diff mbox series

[COMMITTED] bpf: facilitate constant propagation of function addresses

Message ID 87v8qh938t.fsf@oracle.com
State New, archived
Headers
Series [COMMITTED] bpf: facilitate constant propagation of function addresses |

Commit Message

Jose E. Marchesi Aug. 24, 2022, 1:32 p.m. UTC 
  eBPF effectively supports two kind of call instructions:

- The so called pseudo-calls ("bpf to bpf").
- External calls ("bpf to kernel").

The BPF call instruction always gets an immediate argument, whose
interpretation varies depending on the purpose of the instruction:

- For pseudo-calls, the immediate argument is interpreted as a
  32-bit PC-relative displacement measured in number of 64-bit words
  minus one.

- For external calls, the immediate argument is interpreted as the
  identification of a kernel helper.

In order to differenciate both flavors of CALL instructions the SRC
field of the instruction (otherwise unused) is abused as an opcode;
if the field holds 0 the instruction is an external call, if it holds
BPF_PSEUDO_CALL the instruction is a pseudo-call.

C-to-BPF toolchains, including the GNU toolchain, use the following
practical heuristic at assembly time in order to determine what kind
of CALL instruction to generate: call instructions requiring a fixup
at assembly time are interpreted as pseudo-calls.  This means that in
practice a call instruction involving symbols at assembly time (such
as `call foo') is assembled into a pseudo-call instruction, whereas
something like `call 12' is assembled into an external call
instruction.

In both cases, the argument of CALL is an immediate: at the time of
writing eBPF lacks support for indirect calls, i.e. there is no
call-to-register instruction.

This is the reason why BPF programs, in practice, rely on certain
optimizations to happen in order to generate calls to immediates.
This is a typical example involving a kernel helper:

  static void * (*bpf_map_lookup_elem)(void *map, const void *key)
    = (void *) 1;

  int foo (...)
  {
    char *ret;

    ret = bpf_map_lookup_elem (args...);
    if (ret)
      return 1;
    return 0;
  }

Note how the code above relies on the compiler to do constant
propagation so the call to bpf_map_lookup_elem can be compiled to a
`call 1' instruction.

While GCC provides a kernel_helper function declaration attribute that
can be used in a robust way to tell GCC to generate an external call
despite of optimization level and any other consideration, the Linux
kernel bpf_helpers.h file relies on tricks like the above.

This patch modifies the BPF backend to avoid SSA sparse constant
propagation to be "undone" by the expander loading the function
address into a register.  A new test is also added.

Tested in bpf-unknown-linux-gnu.
No regressions.

gcc/ChangeLog:

	PR target/106733
	* config/bpf/bpf.cc (bpf_legitimate_address_p): Recognize integer
	constants as legitimate addresses for functions.
	(bpf_small_register_classes_for_mode_p): Define target hook.

gcc/testsuite/ChangeLog:

	PR target/106733
	* gcc.target/bpf/constant-calls.c: Rename to ...
	* gcc.target/bpf/constant-calls-1.c: and modify to not expect
	failure anymore.
	* gcc.target/bpf/constant-calls-2.c: New test.
---
 gcc/config/bpf/bpf.cc                         | 21 ++++++++++++++++++-
 .../{constant-calls.c => constant-calls-1.c}  |  1 -
 .../gcc.target/bpf/constant-calls-2.c         | 16 ++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)
 rename gcc/testsuite/gcc.target/bpf/{constant-calls.c => constant-calls-1.c} (88%)
 create mode 100644 gcc/testsuite/gcc.target/bpf/constant-calls-2.c
diff mbox series

Patch

diff --git a/gcc/config/bpf/bpf.cc b/gcc/config/bpf/bpf.cc
index 6a0e3bbca9e..7e37e080808 100644
--- a/gcc/config/bpf/bpf.cc
+++ b/gcc/config/bpf/bpf.cc
@@ -659,12 +659,15 @@  bpf_address_base_p (rtx x, bool strict)
    target machine for a memory operand of mode MODE.  */
 
 static bool
-bpf_legitimate_address_p (machine_mode mode ATTRIBUTE_UNUSED,
+bpf_legitimate_address_p (machine_mode mode,
 			  rtx x,
 			  bool strict)
 {
   switch (GET_CODE (x))
     {
+    case CONST_INT:
+      return (mode == FUNCTION_MODE);
+
     case REG:
       return bpf_address_base_p (x, strict);
 
@@ -1311,6 +1314,22 @@  bpf_core_walk (tree *tp, int *walk_subtrees, void *data)
   return NULL_TREE;
 }
 
+/* Implement target hook small_register_classes_for_mode_p.  */
+
+static bool
+bpf_small_register_classes_for_mode_p (machine_mode mode)
+{
+  if (TARGET_XBPF)
+    return 1;
+  else
+    /* Avoid putting function addresses in registers, as calling these
+       is not supported in eBPF.  */
+    return (mode != FUNCTION_MODE);
+}
+
+#undef TARGET_SMALL_REGISTER_CLASSES_FOR_MODE_P
+#define TARGET_SMALL_REGISTER_CLASSES_FOR_MODE_P \
+  bpf_small_register_classes_for_mode_p
 
 /* Implement TARGET_RESOLVE_OVERLOADED_BUILTIN (see gccint manual section
    Target Macros::Misc.).
diff --git a/gcc/testsuite/gcc.target/bpf/constant-calls.c b/gcc/testsuite/gcc.target/bpf/constant-calls-1.c
similarity index 88%
rename from gcc/testsuite/gcc.target/bpf/constant-calls.c
rename to gcc/testsuite/gcc.target/bpf/constant-calls-1.c
index 84612a92ae9..6effc7dfdd4 100644
--- a/gcc/testsuite/gcc.target/bpf/constant-calls.c
+++ b/gcc/testsuite/gcc.target/bpf/constant-calls-1.c
@@ -1,5 +1,4 @@ 
 /* { dg-do compile } */
-/* { dg-xfail-if "" { bpf-*-* } } */
 
 typedef void  *(*T)(void);
 f1 ()
diff --git a/gcc/testsuite/gcc.target/bpf/constant-calls-2.c b/gcc/testsuite/gcc.target/bpf/constant-calls-2.c
new file mode 100644
index 00000000000..836ab67a1fd
--- /dev/null
+++ b/gcc/testsuite/gcc.target/bpf/constant-calls-2.c
@@ -0,0 +1,16 @@ 
+/* { dg-do compile } */
+/* { dg-options "-std=c89 -O2" } */
+
+static void * (*bpf_map_lookup_elem)(void *map, const void *key) = (void *) 666;
+
+int foo ()
+{
+  char *ret;
+
+  ret = bpf_map_lookup_elem (ret, ret);
+  if (ret)
+    return 0;
+  return 1;
+}
+
+/* { dg-final { scan-assembler "call\t666" } } */