[PATCH 09/13] libbpf: Add bpf_insn__interpret function
From: Jiri Olsa
Date: Mon Mar 12 2018 - 05:43:42 EST
Adding bpf_insn__interpret function to run ebpf program
in user space.
It's 'borrowed' from systemtap code, I still need to figure
the proper credits, that will go to the file header in case
this would ever go in.
Link: http://lkml.kernel.org/n/tip-qqxsyw6imdisj3dydd6e21y7@xxxxxxxxxxxxxx
Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
---
tools/lib/bpf/Build | 2 +-
tools/lib/bpf/interp.c | 245 +++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 246 insertions(+), 1 deletion(-)
create mode 100644 tools/lib/bpf/interp.c
diff --git a/tools/lib/bpf/Build b/tools/lib/bpf/Build
index 64c679d67109..af99109f3d2d 100644
--- a/tools/lib/bpf/Build
+++ b/tools/lib/bpf/Build
@@ -1 +1 @@
-libbpf-y := libbpf.o bpf.o nlattr.o
+libbpf-y := libbpf.o bpf.o nlattr.o interp.o
diff --git a/tools/lib/bpf/interp.c b/tools/lib/bpf/interp.c
new file mode 100644
index 000000000000..2ceb6a0836c3
--- /dev/null
+++ b/tools/lib/bpf/interp.c
@@ -0,0 +1,245 @@
+#include <uapi/linux/bpf.h>
+#include <stdlib.h>
+#include "interp.h"
+
+u64 bpf_interp__run(struct bpf_interp *interp)
+{
+ const struct bpf_insn *i = interp->insns + interp->insns_start;
+ u64 stack[512 / 8];
+ u64 regs[MAX_BPF_REG];
+
+ regs[BPF_REG_10] = (uintptr_t)stack + sizeof(stack);
+
+ while ((size_t)(i - interp->insns) < interp->insns_cnt) {
+ u64 dr, sr, si, s1;
+
+ dr = regs[i->dst_reg];
+ sr = regs[i->src_reg];
+ si = i->imm;
+ s1 = i->code & BPF_X ? sr : si;
+
+ switch (i->code) {
+ case BPF_LDX | BPF_MEM | BPF_B:
+ dr = *(u8 *)((uintptr_t) sr + i->off);
+ break;
+ case BPF_LDX | BPF_MEM | BPF_H:
+ dr = *(u16 *)((uintptr_t) sr + i->off);
+ break;
+ case BPF_LDX | BPF_MEM | BPF_W:
+ dr = *(u32 *)((uintptr_t) sr + i->off);
+ break;
+ case BPF_LDX | BPF_MEM | BPF_DW:
+ dr = *(u64 *)((uintptr_t) sr + i->off);
+ break;
+ case BPF_ST | BPF_MEM | BPF_B:
+ sr = si;
+ /* Fallthrough */
+ case BPF_STX | BPF_MEM | BPF_B:
+ *(u8 *)((uintptr_t) dr + i->off) = sr;
+ goto nowrite;
+ case BPF_ST | BPF_MEM | BPF_H:
+ sr = si;
+ /* Fallthrough */
+ case BPF_STX | BPF_MEM | BPF_H:
+ *(u16 *)((uintptr_t) dr + i->off) = sr;
+ goto nowrite;
+ case BPF_ST | BPF_MEM | BPF_W:
+ sr = si;
+ /* Fallthrough */
+ case BPF_STX | BPF_MEM | BPF_W:
+ *(u32 *)((uintptr_t) dr + i->off) = sr;
+ goto nowrite;
+ case BPF_ST | BPF_MEM | BPF_DW:
+ sr = si;
+ /* Fallthrough */
+ case BPF_STX | BPF_MEM | BPF_DW:
+ *(u64 *)((uintptr_t) dr + i->off) = sr;
+ goto nowrite;
+
+ case BPF_ALU64 | BPF_ADD | BPF_X:
+ case BPF_ALU64 | BPF_ADD | BPF_K:
+ dr += s1;
+ break;
+ case BPF_ALU64 | BPF_SUB | BPF_X:
+ case BPF_ALU64 | BPF_SUB | BPF_K:
+ dr -= s1;
+ break;
+ case BPF_ALU64 | BPF_AND | BPF_X:
+ case BPF_ALU64 | BPF_AND | BPF_K:
+ dr &= s1;
+ break;
+ case BPF_ALU64 | BPF_OR | BPF_X:
+ case BPF_ALU64 | BPF_OR | BPF_K:
+ dr |= s1;
+ break;
+ case BPF_ALU64 | BPF_LSH | BPF_X:
+ case BPF_ALU64 | BPF_LSH | BPF_K:
+ dr <<= s1;
+ break;
+ case BPF_ALU64 | BPF_RSH | BPF_X:
+ case BPF_ALU64 | BPF_RSH | BPF_K:
+ dr >>= s1;
+ break;
+ case BPF_ALU64 | BPF_XOR | BPF_X:
+ case BPF_ALU64 | BPF_XOR | BPF_K:
+ dr ^= s1;
+ break;
+ case BPF_ALU64 | BPF_MUL | BPF_X:
+ case BPF_ALU64 | BPF_MUL | BPF_K:
