bpf_jit_disasm.c 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Minimal BPF JIT image disassembler
  4. *
  5. * Disassembles BPF JIT compiler emitted opcodes back to asm insn's for
  6. * debugging or verification purposes.
  7. *
  8. * To get the disassembly of the JIT code, do the following:
  9. *
  10. * 1) `echo 2 > /proc/sys/net/core/bpf_jit_enable`
  11. * 2) Load a BPF filter (e.g. `tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24`)
  12. * 3) Run e.g. `bpf_jit_disasm -o` to read out the last JIT code
  13. *
  14. * Copyright 2013 Daniel Borkmann <[email protected]>
  15. */
  16. #include <stdint.h>
  17. #include <stdio.h>
  18. #include <stdlib.h>
  19. #include <assert.h>
  20. #include <unistd.h>
  21. #include <string.h>
  22. #include <bfd.h>
  23. #include <dis-asm.h>
  24. #include <regex.h>
  25. #include <fcntl.h>
  26. #include <sys/klog.h>
  27. #include <sys/types.h>
  28. #include <sys/stat.h>
  29. #include <limits.h>
  30. #include <tools/dis-asm-compat.h>
  31. #define CMD_ACTION_SIZE_BUFFER 10
  32. #define CMD_ACTION_READ_ALL 3
  33. static void get_exec_path(char *tpath, size_t size)
  34. {
  35. char *path;
  36. ssize_t len;
  37. snprintf(tpath, size, "/proc/%d/exe", (int) getpid());
  38. tpath[size - 1] = 0;
  39. path = strdup(tpath);
  40. assert(path);
  41. len = readlink(path, tpath, size);
  42. tpath[len] = 0;
  43. free(path);
  44. }
  45. static void get_asm_insns(uint8_t *image, size_t len, int opcodes)
  46. {
  47. int count, i, pc = 0;
  48. char tpath[PATH_MAX];
  49. struct disassemble_info info;
  50. disassembler_ftype disassemble;
  51. bfd *bfdf;
  52. memset(tpath, 0, sizeof(tpath));
  53. get_exec_path(tpath, sizeof(tpath));
  54. bfdf = bfd_openr(tpath, NULL);
  55. assert(bfdf);
  56. assert(bfd_check_format(bfdf, bfd_object));
  57. init_disassemble_info_compat(&info, stdout,
  58. (fprintf_ftype) fprintf,
  59. fprintf_styled);
  60. info.arch = bfd_get_arch(bfdf);
  61. info.mach = bfd_get_mach(bfdf);
  62. info.buffer = image;
  63. info.buffer_length = len;
  64. disassemble_init_for_target(&info);
  65. #ifdef DISASM_FOUR_ARGS_SIGNATURE
  66. disassemble = disassembler(info.arch,
  67. bfd_big_endian(bfdf),
  68. info.mach,
  69. bfdf);
  70. #else
  71. disassemble = disassembler(bfdf);
  72. #endif
  73. assert(disassemble);
  74. do {
  75. printf("%4x:\t", pc);
  76. count = disassemble(pc, &info);
  77. if (opcodes) {
  78. printf("\n\t");
  79. for (i = 0; i < count; ++i)
  80. printf("%02x ", (uint8_t) image[pc + i]);
  81. }
  82. printf("\n");
  83. pc += count;
  84. } while(count > 0 && pc < len);
  85. bfd_close(bfdf);
  86. }
  87. static char *get_klog_buff(unsigned int *klen)
  88. {
  89. int ret, len;
  90. char *buff;
  91. len = klogctl(CMD_ACTION_SIZE_BUFFER, NULL, 0);
  92. if (len < 0)
  93. return NULL;
  94. buff = malloc(len);
  95. if (!buff)
  96. return NULL;
  97. ret = klogctl(CMD_ACTION_READ_ALL, buff, len);
  98. if (ret < 0) {
  99. free(buff);
  100. return NULL;
  101. }
  102. *klen = ret;
  103. return buff;
  104. }
  105. static char *get_flog_buff(const char *file, unsigned int *klen)
  106. {
  107. int fd, ret, len;
  108. struct stat fi;
  109. char *buff;
  110. fd = open(file, O_RDONLY);
  111. if (fd < 0)
  112. return NULL;
  113. ret = fstat(fd, &fi);
  114. if (ret < 0 || !S_ISREG(fi.st_mode))
  115. goto out;
  116. len = fi.st_size + 1;
  117. buff = malloc(len);
  118. if (!buff)
  119. goto out;
  120. memset(buff, 0, len);
  121. ret = read(fd, buff, len - 1);
  122. if (ret <= 0)
  123. goto out_free;
  124. close(fd);
  125. *klen = ret;
  126. return buff;
  127. out_free:
  128. free(buff);
  129. out:
  130. close(fd);
  131. return NULL;
  132. }
  133. static char *get_log_buff(const char *file, unsigned int *klen)
  134. {
  135. return file ? get_flog_buff(file, klen) : get_klog_buff(klen);
  136. }
  137. static void put_log_buff(char *buff)
  138. {
  139. free(buff);
  140. }
