2 * Minimal BPF JIT image disassembler
4 * Disassembles BPF JIT compiler emitted opcodes back to asm insn's for
5 * debugging or verification purposes.
7 * To get the disassembly of the JIT code, do the following:
9 * 1) `echo 2 > /proc/sys/net/core/bpf_jit_enable`
10 * 2) Load a BPF filter (e.g. `tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24`)
11 * 3) Run e.g. `bpf_jit_disasm -o` to read out the last JIT code
13 * Copyright 2013 Daniel Borkmann <borkmann@redhat.com>
14 * Licensed under the GNU General Public License, version 2.0 (GPLv2)
28 #include <sys/types.h>
31 #define CMD_ACTION_SIZE_BUFFER 10
32 #define CMD_ACTION_READ_ALL 3
34 static void get_exec_path(char *tpath
, size_t size
)
39 snprintf(tpath
, size
, "/proc/%d/exe", (int) getpid());
45 len
= readlink(path
, tpath
, size
);
51 static void get_asm_insns(uint8_t *image
, size_t len
, int opcodes
)
55 struct disassemble_info info
;
56 disassembler_ftype disassemble
;
59 memset(tpath
, 0, sizeof(tpath
));
60 get_exec_path(tpath
, sizeof(tpath
));
62 bfdf
= bfd_openr(tpath
, NULL
);
64 assert(bfd_check_format(bfdf
, bfd_object
));
66 init_disassemble_info(&info
, stdout
, (fprintf_ftype
) fprintf
);
67 info
.arch
= bfd_get_arch(bfdf
);
68 info
.mach
= bfd_get_mach(bfdf
);
70 info
.buffer_length
= len
;
72 disassemble_init_for_target(&info
);
74 disassemble
= disassembler(bfdf
);
80 count
= disassemble(pc
, &info
);
84 for (i
= 0; i
< count
; ++i
)
85 printf("%02x ", (uint8_t) image
[pc
+ i
]);
90 } while(count
> 0 && pc
< len
);
95 static char *get_klog_buff(unsigned int *klen
)
100 len
= klogctl(CMD_ACTION_SIZE_BUFFER
, NULL
, 0);
108 ret
= klogctl(CMD_ACTION_READ_ALL
, buff
, len
);
118 static char *get_flog_buff(const char *file
, unsigned int *klen
)
124 fd
= open(file
, O_RDONLY
);
128 ret
= fstat(fd
, &fi
);
129 if (ret
< 0 || !S_ISREG(fi
.st_mode
))
132 len
= fi
.st_size
+ 1;
137 memset(buff
, 0, len
);
138 ret
= read(fd
, buff
, len
- 1);
152 static char *get_log_buff(const char *file
, unsigned int *klen
)
154 return file
? get_flog_buff(file
, klen
) : get_klog_buff(klen
);
157 static void put_log_buff(char *buff
)
162 static uint8_t *get_last_jit_image(char *haystack
, size_t hlen
,
165 char *ptr
, *pptr
, *tmp
;
167 int ret
, flen
, proglen
, pass
, ulen
= 0;
168 regmatch_t pmatch
[1];
176 ret
= regcomp(®ex
, "flen=[[:alnum:]]+ proglen=[[:digit:]]+ "
177 "pass=[[:digit:]]+ image=[[:xdigit:]]+", REG_EXTENDED
);
181 memset(pmatch
, 0, sizeof(pmatch
));
184 ret
= regexec(®ex
, ptr
, 1, pmatch
, 0);
186 ptr
+= pmatch
[0].rm_eo
;
187 off
+= pmatch
[0].rm_eo
;
193 ptr
= haystack
+ off
- (pmatch
[0].rm_eo
- pmatch
[0].rm_so
);
194 ret
= sscanf(ptr
, "flen=%d proglen=%d pass=%d image=%lx",
195 &flen
, &proglen
, &pass
, &base
);
200 if (proglen
> 1000000) {
201 printf("proglen of %d too big, stopping\n", proglen
);
205 image
= malloc(proglen
);
207 printf("Out of memory\n");
210 memset(image
, 0, proglen
);
212 tmp
= ptr
= haystack
+ off
;
213 while ((ptr
= strtok(tmp
, "\n")) != NULL
&& ulen
< proglen
) {
215 if (!strstr(ptr
, "JIT code"))
218 while ((ptr
= strstr(pptr
, ":")))
222 image
[ulen
++] = (uint8_t) strtoul(pptr
, &pptr
, 16);
233 assert(ulen
== proglen
);
234 printf("%d bytes emitted from JIT compiler (pass:%d, flen:%d)\n",
235 proglen
, pass
, flen
);
236 printf("%lx + <x>:\n", base
);
243 static void usage(void)
245 printf("Usage: bpf_jit_disasm [...]\n");
246 printf(" -o Also display related opcodes (default: off).\n");
247 printf(" -O <file> Write binary image of code to file, don't disassemble to stdout.\n");
248 printf(" -f <file> Read last image dump from file or stdin (default: klog).\n");
249 printf(" -h Display this help.\n");
252 int main(int argc
, char **argv
)
254 unsigned int len
, klen
, opt
, opcodes
= 0;
255 char *kbuff
, *file
= NULL
;
260 uint8_t *image
= NULL
;
262 while ((opt
= getopt(argc
, argv
, "of:O:")) != -1) {
281 kbuff
= get_log_buff(file
, &klen
);
283 fprintf(stderr
, "Could not retrieve log buffer!\n");
287 image
= get_last_jit_image(kbuff
, klen
, &len
);
289 fprintf(stderr
, "No JIT image found!\n");
293 get_asm_insns(image
, len
, opcodes
);
297 ofd
= open(ofile
, O_WRONLY
| O_CREAT
| O_TRUNC
, DEFFILEMODE
);
299 fprintf(stderr
, "Could not open file %s for writing: ", ofile
);
305 nr
= write(ofd
, pos
, len
);
307 fprintf(stderr
, "Could not write data to %s: ", ofile
);