]>
Commit | Line | Data |
---|---|---|
e306e2c1 DB |
1 | /* |
2 | * Minimal BPF JIT image disassembler | |
3 | * | |
4 | * Disassembles BPF JIT compiler emitted opcodes back to asm insn's for | |
5 | * debugging or verification purposes. | |
6 | * | |
7 | * To get the disassembly of the JIT code, do the following: | |
8 | * | |
9 | * 1) `echo 2 > /proc/sys/net/core/bpf_jit_enable` | |
10 | * 2) Load a BPF filter (e.g. `tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24`) | |
11 | * 3) Run e.g. `bpf_jit_disasm -o` to read out the last JIT code | |
12 | * | |
13 | * Copyright 2013 Daniel Borkmann <borkmann@redhat.com> | |
14 | * Licensed under the GNU General Public License, version 2.0 (GPLv2) | |
15 | */ | |
16 | ||
17 | #include <stdint.h> | |
18 | #include <stdio.h> | |
19 | #include <stdlib.h> | |
20 | #include <assert.h> | |
21 | #include <unistd.h> | |
22 | #include <string.h> | |
23 | #include <bfd.h> | |
24 | #include <dis-asm.h> | |
a6ed3836 DB |
25 | #include <regex.h> |
26 | #include <fcntl.h> | |
e306e2c1 DB |
27 | #include <sys/klog.h> |
28 | #include <sys/types.h> | |
a6ed3836 | 29 | #include <sys/stat.h> |
cdc89c91 | 30 | #include <limits.h> |
a6ed3836 DB |
31 | |
32 | #define CMD_ACTION_SIZE_BUFFER 10 | |
33 | #define CMD_ACTION_READ_ALL 3 | |
e306e2c1 DB |
34 | |
35 | static void get_exec_path(char *tpath, size_t size) | |
36 | { | |
37 | char *path; | |
38 | ssize_t len; | |
39 | ||
40 | snprintf(tpath, size, "/proc/%d/exe", (int) getpid()); | |
41 | tpath[size - 1] = 0; | |
42 | ||
43 | path = strdup(tpath); | |
44 | assert(path); | |
45 | ||
46 | len = readlink(path, tpath, size); | |
47 | tpath[len] = 0; | |
48 | ||
49 | free(path); | |
50 | } | |
51 | ||
ed4afd45 | 52 | static void get_asm_insns(uint8_t *image, size_t len, int opcodes) |
e306e2c1 DB |
53 | { |
54 | int count, i, pc = 0; | |
cdc89c91 | 55 | char tpath[PATH_MAX]; |
e306e2c1 DB |
56 | struct disassemble_info info; |
57 | disassembler_ftype disassemble; | |
58 | bfd *bfdf; | |
59 | ||
60 | memset(tpath, 0, sizeof(tpath)); | |
61 | get_exec_path(tpath, sizeof(tpath)); | |
62 | ||
63 | bfdf = bfd_openr(tpath, NULL); | |
64 | assert(bfdf); | |
65 | assert(bfd_check_format(bfdf, bfd_object)); | |
66 | ||
67 | init_disassemble_info(&info, stdout, (fprintf_ftype) fprintf); | |
68 | info.arch = bfd_get_arch(bfdf); | |
69 | info.mach = bfd_get_mach(bfdf); | |
70 | info.buffer = image; | |
71 | info.buffer_length = len; | |
72 | ||
73 | disassemble_init_for_target(&info); | |
74 | ||
75 | disassemble = disassembler(bfdf); | |
76 | assert(disassemble); | |
77 | ||
78 | do { | |
79 | printf("%4x:\t", pc); | |
80 | ||
81 | count = disassemble(pc, &info); | |
82 | ||
83 | if (opcodes) { | |
84 | printf("\n\t"); | |
85 | for (i = 0; i < count; ++i) | |
86 | printf("%02x ", (uint8_t) image[pc + i]); | |
87 | } | |
88 | printf("\n"); | |
89 | ||
90 | pc += count; | |
91 | } while(count > 0 && pc < len); | |
92 | ||
93 | bfd_close(bfdf); | |
94 | } | |
95 | ||
a6ed3836 | 96 | static char *get_klog_buff(unsigned int *klen) |
e306e2c1 | 97 | { |
a6ed3836 DB |
98 | int ret, len; |
99 | char *buff; | |
100 | ||
101 | len = klogctl(CMD_ACTION_SIZE_BUFFER, NULL, 0); | |
25a54342 CIK |
102 | if (len < 0) |
103 | return NULL; | |
104 | ||
a6ed3836 DB |
105 | buff = malloc(len); |
