};



#define OP_LDF_BASE	0x0c000000000ULL

#define OP_LDF_A_SRC	0x000000000ffULL

#define OP_LDF_SC	0x00000000300ULL

#define OP_LDF_B_SRC	0x0000003fc00ULL

#define OP_LDF_I8	0x00000040000ULL

#define OP_LDF_SW	0x00000080000ULL

#define OP_LDF_ZF	0x00000100000ULL

#define OP_LDF_BMASK	0x0000f000000ULL

#define OP_LDF_SHF	0x001f0000000ULL

#define OP_LDF_WR_AB	0x20000000000ULL



#define OP_CMD_A_SRC	 0x000000000ffULL

#define OP_CMD_CTX	 0x00000000300ULL

#define OP_CMD_B_SRC	 0x0000003fc00ULL

#define OP_CMD_TOKEN	 0x000000c0000ULL

#define OP_CMD_XFER	 0x00001f00000ULL

#define OP_CMD_CNT	 0x0000e000000ULL

#define OP_CMD_SIG	 0x000f0000000ULL

#define OP_CMD_TGT_CMD	 0x07f00000000ULL

#define OP_CMD_MODE	0x1c0000000000ULL



struct cmd_tgt_act {

	u8 token;

	u8 tgt_cmd;

};



enum cmd_tgt_map {

	CMD_TGT_READ8,

	CMD_TGT_WRITE8,

	CMD_TGT_READ_LE,

	CMD_TGT_READ_SWAP_LE,

	__CMD_TGT_MAP_SIZE,

};



enum cmd_mode {

	CMD_MODE_40b_AB	= 0,

	CMD_MODE_40b_BA	= 1,

	CMD_MODE_32b	= 4,

};



enum cmd_ctx_swap {

	CMD_CTX_SWAP = 0,

	CMD_CTX_NO_SWAP = 3,

};



#define OP_LCSR_BASE	0x0fc00000000ULL

#define OP_LCSR_A_SRC	0x000000003ffULL

#define OP_LCSR_B_SRC	0x000000ffc00ULL

#define OP_LCSR_WRITE	0x00000200000ULL

#define OP_LCSR_ADDR	0x001ffc00000ULL



enum lcsr_wr_src {

	LCSR_WR_AREG,

	LCSR_WR_BREG,

	LCSR_WR_IMM,

};



#define OP_CARB_BASE	0x0e000000000ULL

#define OP_CARB_OR	0x00000010000ULL



#endif

drivers/net/ethernet/netronome/nfp/nfp_bpf.h

0 → 100644
+212 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2016 Netronome Systems, Inc.

 *

 * This software is dual licensed under the GNU General License Version 2,

 * June 1991 as shown in the file COPYING in the top-level directory of this

 * source tree or the BSD 2-Clause License provided below.  You have the

 * option to license this software under the complete terms of either license.

 *

 * The BSD 2-Clause License:

 *

 *     Redistribution and use in source and binary forms, with or

 *     without modification, are permitted provided that the following

 *     conditions are met:

 *

 *      1. Redistributions of source code must retain the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer.

 *

 *      2. Redistributions in binary form must reproduce the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer in the documentation and/or other materials

 *         provided with the distribution.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 */



#ifndef __NFP_BPF_H__

#define __NFP_BPF_H__ 1



#include <linux/bitfield.h>

#include <linux/bpf.h>

#include <linux/list.h>

#include <linux/types.h>



#define FIELD_FIT(mask, val)  (!((((u64)val) << __bf_shf(mask)) & ~(mask)))



/* For branch fixup logic use up-most byte of branch instruction as scratch

 * area.  Remember to clear this before sending instructions to HW!

