interpreter.rs 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708
  1. // SPDX-License-Identifier: (Apache-2.0 OR MIT)
  2. // Derived from uBPF <https://github.com/iovisor/ubpf>
  3. // Copyright 2015 Big Switch Networks, Inc
  4. // (uBPF: VM architecture, parts of the interpreter, originally in C)
  5. // Copyright 2016 6WIND S.A. <quentin.monnet@6wind.com>
  6. // (Translation to Rust, MetaBuff/multiple classes addition, hashmaps for helpers)
  7. use crate::{
  8. ebpf::{self, Insn},
  9. helpers::BPF_FUNC_MAPPER,
  10. stack::StackFrame,
  11. *,
  12. };
  13. #[cfg(not(feature = "user"))]
  14. #[allow(unused)]
  15. fn check_mem(
  16. addr: u64,
  17. len: usize,
  18. access_type: &str,
  19. insn_ptr: usize,
  20. mbuff: &[u8],
  21. mem: &[u8],
  22. stack: &[u8],
  23. ) -> Result<(), Error> {
  24. log::trace!(
  25. "check_mem: addr {:#x}, len {}, access_type {}, insn_ptr {}",
  26. addr,
  27. len,
  28. access_type,
  29. insn_ptr
  30. );
  31. log::trace!(
  32. "check_mem: mbuff: {:#x}/{:#x}, mem: {:#x}/{:#x}, stack: {:#x}/{:#x}",
  33. mbuff.as_ptr() as u64,
  34. mbuff.len(),
  35. mem.as_ptr() as u64,
  36. mem.len(),
  37. stack.as_ptr() as u64,
  38. stack.len()
  39. );
  40. Ok(())
  41. }
  42. #[cfg(feature = "user")]
  43. fn check_mem(
  44. addr: u64,
  45. len: usize,
  46. access_type: &str,
  47. insn_ptr: usize,
  48. mbuff: &[u8],
  49. mem: &[u8],
  50. stack: &[u8],
  51. ) -> Result<(), Error> {
  52. if let Some(addr_end) = addr.checked_add(len as u64) {
  53. if mbuff.as_ptr() as u64 <= addr && addr_end <= mbuff.as_ptr() as u64 + mbuff.len() as u64 {
  54. return Ok(());
  55. }
  56. if mem.as_ptr() as u64 <= addr && addr_end <= mem.as_ptr() as u64 + mem.len() as u64 {
  57. return Ok(());
  58. }
  59. if stack.as_ptr() as u64 <= addr && addr_end <= stack.as_ptr() as u64 + stack.len() as u64 {
  60. return Ok(());
  61. }
  62. }
  63. Err(Error::new(ErrorKind::Other, format!(
  64. "Error: out of bounds memory {} (insn #{:?}), addr {:#x}, size {:?}\nmbuff: {:#x}/{:#x}, mem: {:#x}/{:#x}, stack: {:#x}/{:#x}",
  65. access_type, insn_ptr, addr, len,
  66. mbuff.as_ptr() as u64, mbuff.len(),
  67. mem.as_ptr() as u64, mem.len(),
  68. stack.as_ptr() as u64, stack.len()
  69. )))
  70. }
  71. #[inline]
  72. fn do_jump(insn_ptr: &mut usize, insn: &Insn) {
  73. *insn_ptr = (*insn_ptr as i16 + insn.off) as usize;
  74. }
  75. #[allow(unknown_lints)]
  76. #[allow(cyclomatic_complexity)]
  77. pub fn execute_program(
  78. prog_: Option<&[u8]>,
  79. mem: &[u8],
  80. mbuff: &[u8],
  81. helpers: &HashMap<u32, ebpf::Helper>,
  82. ) -> Result<u64, Error> {
  83. const U32MAX: u64 = u32::MAX as u64;
  84. const SHIFT_MASK_64: u64 = 0x3f;
  85. let prog = match prog_ {
  86. Some(prog) => prog,
  87. None => Err(Error::new(
  88. ErrorKind::Other,
  89. "Error: No program set, call prog_set() to load one",
  90. ))?,
  91. };
  92. let mut stacks = Vec::new();
  93. let stack = StackFrame::new();
  94. // R1 points to beginning of memory area, R10 to stack
  95. let mut reg: [u64; 11] = [
  96. 0,
  97. 0,
  98. 0,
  99. 0,
  100. 0,
  101. 0,
  102. 0,
  103. 0,
  104. 0,
  105. 0,
  106. stack.as_ptr() as u64 + stack.len() as u64,
  107. ];
  108. stacks.push(stack);
  109. if !mbuff.is_empty() {
  110. reg[1] = mbuff.as_ptr() as u64;
  111. } else if !mem.is_empty() {
  112. reg[1] = mem.as_ptr() as u64;
  113. }
  114. let check_mem_load =
  115. |stack: &[u8], addr: u64, len: usize, insn_ptr: usize| -> Result<(), Error> {