106 | if (!buff) | |
107 | return NULL; | |
108 | ||
109 | ret = klogctl(CMD_ACTION_READ_ALL, buff, len); | |
110 | if (ret < 0) { | |
111 | free(buff); | |
112 | return NULL; | |
113 | } | |
e306e2c1 | 114 | |
e306e2c1 | 115 | *klen = ret; |
a6ed3836 DB |
116 | return buff; |
117 | } | |
e306e2c1 | 118 | |
a6ed3836 DB |
119 | static char *get_flog_buff(const char *file, unsigned int *klen) |
120 | { | |
121 | int fd, ret, len; | |
122 | struct stat fi; | |
123 | char *buff; | |
124 | ||
125 | fd = open(file, O_RDONLY); | |
126 | if (fd < 0) | |
127 | return NULL; | |
128 | ||
129 | ret = fstat(fd, &fi); | |
130 | if (ret < 0 || !S_ISREG(fi.st_mode)) | |
131 | goto out; | |
132 | ||
133 | len = fi.st_size + 1; | |
134 | buff = malloc(len); | |
135 | if (!buff) | |
136 | goto out; | |
137 | ||
138 | memset(buff, 0, len); | |
139 | ret = read(fd, buff, len - 1); | |
140 | if (ret <= 0) | |
141 | goto out_free; | |
142 | ||
143 | close(fd); | |
144 | *klen = ret; | |
e306e2c1 | 145 | return buff; |
a6ed3836 DB |
146 | out_free: |
147 | free(buff); | |
148 | out: | |
149 | close(fd); | |
150 | return NULL; | |
151 | } | |
152 | ||
153 | static char *get_log_buff(const char *file, unsigned int *klen) | |
154 | { | |
155 | return file ? get_flog_buff(file, klen) : get_klog_buff(klen); | |
e306e2c1 DB |
156 | } |
157 | ||
a6ed3836 | 158 | static void put_log_buff(char *buff) |
e306e2c1 DB |
159 | { |
160 | free(buff); | |
161 | } | |
162 | ||
e274da1a DD |
163 | static uint8_t *get_last_jit_image(char *haystack, size_t hlen, |
164 | unsigned int *ilen) | |
e306e2c1 DB |
165 | { |
166 | char *ptr, *pptr, *tmp; | |
167 | off_t off = 0; | |
168 | int ret, flen, proglen, pass, ulen = 0; | |
169 | regmatch_t pmatch[1]; | |
ed4afd45 | 170 | unsigned long base; |
e306e2c1 | 171 | regex_t regex; |
e274da1a | 172 | uint8_t *image; |
e306e2c1 DB |
173 | |
174 | if (hlen == 0) | |
e274da1a | 175 | return NULL; |
e306e2c1 DB |
176 | |
177 | ret = regcomp(®ex, "flen=[[:alnum:]]+ proglen=[[:digit:]]+ " | |
178 | "pass=[[:digit:]]+ image=[[:xdigit:]]+", REG_EXTENDED); | |
179 | assert(ret == 0); | |
180 | ||
181 | ptr = haystack; | |
082739aa DB |
182 | memset(pmatch, 0, sizeof(pmatch)); |
183 | ||
e306e2c1 DB |
184 | while (1) { |
185 | ret = regexec(®ex, ptr, 1, pmatch, 0); | |
186 | if (ret == 0) { | |
187 | ptr += pmatch[0].rm_eo; | |
188 | off += pmatch[0].rm_eo; | |
189 | assert(off < hlen); | |
190 | } else | |
191 | break; | |
192 | } | |
193 | ||
194 | ptr = haystack + off - (pmatch[0].rm_eo - pmatch[0].rm_so); | |
195 | ret = sscanf(ptr, "flen=%d proglen=%d pass=%d image=%lx", | |
ed4afd45 | 196 | &flen, &proglen, &pass, &base); |
a6ed3836 DB |
197 | if (ret != 4) { |
198 | regfree(®ex); | |
e274da1a DD |
199 | return NULL; |
200 | } | |
201 | if (proglen > 1000000) { | |
202 | printf("proglen of %d too big, stopping\n", proglen); | |
203 | return NULL; | |
a6ed3836 | 204 | } |
e306e2c1 | 205 | |
e274da1a DD |
206 | image = malloc(proglen); |
207 | if (!image) { | |
208 | printf("Out of memory\n"); | |
209 | return NULL; | |
210 | } | |
211 | memset(image, 0, proglen); | |
212 | ||
e306e2c1 | 213 | tmp = ptr = haystack + off; |
e274da1a | 214 | while ((ptr = strtok(tmp, "\n")) != NULL && ulen < proglen) { |
e306e2c1 DB |
215 | tmp = NULL; |