+ dr *= s1;
+ break;
+ case BPF_ALU64 | BPF_MOV | BPF_X:
+ case BPF_ALU64 | BPF_MOV | BPF_K:
+ dr = s1;
+ break;
+ case BPF_ALU64 | BPF_ARSH | BPF_X:
+ case BPF_ALU64 | BPF_ARSH | BPF_K:
+ dr = (u64) dr >> s1;
+ break;
+ case BPF_ALU64 | BPF_NEG:
+ dr = -sr;
+ /* Fallthrough */
+ case BPF_ALU64 | BPF_DIV | BPF_X:
+ case BPF_ALU64 | BPF_DIV | BPF_K:
+ if (s1 == 0)
+ return 0;
+ dr /= s1;
+ break;
+ case BPF_ALU64 | BPF_MOD | BPF_X:
+ case BPF_ALU64 | BPF_MOD | BPF_K:
+ if (s1 == 0)
+ return 0;
+ dr %= s1;
+ break;
+
+ case BPF_ALU | BPF_ADD | BPF_X:
+ case BPF_ALU | BPF_ADD | BPF_K:
+ dr = (u32)(dr + s1);
+ break;
+ case BPF_ALU | BPF_SUB | BPF_X:
+ case BPF_ALU | BPF_SUB | BPF_K:
+ dr = (u32)(dr - s1);
+ break;
+ case BPF_ALU | BPF_AND | BPF_X:
+ case BPF_ALU | BPF_AND | BPF_K:
+ dr = (u32)(dr & s1);
+ break;
+ case BPF_ALU | BPF_OR | BPF_X:
+ case BPF_ALU | BPF_OR | BPF_K:
+ dr = (u32)(dr | s1);
+ break;
+ case BPF_ALU | BPF_LSH | BPF_X:
+ case BPF_ALU | BPF_LSH | BPF_K:
+ dr = (u32)dr << s1;
+ break;
+ case BPF_ALU | BPF_RSH | BPF_X:
+ case BPF_ALU | BPF_RSH | BPF_K:
+ dr = (u32)dr >> s1;
+ break;
+ case BPF_ALU | BPF_XOR | BPF_X:
+ case BPF_ALU | BPF_XOR | BPF_K:
+ dr = (u32)(dr ^ s1);
+ break;
+ case BPF_ALU | BPF_MUL | BPF_X:
+ case BPF_ALU | BPF_MUL | BPF_K:
+ dr = (u32)(dr * s1);
+ break;
+ case BPF_ALU | BPF_MOV | BPF_X:
+ case BPF_ALU | BPF_MOV | BPF_K:
+ dr = (u32)s1;
+ break;
+ case BPF_ALU | BPF_ARSH | BPF_X:
+ case BPF_ALU | BPF_ARSH | BPF_K:
+ dr = (u32)dr >> s1;
+ break;
+ case BPF_ALU | BPF_NEG:
+ dr = -(u32)sr;
+ /* Fallthrough */
+ case BPF_ALU | BPF_DIV | BPF_X:
+ case BPF_ALU | BPF_DIV | BPF_K:
+ if ((u32)s1 == 0)
+ return 0;
+ dr = (u32)dr / (u32)s1;
+ break;
+ case BPF_ALU | BPF_MOD | BPF_X:
+ case BPF_ALU | BPF_MOD | BPF_K:
+ if ((u32)s1 == 0)
+ return 0;
+ dr = (u32)dr % (u32)s1;
+ break;
+
+ case BPF_LD | BPF_IMM | BPF_DW:
+ switch (i->src_reg) {
+ case 0:
+ dr = (u32)si | ((u64 )i[1].imm << 32);
+ break;
+ case BPF_PSEUDO_MAP_FD:
+ dr = (u64) si;
+ break;
+ default:
+ abort();
+ }
+ regs[i->dst_reg] = dr;
+ i += 2;
+ continue;
+
+ case BPF_JMP | BPF_JEQ | BPF_X:
+ case BPF_JMP | BPF_JEQ | BPF_K:
+ if (dr == s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JNE | BPF_X:
+ case BPF_JMP | BPF_JNE | BPF_K:
+ if (dr != s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JGT | BPF_X:
+ case BPF_JMP | BPF_JGT | BPF_K:
+ if (dr > s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JGE | BPF_X:
+ case BPF_JMP | BPF_JGE | BPF_K:
+ if (dr >= s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JSGT | BPF_X:
+ case BPF_JMP | BPF_JSGT | BPF_K:
+ if ((u64) dr > (u64) s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JSGE | BPF_X:
+ case BPF_JMP | BPF_JSGE | BPF_K:
+ if ((u64) dr >= (u64) s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JSET | BPF_X:
+ case BPF_JMP | BPF_JSET | BPF_K:
+ if (dr & s1)
+ goto dojmp;
+ goto nowrite;
+ case BPF_JMP | BPF_JA:
+ dojmp:
+ i += 1 + i->off;
+ continue;
+
+ case BPF_JMP | BPF_CALL:
+ if (interp->call_cb(interp, si, regs))
+ return (u64) -1;
+
+ goto nowrite;
+
+ case BPF_JMP | BPF_EXIT:
+ return regs[0];
+
+ default:
+ abort();
+ }
+
+ regs[i->dst_reg] = dr;
+ nowrite:
+ i++;
+ }
+
+ return 0;
+}
--
2.13.6