 */

#define OP_BR_SPECIAL	0xff00000000000000ULL



enum br_special {

	OP_BR_NORMAL = 0,

	OP_BR_GO_OUT,

	OP_BR_GO_ABORT,

};



enum static_regs {

	STATIC_REG_PKT		= 1,

#define REG_PKT_BANK	ALU_DST_A

	STATIC_REG_IMM		= 2, /* Bank AB */

};



enum nfp_bpf_action_type {

	NN_ACT_TC_DROP,

	NN_ACT_TC_REDIR,

	NN_ACT_DIRECT,

};



/* Software register representation, hardware encoding in asm.h */

#define NN_REG_TYPE	GENMASK(31, 24)

#define NN_REG_VAL	GENMASK(7, 0)



enum nfp_bpf_reg_type {

	NN_REG_GPR_A =	BIT(0),

	NN_REG_GPR_B =	BIT(1),

	NN_REG_NNR =	BIT(2),

	NN_REG_XFER =	BIT(3),

	NN_REG_IMM =	BIT(4),

	NN_REG_NONE =	BIT(5),

};



#define NN_REG_GPR_BOTH	(NN_REG_GPR_A | NN_REG_GPR_B)



#define reg_both(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_GPR_BOTH))

#define reg_a(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_GPR_A))

#define reg_b(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_GPR_B))

#define reg_nnr(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_NNR))

#define reg_xfer(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_XFER))

#define reg_imm(x)	((x) | FIELD_PREP(NN_REG_TYPE, NN_REG_IMM))

#define reg_none()	(FIELD_PREP(NN_REG_TYPE, NN_REG_NONE))



#define pkt_reg(np)	reg_a((np)->regs_per_thread - STATIC_REG_PKT)

#define imm_a(np)	reg_a((np)->regs_per_thread - STATIC_REG_IMM)

#define imm_b(np)	reg_b((np)->regs_per_thread - STATIC_REG_IMM)

#define imm_both(np)	reg_both((np)->regs_per_thread - STATIC_REG_IMM)



#define NFP_BPF_ABI_FLAGS	reg_nnr(0)

#define   NFP_BPF_ABI_FLAG_MARK	1

#define NFP_BPF_ABI_MARK	reg_nnr(1)

#define NFP_BPF_ABI_PKT		reg_nnr(2)

#define NFP_BPF_ABI_LEN		reg_nnr(3)



struct nfp_prog;

struct nfp_insn_meta;

typedef int (*instr_cb_t)(struct nfp_prog *, struct nfp_insn_meta *);



#define nfp_prog_first_meta(nfp_prog)					\

	list_first_entry(&(nfp_prog)->insns, struct nfp_insn_meta, l)

#define nfp_prog_last_meta(nfp_prog)					\

	list_last_entry(&(nfp_prog)->insns, struct nfp_insn_meta, l)

#define nfp_meta_next(meta)	list_next_entry(meta, l)

#define nfp_meta_prev(meta)	list_prev_entry(meta, l)



/**

 * struct nfp_insn_meta - BPF instruction wrapper

 * @insn: BPF instruction

 * @off: index of first generated machine instruction (in nfp_prog.prog)

 * @n: eBPF instruction number

 * @skip: skip this instruction (optimized out)

 * @double_cb: callback for second part of the instruction

 * @l: link on nfp_prog->insns list

 */

struct nfp_insn_meta {

	struct bpf_insn insn;

	unsigned int off;

	unsigned short n;

	bool skip;

	instr_cb_t double_cb;



	struct list_head l;

};



#define BPF_SIZE_MASK	0x18



static inline u8 mbpf_class(const struct nfp_insn_meta *meta)

{

	return BPF_CLASS(meta->insn.code);

}



static inline u8 mbpf_src(const struct nfp_insn_meta *meta)

{

	return BPF_SRC(meta->insn.code);

}



static inline u8 mbpf_op(const struct nfp_insn_meta *meta)

{

	return BPF_OP(meta->insn.code);

}



static inline u8 mbpf_mode(const struct nfp_insn_meta *meta)

{

	return BPF_MODE(meta->insn.code);

}



/**

 * struct nfp_prog - nfp BPF program

 * @prog: machine code

 * @prog_len: number of valid instructions in @prog array

 * @__prog_alloc_len: alloc size of @prog array

 * @act: BPF program/action type (TC DA, TC with action, XDP etc.)