216 | if (!strstr(ptr, "JIT code")) | |
217 | continue; | |
218 | pptr = ptr; | |
219 | while ((ptr = strstr(pptr, ":"))) | |
220 | pptr = ptr + 1; | |
221 | ptr = pptr; | |
222 | do { | |
223 | image[ulen++] = (uint8_t) strtoul(pptr, &pptr, 16); | |
e274da1a | 224 | if (ptr == pptr) { |
e306e2c1 DB |
225 | ulen--; |
226 | break; | |
227 | } | |
e274da1a DD |
228 | if (ulen >= proglen) |
229 | break; | |
e306e2c1 DB |
230 | ptr = pptr; |
231 | } while (1); | |
232 | } | |
233 | ||
234 | assert(ulen == proglen); | |
235 | printf("%d bytes emitted from JIT compiler (pass:%d, flen:%d)\n", | |
236 | proglen, pass, flen); | |
ed4afd45 | 237 | printf("%lx + <x>:\n", base); |
e306e2c1 DB |
238 | |
239 | regfree(®ex); | |
e274da1a DD |
240 | *ilen = ulen; |
241 | return image; | |
e306e2c1 DB |
242 | } |
243 | ||
a6ed3836 DB |
244 | static void usage(void) |
245 | { | |
246 | printf("Usage: bpf_jit_disasm [...]\n"); | |
247 | printf(" -o Also display related opcodes (default: off).\n"); | |
b6518e6a | 248 | printf(" -O <file> Write binary image of code to file, don't disassemble to stdout.\n"); |
a6ed3836 DB |
249 | printf(" -f <file> Read last image dump from file or stdin (default: klog).\n"); |
250 | printf(" -h Display this help.\n"); | |
251 | } | |
252 | ||
e306e2c1 DB |
253 | int main(int argc, char **argv) |
254 | { | |
a6ed3836 | 255 | unsigned int len, klen, opt, opcodes = 0; |
a6ed3836 | 256 | char *kbuff, *file = NULL; |
b6518e6a DD |
257 | char *ofile = NULL; |
258 | int ofd; | |
259 | ssize_t nr; | |
260 | uint8_t *pos; | |
e274da1a | 261 | uint8_t *image = NULL; |
e306e2c1 | 262 | |
b6518e6a | 263 | while ((opt = getopt(argc, argv, "of:O:")) != -1) { |
a6ed3836 DB |
264 | switch (opt) { |
265 | case 'o': | |
e306e2c1 | 266 | opcodes = 1; |
a6ed3836 | 267 | break; |
b6518e6a DD |
268 | case 'O': |
269 | ofile = optarg; | |
270 | break; | |
a6ed3836 DB |
271 | case 'f': |
272 | file = optarg; | |
273 | break; | |
274 | default: | |
275 | usage(); | |
276 | return -1; | |
e306e2c1 DB |
277 | } |
278 | } | |
279 | ||
280 | bfd_init(); | |
e306e2c1 | 281 | |
a6ed3836 DB |
282 | kbuff = get_log_buff(file, &klen); |
283 | if (!kbuff) { | |
284 | fprintf(stderr, "Could not retrieve log buffer!\n"); | |
285 | return -1; | |
286 | } | |
e306e2c1 | 287 | |
e274da1a DD |
288 | image = get_last_jit_image(kbuff, klen, &len); |
289 | if (!image) { | |
a6ed3836 | 290 | fprintf(stderr, "No JIT image found!\n"); |
b6518e6a DD |
291 | goto done; |
292 | } | |
293 | if (!ofile) { | |
294 | get_asm_insns(image, len, opcodes); | |
295 | goto done; | |
296 | } | |
297 | ||
298 | ofd = open(ofile, O_WRONLY | O_CREAT | O_TRUNC, DEFFILEMODE); | |
299 | if (ofd < 0) { | |
300 | fprintf(stderr, "Could not open file %s for writing: ", ofile); | |
301 | perror(NULL); | |
302 | goto done; | |
303 | } | |
304 | pos = image; | |
305 | do { | |
306 | nr = write(ofd, pos, len); | |
307 | if (nr < 0) { | |
308 | fprintf(stderr, "Could not write data to %s: ", ofile); | |
309 | perror(NULL); | |
310 | goto done; | |
311 | } | |
312 | len -= nr; | |
313 | pos += nr; | |
314 | } while (len); | |
315 | close(ofd); | |
e306e2c1 | 316 | |
b6518e6a | 317 | done: |
a6ed3836 | 318 | put_log_buff(kbuff); |
e274da1a | 319 | free(image); |
e306e2c1 DB |
320 | return 0; |
321 | } |