  116. check_mem(addr, len, "load", insn_ptr, mbuff, mem, stack)
  117. };
  118. let check_mem_store =
  119. |stack: &[u8], addr: u64, len: usize, insn_ptr: usize| -> Result<(), Error> {
  120. check_mem(addr, len, "store", insn_ptr, mbuff, mem, stack)
  121. };
  122. // Loop on instructions
  123. let mut insn_ptr: usize = 0;
  124. while insn_ptr * ebpf::INSN_SIZE < prog.len() {
  125. let insn = ebpf::get_insn(prog, insn_ptr);
  126. insn_ptr += 1;
  127. let _dst = insn.dst as usize;
  128. let _src = insn.src as usize;
  129. match insn.opc {
  130. // BPF_LD class
  131. // LD_ABS_* and LD_IND_* are supposed to load pointer to data from metadata buffer.
  132. // Since this pointer is constant, and since we already know it (mem), do not
  133. // bother re-fetching it, just use mem already.
  134. ebpf::LD_ABS_B => {
  135. reg[0] = unsafe {
  136. let x = (mem.as_ptr() as u64 + (insn.imm as u32) as u64) as *const u8;
  137. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  138. x.read_unaligned() as u64
  139. }
  140. }
  141. ebpf::LD_ABS_H => {
  142. reg[0] = unsafe {
  143. let x = (mem.as_ptr() as u64 + (insn.imm as u32) as u64) as *const u16;
  144. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  145. x.read_unaligned() as u64
  146. }
  147. }
  148. ebpf::LD_ABS_W => {
  149. reg[0] = unsafe {
  150. let x = (mem.as_ptr() as u64 + (insn.imm as u32) as u64) as *const u32;
  151. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  152. x.read_unaligned() as u64
  153. }
  154. }
  155. ebpf::LD_ABS_DW => {
  156. log::info!("executing LD_ABS_DW, set reg[{}] to {:#x}", _dst, insn.imm);
  157. reg[0] = unsafe {
  158. let x = (mem.as_ptr() as u64 + (insn.imm as u32) as u64) as *const u64;
  159. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  160. x.read_unaligned()
  161. }
  162. }
  163. ebpf::LD_IND_B => {
  164. reg[0] = unsafe {
  165. let x =
  166. (mem.as_ptr() as u64 + reg[_src] + (insn.imm as u32) as u64) as *const u8;
  167. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  168. x.read_unaligned() as u64
  169. }
  170. }
  171. ebpf::LD_IND_H => {
  172. reg[0] = unsafe {
  173. let x =
  174. (mem.as_ptr() as u64 + reg[_src] + (insn.imm as u32) as u64) as *const u16;
  175. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  176. x.read_unaligned() as u64
  177. }
  178. }
  179. ebpf::LD_IND_W => {
  180. reg[0] = unsafe {
  181. let x =
  182. (mem.as_ptr() as u64 + reg[_src] + (insn.imm as u32) as u64) as *const u32;
  183. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  184. x.read_unaligned() as u64
  185. }
  186. }
  187. ebpf::LD_IND_DW => {
  188. reg[0] = unsafe {
  189. let x =
  190. (mem.as_ptr() as u64 + reg[_src] + (insn.imm as u32) as u64) as *const u64;
  191. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  192. x.read_unaligned()
  193. }
  194. }
  195. ebpf::LD_DW_IMM => {
  196. let next_insn = ebpf::get_insn(prog, insn_ptr);
  197. insn_ptr += 1;
  198. // log::warn!(
  199. // "executing LD_DW_IMM, set reg[{}] to {:#x}",
  200. // _dst,
  201. // ((insn.imm as u32) as u64) + ((next_insn.imm as u64) << 32)
  202. // );
  203. reg[_dst] = ((insn.imm as u32) as u64) + ((next_insn.imm as u64) << 32);
  204. }
  205. // BPF_LDX class
  206. ebpf::LD_B_REG => {
  207. reg[_dst] = unsafe {
  208. #[allow(clippy::cast_ptr_alignment)]
  209. let x = (reg[_src] as *const u8).offset(insn.off as isize);
  210. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 1, insn_ptr)?;
