Re: [PATCH 10/14] bpf/tests: Add branch conversion JIT test

[Yonghong Song <yhs@fb.com>]

On 7/28/21 10:04 AM, Johan Almbladh wrote:
> Some JITs may need to convert a conditional jump instruction to
> to short PC-relative branch and a long unconditional jump, if the
> PC-relative offset exceeds offset field width in the CPU instruction.
> This test triggers such branch conversion on the 32-bit MIPS JIT.
> 
> Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
> ---
>   lib/test_bpf.c | 38 ++++++++++++++++++++++++++++++++++++++
>   1 file changed, 38 insertions(+)
> 
> diff --git a/lib/test_bpf.c b/lib/test_bpf.c
> index 8b94902702ed..55914b6236aa 100644
> --- a/lib/test_bpf.c
> +++ b/lib/test_bpf.c
> @@ -461,6 +461,36 @@ static int bpf_fill_stxdw(struct bpf_test *self)
>   	return __bpf_fill_stxdw(self, BPF_DW);
>   }
>   
> +static int bpf_fill_long_jmp(struct bpf_test *self)
> +{
> +	unsigned int len = BPF_MAXINSNS;

BPF_MAXINSNS is 4096 as defined in uapi/linux/bpf_common.h.
Will it be able to trigger a PC relative branch + long
conditional jump?

> +	struct bpf_insn *insn;
> +	int i;
> +
> +	insn = kmalloc_array(len, sizeof(*insn), GFP_KERNEL);
> +	if (!insn)
> +		return -ENOMEM;
> +
> +	insn[0] = BPF_ALU64_IMM(BPF_MOV, R0, 1);
> +	insn[1] = BPF_JMP_IMM(BPF_JEQ, R0, 1, len - 2 - 1);
> +
> +	/*
> +	 * Fill with a complex 64-bit operation that expands to a lot of
> +	 * instructions on 32-bit JITs. The large jump offset can then
> +	 * overflow the conditional branch field size, triggering a branch
> +	 * conversion mechanism in some JITs.
> +	 */
> +	for (i = 2; i < len - 1; i++)
> +		insn[i] = BPF_ALU64_IMM(BPF_MUL, R0, (i << 16) + i);
> +
> +	insn[len - 1] = BPF_EXIT_INSN();
> +
> +	self->u.ptr.insns = insn;
> +	self->u.ptr.len = len;
> +
> +	return 0;
> +}
> +
[...]