 * @num_regs: number of registers used by this program

 * @regs_per_thread: number of basic registers allocated per thread

 * @start_off: address of the first instruction in the memory

 * @tgt_out: jump target for normal exit

 * @tgt_abort: jump target for abort (e.g. access outside of packet buffer)

 * @tgt_done: jump target to get the next packet

 * @n_translated: number of successfully translated instructions (for errors)

 * @error: error code if something went wrong

 * @insns: list of BPF instruction wrappers (struct nfp_insn_meta)

 */

struct nfp_prog {

	u64 *prog;

	unsigned int prog_len;

	unsigned int __prog_alloc_len;



	enum nfp_bpf_action_type act;



	unsigned int num_regs;

	unsigned int regs_per_thread;



	unsigned int start_off;

	unsigned int tgt_out;

	unsigned int tgt_abort;

	unsigned int tgt_done;



	unsigned int n_translated;

	int error;



	struct list_head insns;

};



struct nfp_bpf_result {

	unsigned int n_instr;

	bool dense_mode;

};



#ifdef CONFIG_BPF_SYSCALL

int

nfp_bpf_jit(struct bpf_prog *filter, void *prog, enum nfp_bpf_action_type act,

	    unsigned int prog_start, unsigned int prog_done,

	    unsigned int prog_sz, struct nfp_bpf_result *res);

#else

int

nfp_bpf_jit(struct bpf_prog *filter, void *prog, enum nfp_bpf_action_type act,

	    unsigned int prog_start, unsigned int prog_done,

	    unsigned int prog_sz, struct nfp_bpf_result *res)

{

	return -ENOTSUPP;

}

#endif



int nfp_prog_verify(struct nfp_prog *nfp_prog, struct bpf_prog *prog);



#endif

drivers/net/ethernet/netronome/nfp/nfp_bpf_jit.c

0 → 100644
+1811 −0

File added.

Preview size limit exceeded, changes collapsed.

drivers/net/ethernet/netronome/nfp/nfp_bpf_verifier.c

0 → 100644
+171 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2016 Netronome Systems, Inc.

 *

 * This software is dual licensed under the GNU General License Version 2,

 * June 1991 as shown in the file COPYING in the top-level directory of this

 * source tree or the BSD 2-Clause License provided below.  You have the

 * option to license this software under the complete terms of either license.

 *

 * The BSD 2-Clause License:

 *

 *     Redistribution and use in source and binary forms, with or

 *     without modification, are permitted provided that the following

 *     conditions are met:

 *

 *      1. Redistributions of source code must retain the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer.

 *

 *      2. Redistributions in binary form must reproduce the above

 *         copyright notice, this list of conditions and the following

 *         disclaimer in the documentation and/or other materials

 *         provided with the distribution.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 */



#define pr_fmt(fmt)	"NFP net bpf: " fmt



#include <linux/bpf.h>

#include <linux/bpf_verifier.h>

#include <linux/kernel.h>

#include <linux/pkt_cls.h>



#include "nfp_bpf.h"



/* Analyzer/verifier definitions */

struct nfp_bpf_analyzer_priv {

	struct nfp_prog *prog;

	struct nfp_insn_meta *meta;

};



static struct nfp_insn_meta *

nfp_bpf_goto_meta(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,

		  unsigned int insn_idx, unsigned int n_insns)

{

	unsigned int forward, backward, i;



	backward = meta->n - insn_idx;

	forward = insn_idx - meta->n;



	if (min(forward, backward) > n_insns - insn_idx - 1) {

		backward = n_insns - insn_idx - 1;

		meta = nfp_prog_last_meta(nfp_prog);

