bpf_jit_disasm.c

   1 /*
   2  * Minimal BPF JIT image disassembler
   3  *
   4  * Disassembles BPF JIT compiler emitted opcodes back to asm insn's for
   5  * debugging or verification purposes.
   6  *
   7  * There is no Makefile. Compile with
   8  *
   9  *   `gcc -Wall -O2 bpf_jit_disasm.c -o bpf_jit_disasm -lopcodes -lbfd -ldl`
  10  *
  11  * or similar.
  12  *
  13  * To get the disassembly of the JIT code, do the following:
  14  *
  15  *  1) `echo 2 > /proc/sys/net/core/bpf_jit_enable`
  16  *  2) Load a BPF filter (e.g. `tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24`)
  17  *  3) Run e.g. `bpf_jit_disasm -o` to read out the last JIT code
  18  *
  19  * Copyright 2013 Daniel Borkmann <borkmann@redhat.com>
  20  * Licensed under the GNU General Public License, version 2.0 (GPLv2)
  21  *
  22  * Note: this is part of the Linux kernel and can be found under tools/net/.
  23  */
  24
  25 #include <stdint.h>
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <assert.h>
  29 #include <unistd.h>
  30 #include <string.h>
  31 #include <bfd.h>
  32 #include <dis-asm.h>
  33 #include <sys/klog.h>
  34 #include <sys/types.h>
  35 #include <regex.h>
  36
  37 static void get_exec_path(char *tpath, size_t size)
  38 {
  39         char *path;
  40         ssize_t len;
  41
  42         snprintf(tpath, size, "/proc/%d/exe", (int) getpid());
  43         tpath[size - 1] = 0;
  44
  45         path = strdup(tpath);
  46         assert(path);
  47
  48         len = readlink(path, tpath, size);
  49         tpath[len] = 0;
  50
  51         free(path);
  52 }
  53
  54 static void get_asm_insns(uint8_t *image, size_t len, unsigned long base,
  55                           int opcodes)
  56 {
  57         int count, i, pc = 0;
  58         char tpath[256];
  59         struct disassemble_info info;
  60         disassembler_ftype disassemble;
  61         bfd *bfdf;
  62
  63         memset(tpath, 0, sizeof(tpath));
  64         get_exec_path(tpath, sizeof(tpath));
  65
  66         bfdf = bfd_openr(tpath, NULL);
  67         assert(bfdf);
  68         assert(bfd_check_format(bfdf, bfd_object));
  69
  70         init_disassemble_info(&info, stdout, (fprintf_ftype) fprintf);
  71         info.arch = bfd_get_arch(bfdf);
  72         info.mach = bfd_get_mach(bfdf);
  73         info.buffer = image;
  74         info.buffer_length = len;
  75
  76         disassemble_init_for_target(&info);
  77
  78         disassemble = disassembler(bfdf);
  79         assert(disassemble);
  80
  81         do {
  82                 printf("%4x:\t", pc);
  83
  84                 count = disassemble(pc, &info);
  85
  86                 if (opcodes) {
  87                         printf("\n\t");
  88                         for (i = 0; i < count; ++i)
  89                                 printf("%02x ", (uint8_t) image[pc + i]);
  90                 }
  91                 printf("\n");
  92
  93                 pc += count;
  94         } while(count > 0 && pc < len);
  95
  96         bfd_close(bfdf);
  97 }
  98
  99 static char *get_klog_buff(int *klen)
 100 {
 101         int ret, len = klogctl(10, NULL, 0);
 102         char *buff = malloc(len);
 103
 104         assert(buff && klen);
 105         ret = klogctl(3, buff, len);
 106         assert(ret >= 0);
 107         *klen = ret;
 108
 109         return buff;
 110 }
 111
 112 static void put_klog_buff(char *buff)
 113 {
 114         free(buff);
 115 }
 116
 117 static int get_last_jit_image(char *haystack, size_t hlen,
 118                               uint8_t *image, size_t ilen,
 119                               unsigned long *base)
 120 {
 121         char *ptr, *pptr, *tmp;
 122         off_t off = 0;
 123         int ret, flen, proglen, pass, ulen = 0;
 124         regmatch_t pmatch[1];
 125         regex_t regex;
 126
 127         if (hlen == 0)
 128                 return 0;
 129
 130         ret = regcomp(&regex, "flen=[[:alnum:]]+ proglen=[[:digit:]]+ "
 131                       "pass=[[:digit:]]+ image=[[:xdigit:]]+", REG_EXTENDED);
 132         assert(ret == 0);
 133
 134         ptr = haystack;
 135         while (1) {
 136                 ret = regexec(&regex, ptr, 1, pmatch, 0);
 137                 if (ret == 0) {
 138                         ptr += pmatch[0].rm_eo;
 139                         off += pmatch[0].rm_eo;
 140                         assert(off < hlen);
 141                 } else
 142                         break;
 143         }
 144
 145         ptr = haystack + off - (pmatch[0].rm_eo - pmatch[0].rm_so);
 146         ret = sscanf(ptr, "flen=%d proglen=%d pass=%d image=%lx",
 147                      &flen, &proglen, &pass, base);
 148         if (ret != 4)
 149                 return 0;
 150
 151         tmp = ptr = haystack + off;
 152         while ((ptr = strtok(tmp, "\n")) != NULL && ulen < ilen) {
 153                 tmp = NULL;
 154                 if (!strstr(ptr, "JIT code"))
 155                         continue;
 156                 pptr = ptr;
 157                 while ((ptr = strstr(pptr, ":")))
 158                         pptr = ptr + 1;
 159                 ptr = pptr;
 160                 do {
 161                         image[ulen++] = (uint8_t) strtoul(pptr, &pptr, 16);
 162                         if (ptr == pptr || ulen >= ilen) {
 163                                 ulen--;
 164                                 break;
 165                         }
 166                         ptr = pptr;
 167                 } while (1);
 168         }
 169
 170         assert(ulen == proglen);
 171         printf("%d bytes emitted from JIT compiler (pass:%d, flen:%d)\n",
 172                proglen, pass, flen);
 173         printf("%lx + <x>:\n", *base);
 174
 175         regfree(&regex);
 176         return ulen;
 177 }
 178
 179 int main(int argc, char **argv)
 180 {
 181         int len, klen, opcodes = 0;
 182         char *kbuff;
 183         unsigned long base;
 184         uint8_t image[4096];
 185
 186         if (argc > 1) {
 187                 if (!strncmp("-o", argv[argc - 1], 2)) {
 188                         opcodes = 1;
 189                 } else {
 190                         printf("usage: bpf_jit_disasm [-o: show opcodes]\n");
 191                         exit(0);
 192                 }
 193         }
 194
 195         bfd_init();
 196         memset(image, 0, sizeof(image));
 197
 198         kbuff = get_klog_buff(&klen);
 199
 200         len = get_last_jit_image(kbuff, klen, image, sizeof(image), &base);
 201         if (len > 0 && base > 0)
 202                 get_asm_insns(image, len, base, opcodes);
 203
 204         put_klog_buff(kbuff);
 205
 206         return 0;
 207 }