  211. x.read_unaligned() as u64
  212. }
  213. }
  214. ebpf::LD_H_REG => {
  215. reg[_dst] = unsafe {
  216. #[allow(clippy::cast_ptr_alignment)]
  217. let x = (reg[_src] as *const u8).offset(insn.off as isize) as *const u16;
  218. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 2, insn_ptr)?;
  219. x.read_unaligned() as u64
  220. }
  221. }
  222. ebpf::LD_W_REG => {
  223. reg[_dst] = unsafe {
  224. #[allow(clippy::cast_ptr_alignment)]
  225. let x = (reg[_src] as *const u8).offset(insn.off as isize) as *const u32;
  226. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 4, insn_ptr)?;
  227. // log::warn!(
  228. // "executing LD_W_REG, the ptr is REG:{} -> [{:#x}] + {:#x}",
  229. // _src,
  230. // reg[_src],
  231. // insn.off
  232. // );
  233. x.read_unaligned() as u64
  234. }
  235. }
  236. ebpf::LD_DW_REG => {
  237. reg[_dst] = unsafe {
  238. #[allow(clippy::cast_ptr_alignment)]
  239. let x = (reg[_src] as *const u8).offset(insn.off as isize) as *const u64;
  240. check_mem_load(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  241. x.read_unaligned()
  242. }
  243. }
  244. // BPF_ST class
  245. ebpf::ST_B_IMM => unsafe {
  246. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u8;
  247. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 1, insn_ptr)?;
  248. x.write_unaligned(insn.imm as u8);
  249. },
  250. ebpf::ST_H_IMM => unsafe {
  251. #[allow(clippy::cast_ptr_alignment)]
  252. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u16;
  253. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 2, insn_ptr)?;
  254. x.write_unaligned(insn.imm as u16);
  255. },
  256. ebpf::ST_W_IMM => unsafe {
  257. #[allow(clippy::cast_ptr_alignment)]
  258. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u32;
  259. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 4, insn_ptr)?;
  260. x.write_unaligned(insn.imm as u32);
  261. },
  262. ebpf::ST_DW_IMM => unsafe {
  263. #[allow(clippy::cast_ptr_alignment)]
  264. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u64;
  265. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  266. x.write_unaligned(insn.imm as u64);
  267. },
  268. // BPF_STX class
  269. ebpf::ST_B_REG => unsafe {
  270. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u8;
  271. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 1, insn_ptr)?;
  272. x.write_unaligned(reg[_src] as u8);
  273. },
  274. ebpf::ST_H_REG => unsafe {
  275. #[allow(clippy::cast_ptr_alignment)]
  276. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u16;
  277. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 2, insn_ptr)?;
  278. x.write_unaligned(reg[_src] as u16);
  279. },
  280. ebpf::ST_W_REG => unsafe {
  281. #[allow(clippy::cast_ptr_alignment)]
  282. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u32;
  283. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 4, insn_ptr)?;
  284. x.write_unaligned(reg[_src] as u32);
  285. },
  286. ebpf::ST_DW_REG => unsafe {
  287. #[allow(clippy::cast_ptr_alignment)]
  288. let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u64;
  289. check_mem_store(stacks.last().unwrap().as_slice(), x as u64, 8, insn_ptr)?;
  290. x.write_unaligned(reg[_src]);
  291. },
  292. ebpf::ST_W_XADD => unimplemented!(),
  293. ebpf::ST_DW_XADD => unimplemented!(),
  294. // BPF_ALU class
  295. // TODO Check how overflow works in kernel. Should we &= U32MAX all src register value
  296. // before we do the operation?