  141. static uint8_t *get_last_jit_image(char *haystack, size_t hlen,
  142. unsigned int *ilen)
  143. {
  144. char *ptr, *pptr, *tmp;
  145. off_t off = 0;
  146. unsigned int proglen;
  147. int ret, flen, pass, ulen = 0;
  148. regmatch_t pmatch[1];
  149. unsigned long base;
  150. regex_t regex;
  151. uint8_t *image;
  152. if (hlen == 0)
  153. return NULL;
  154. ret = regcomp(&regex, "flen=[[:alnum:]]+ proglen=[[:digit:]]+ "
  155. "pass=[[:digit:]]+ image=[[:xdigit:]]+", REG_EXTENDED);
  156. assert(ret == 0);
  157. ptr = haystack;
  158. memset(pmatch, 0, sizeof(pmatch));
  159. while (1) {
  160. ret = regexec(&regex, ptr, 1, pmatch, 0);
  161. if (ret == 0) {
  162. ptr += pmatch[0].rm_eo;
  163. off += pmatch[0].rm_eo;
  164. assert(off < hlen);
  165. } else
  166. break;
  167. }
  168. ptr = haystack + off - (pmatch[0].rm_eo - pmatch[0].rm_so);
  169. ret = sscanf(ptr, "flen=%d proglen=%u pass=%d image=%lx",
  170. &flen, &proglen, &pass, &base);
  171. if (ret != 4) {
  172. regfree(&regex);
  173. return NULL;
  174. }
  175. if (proglen > 1000000) {
  176. printf("proglen of %d too big, stopping\n", proglen);
  177. return NULL;
  178. }
  179. image = malloc(proglen);
  180. if (!image) {
  181. printf("Out of memory\n");
  182. return NULL;
  183. }
  184. memset(image, 0, proglen);
  185. tmp = ptr = haystack + off;
  186. while ((ptr = strtok(tmp, "\n")) != NULL && ulen < proglen) {
  187. tmp = NULL;
  188. if (!strstr(ptr, "JIT code"))
  189. continue;
  190. pptr = ptr;
  191. while ((ptr = strstr(pptr, ":")))
  192. pptr = ptr + 1;
  193. ptr = pptr;
  194. do {
  195. image[ulen++] = (uint8_t) strtoul(pptr, &pptr, 16);
  196. if (ptr == pptr) {
  197. ulen--;
  198. break;
  199. }
  200. if (ulen >= proglen)
  201. break;
  202. ptr = pptr;
  203. } while (1);
  204. }
  205. assert(ulen == proglen);
  206. printf("%u bytes emitted from JIT compiler (pass:%d, flen:%d)\n",
  207. proglen, pass, flen);
  208. printf("%lx + <x>:\n", base);
  209. regfree(&regex);
  210. *ilen = ulen;
  211. return image;
  212. }
  213. static void usage(void)
  214. {
  215. printf("Usage: bpf_jit_disasm [...]\n");
  216. printf(" -o Also display related opcodes (default: off).\n");
  217. printf(" -O <file> Write binary image of code to file, don't disassemble to stdout.\n");
  218. printf(" -f <file> Read last image dump from file or stdin (default: klog).\n");
  219. printf(" -h Display this help.\n");
  220. }
  221. int main(int argc, char **argv)
  222. {
  223. unsigned int len, klen, opt, opcodes = 0;
  224. char *kbuff, *file = NULL;
  225. char *ofile = NULL;
  226. int ofd;
  227. ssize_t nr;
  228. uint8_t *pos;
  229. uint8_t *image = NULL;
  230. while ((opt = getopt(argc, argv, "of:O:")) != -1) {
  231. switch (opt) {
  232. case 'o':
  233. opcodes = 1;
  234. break;
  235. case 'O':
  236. ofile = optarg;
  237. break;
  238. case 'f':
  239. file = optarg;
  240. break;
  241. default:
  242. usage();
  243. return -1;
  244. }
  245. }
  246. bfd_init();
  247. kbuff = get_log_buff(file, &klen);
  248. if (!kbuff) {
  249. fprintf(stderr, "Could not retrieve log buffer!\n");
  250. return -1;
  251. }
  252. image = get_last_jit_image(kbuff, klen, &len);
  253. if (!image) {
  254. fprintf(stderr, "No JIT image found!\n");
  255. goto done;
  256. }
  257. if (!ofile) {
  258. get_asm_insns(image, len, opcodes);
  259. goto done;
  260. }
  261. ofd = open(ofile, O_WRONLY | O_CREAT | O_TRUNC, DEFFILEMODE);
  262. if (ofd < 0) {
  263. fprintf(stderr, "Could not open file %s for writing: ", ofile);
  264. perror(NULL);
  265. goto done;
  266. }
  267. pos = image;
  268. do {
  269. nr = write(ofd, pos, len);
  270. if (nr < 0) {
  271. fprintf(stderr, "Could not write data to %s: ", ofile);
  272. perror(NULL);
  273. goto done;
  274. }
  275. len -= nr;
  276. pos += nr;
  277. } while (len);
  278. close(ofd);
  279. done:
  280. put_log_buff(kbuff);
  281. free(image);
  282. return 0;
  283. }