	}

	if (min(forward, backward) > insn_idx && backward > insn_idx) {

		forward = insn_idx;

		meta = nfp_prog_first_meta(nfp_prog);

	}



	if (forward < backward)

		for (i = 0; i < forward; i++)

			meta = nfp_meta_next(meta);

	else

		for (i = 0; i < backward; i++)

			meta = nfp_meta_prev(meta);



	return meta;

}



static int

nfp_bpf_check_exit(struct nfp_prog *nfp_prog,

		   const struct bpf_verifier_env *env)

{

	const struct bpf_reg_state *reg0 = &env->cur_state.regs[0];



	if (reg0->type != CONST_IMM) {

		pr_info("unsupported exit state: %d, imm: %llx\n",

			reg0->type, reg0->imm);

		return -EINVAL;

	}



	if (nfp_prog->act != NN_ACT_DIRECT &&

	    reg0->imm != 0 && (reg0->imm & ~0U) != ~0U) {

		pr_info("unsupported exit state: %d, imm: %llx\n",

			reg0->type, reg0->imm);

		return -EINVAL;

	}



	if (nfp_prog->act == NN_ACT_DIRECT && reg0->imm <= TC_ACT_REDIRECT &&

	    reg0->imm != TC_ACT_SHOT && reg0->imm != TC_ACT_STOLEN &&

	    reg0->imm != TC_ACT_QUEUED) {

		pr_info("unsupported exit state: %d, imm: %llx\n",

			reg0->type, reg0->imm);

		return -EINVAL;

	}



	return 0;

}



static int

nfp_bpf_check_ctx_ptr(struct nfp_prog *nfp_prog,

		      const struct bpf_verifier_env *env, u8 reg)

{

	if (env->cur_state.regs[reg].type != PTR_TO_CTX)

		return -EINVAL;



	return 0;

}



static int

nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn_idx)

{

	struct nfp_bpf_analyzer_priv *priv = env->analyzer_priv;

	struct nfp_insn_meta *meta = priv->meta;



	meta = nfp_bpf_goto_meta(priv->prog, meta, insn_idx, env->prog->len);

	priv->meta = meta;



	if (meta->insn.src_reg == BPF_REG_10 ||

	    meta->insn.dst_reg == BPF_REG_10) {

		pr_err("stack not yet supported\n");

		return -EINVAL;

	}

	if (meta->insn.src_reg >= MAX_BPF_REG ||

	    meta->insn.dst_reg >= MAX_BPF_REG) {

		pr_err("program uses extended registers - jit hardening?\n");

		return -EINVAL;

	}



	if (meta->insn.code == (BPF_JMP | BPF_EXIT))

		return nfp_bpf_check_exit(priv->prog, env);



	if ((meta->insn.code & ~BPF_SIZE_MASK) == (BPF_LDX | BPF_MEM))

		return nfp_bpf_check_ctx_ptr(priv->prog, env,

					     meta->insn.src_reg);

	if ((meta->insn.code & ~BPF_SIZE_MASK) == (BPF_STX | BPF_MEM))

		return nfp_bpf_check_ctx_ptr(priv->prog, env,

					     meta->insn.dst_reg);



	return 0;

}



static const struct bpf_ext_analyzer_ops nfp_bpf_analyzer_ops = {

	.insn_hook = nfp_verify_insn,

};



int nfp_prog_verify(struct nfp_prog *nfp_prog, struct bpf_prog *prog)

{

	struct nfp_bpf_analyzer_priv *priv;

	int ret;



	priv = kzalloc(sizeof(*priv), GFP_KERNEL);

	if (!priv)

		return -ENOMEM;



	priv->prog = nfp_prog;

	priv->meta = nfp_prog_first_meta(nfp_prog);



	ret = bpf_analyzer(prog, &nfp_bpf_analyzer_ops, priv);



	kfree(priv);



	return ret;

}