  297. // Cf ((0x11 << 32) - (0x1 << 32)) as u32 VS ((0x11 << 32) as u32 - (0x1 << 32) as u32
  298. ebpf::ADD32_IMM => reg[_dst] = (reg[_dst] as i32).wrapping_add(insn.imm) as u64, //((reg[_dst] & U32MAX) + insn.imm as u64) & U32MAX,
  299. ebpf::ADD32_REG => reg[_dst] = (reg[_dst] as i32).wrapping_add(reg[_src] as i32) as u64, //((reg[_dst] & U32MAX) + (reg[_src] & U32MAX)) & U32MAX,
  300. ebpf::SUB32_IMM => reg[_dst] = (reg[_dst] as i32).wrapping_sub(insn.imm) as u64,
  301. ebpf::SUB32_REG => reg[_dst] = (reg[_dst] as i32).wrapping_sub(reg[_src] as i32) as u64,
  302. ebpf::MUL32_IMM => reg[_dst] = (reg[_dst] as i32).wrapping_mul(insn.imm) as u64,
  303. ebpf::MUL32_REG => reg[_dst] = (reg[_dst] as i32).wrapping_mul(reg[_src] as i32) as u64,
  304. ebpf::DIV32_IMM if insn.imm as u32 == 0 => reg[_dst] = 0,
  305. ebpf::DIV32_IMM => reg[_dst] = (reg[_dst] as u32 / insn.imm as u32) as u64,
  306. ebpf::DIV32_REG if reg[_src] as u32 == 0 => reg[_dst] = 0,
  307. ebpf::DIV32_REG => reg[_dst] = (reg[_dst] as u32 / reg[_src] as u32) as u64,
  308. ebpf::OR32_IMM => reg[_dst] = (reg[_dst] as u32 | insn.imm as u32) as u64,
  309. ebpf::OR32_REG => reg[_dst] = (reg[_dst] as u32 | reg[_src] as u32) as u64,
  310. ebpf::AND32_IMM => reg[_dst] = (reg[_dst] as u32 & insn.imm as u32) as u64,
  311. ebpf::AND32_REG => reg[_dst] = (reg[_dst] as u32 & reg[_src] as u32) as u64,
  312. // As for the 64-bit version, we should mask the number of bits to shift with
  313. // 0x1f, but .wrappping_shr() already takes care of it for us.
  314. ebpf::LSH32_IMM => reg[_dst] = (reg[_dst] as u32).wrapping_shl(insn.imm as u32) as u64,
  315. ebpf::LSH32_REG => reg[_dst] = (reg[_dst] as u32).wrapping_shl(reg[_src] as u32) as u64,
  316. ebpf::RSH32_IMM => reg[_dst] = (reg[_dst] as u32).wrapping_shr(insn.imm as u32) as u64,
  317. ebpf::RSH32_REG => reg[_dst] = (reg[_dst] as u32).wrapping_shr(reg[_src] as u32) as u64,
  318. ebpf::NEG32 => {
  319. reg[_dst] = (reg[_dst] as i32).wrapping_neg() as u64;
  320. reg[_dst] &= U32MAX;
  321. }
  322. ebpf::MOD32_IMM if insn.imm as u32 == 0 => (),
  323. ebpf::MOD32_IMM => reg[_dst] = (reg[_dst] as u32 % insn.imm as u32) as u64,
  324. ebpf::MOD32_REG if reg[_src] as u32 == 0 => (),
  325. ebpf::MOD32_REG => reg[_dst] = (reg[_dst] as u32 % reg[_src] as u32) as u64,
  326. ebpf::XOR32_IMM => reg[_dst] = (reg[_dst] as u32 ^ insn.imm as u32) as u64,
  327. ebpf::XOR32_REG => reg[_dst] = (reg[_dst] as u32 ^ reg[_src] as u32) as u64,
  328. ebpf::MOV32_IMM => reg[_dst] = insn.imm as u32 as u64,
  329. ebpf::MOV32_REG => reg[_dst] = (reg[_src] as u32) as u64,
  330. // As for the 64-bit version, we should mask the number of bits to shift with
  331. // 0x1f, but .wrappping_shr() already takes care of it for us.
  332. ebpf::ARSH32_IMM => {
  333. reg[_dst] = (reg[_dst] as i32).wrapping_shr(insn.imm as u32) as u64;
  334. reg[_dst] &= U32MAX;
  335. }
  336. ebpf::ARSH32_REG => {
  337. reg[_dst] = (reg[_dst] as i32).wrapping_shr(reg[_src] as u32) as u64;
  338. reg[_dst] &= U32MAX;
  339. }
  340. ebpf::LE => {
  341. reg[_dst] = match insn.imm {
  342. 16 => (reg[_dst] as u16).to_le() as u64,
  343. 32 => (reg[_dst] as u32).to_le() as u64,
  344. 64 => reg[_dst].to_le(),
  345. _ => unreachable!(),
  346. };
  347. }
  348. ebpf::BE => {
  349. reg[_dst] = match insn.imm {
  350. 16 => (reg[_dst] as u16).to_be() as u64,
  351. 32 => (reg[_dst] as u32).to_be() as u64,
  352. 64 => reg[_dst].to_be(),
  353. _ => unreachable!(),
  354. };
  355. }
  356. // BPF_ALU64 class
  357. ebpf::ADD64_IMM => reg[_dst] = reg[_dst].wrapping_add(insn.imm as u64),
  358. ebpf::ADD64_REG => reg[_dst] = reg[_dst].wrapping_add(reg[_src]),
  359. ebpf::SUB64_IMM => reg[_dst] = reg[_dst].wrapping_sub(insn.imm as u64),
  360. ebpf::SUB64_REG => reg[_dst] = reg[_dst].wrapping_sub(reg[_src]),
  361. ebpf::MUL64_IMM => reg[_dst] = reg[_dst].wrapping_mul(insn.imm as u64),
  362. ebpf::MUL64_REG => reg[_dst] = reg[_dst].wrapping_mul(reg[_src]),
  363. ebpf::DIV64_IMM if insn.imm == 0 => reg[_dst] = 0,
  364. ebpf::DIV64_IMM => reg[_dst] /= insn.imm as u64,
  365. ebpf::DIV64_REG if reg[_src] == 0 => reg[_dst] = 0,
  366. ebpf::DIV64_REG => reg[_dst] /= reg[_src],
  367. ebpf::OR64_IMM => reg[_dst] |= insn.imm as u64,
  368. ebpf::OR64_REG => reg[_dst] |= reg[_src],
  369. ebpf::AND64_IMM => reg[_dst] &= insn.imm as u64,
  370. ebpf::AND64_REG => reg[_dst] &= reg[_src],
  371. ebpf::LSH64_IMM => reg[_dst] <<= insn.imm as u64 & SHIFT_MASK_64,
  372. ebpf::LSH64_REG => reg[_dst] <<= reg[_src] & SHIFT_MASK_64,
  373. ebpf::RSH64_IMM => reg[_dst] >>= insn.imm as u64 & SHIFT_MASK_64,
  374. ebpf::RSH64_REG => reg[_dst] >>= reg[_src] & SHIFT_MASK_64,
  375. ebpf::NEG64 => reg[_dst] = -(reg[_dst] as i64) as u64,
  376. ebpf::MOD64_IMM if insn.imm == 0 => (),
  377. ebpf::MOD64_IMM => reg[_dst] %= insn.imm as u64,
  378. ebpf::MOD64_REG if reg[_src] == 0 => (),
  379. ebpf::MOD64_REG => reg[_dst] %= reg[_src],
  380. ebpf::XOR64_IMM => reg[_dst] ^= insn.imm as u64,
  381. ebpf::XOR64_REG => reg[_dst] ^= reg[_src],
  382. ebpf::MOV64_IMM => reg[_dst] = insn.imm as u64,
  383. ebpf::MOV64_REG => reg[_dst] = reg[_src],
  384. ebpf::ARSH64_IMM => {
  385. reg[_dst] = (reg[_dst] as i64 >> (insn.imm as u64 & SHIFT_MASK_64)) as u64
  386. }
  387. ebpf::ARSH64_REG => {
  388. reg[_dst] = (reg[_dst] as i64 >> (reg[_src] as u64 & SHIFT_MASK_64)) as u64
  389. }
  390. // BPF_JMP class
  391. // TODO: check this actually works as expected for signed / unsigned ops
  392. ebpf::JA => do_jump(&mut insn_ptr, &insn),
  393. ebpf::JEQ_IMM => {
  394. if reg[_dst] == insn.imm as u64 {
  395. do_jump(&mut insn_ptr, &insn);
  396. }
  397. }
  398. ebpf::JEQ_REG => {
  399. if reg[_dst] == reg[_src] {
  400. do_jump(&mut insn_ptr, &insn);
  401. }
  402. }
  403. ebpf::JGT_IMM => {
  404. if reg[_dst] > insn.imm as u64 {
  405. do_jump(&mut insn_ptr, &insn);
  406. }
  407. }
  408. ebpf::JGT_REG => {
  409. if reg[_dst] > reg[_src] {
  410. do_jump(&mut insn_ptr, &insn);
  411. }
  412. }
  413. ebpf::JGE_IMM => {
  414. if reg[_dst] >= insn.imm as u64 {
  415. do_jump(&mut insn_ptr, &insn);
  416. }
  417. }
  418. ebpf::JGE_REG => {
  419. if reg[_dst] >= reg[_src] {
  420. do_jump(&mut insn_ptr, &insn);
  421. }
  422. }
  423. ebpf::JLT_IMM => {
  424. if reg[_dst] < insn.imm as u64 {
  425. do_jump(&mut insn_ptr, &insn);
  426. }
  427. }
  428. ebpf::JLT_REG => {
  429. if reg[_dst] < reg[_src] {
  430. do_jump(&mut insn_ptr, &insn);
  431. }
  432. }
  433. ebpf::JLE_IMM => {
  434. if reg[_dst] <= insn.imm as u64 {
  435. do_jump(&mut insn_ptr, &insn);
  436. }
  437. }
  438. ebpf::JLE_REG => {
  439. if reg[_dst] <= reg[_src] {
  440. do_jump(&mut insn_ptr, &insn);
  441. }
  442. }
  443. ebpf::JSET_IMM => {
  444. if reg[_dst] & insn.imm as u64 != 0 {
  445. do_jump(&mut insn_ptr, &insn);
  446. }
  447. }
  448. ebpf::JSET_REG => {
  449. if reg[_dst] & reg[_src] != 0 {
  450. do_jump(&mut insn_ptr, &insn);
  451. }
  452. }
  453. ebpf::JNE_IMM => {
  454. if reg[_dst] != insn.imm as u64 {
  455. do_jump(&mut insn_ptr, &insn);
  456. }
  457. }
  458. ebpf::JNE_REG => {
  459. if reg[_dst] != reg[_src] {
  460. do_jump(&mut insn_ptr, &insn);
  461. }
  462. }
  463. ebpf::JSGT_IMM => {
  464. if reg[_dst] as i64 > insn.imm as i64 {
  465. do_jump(&mut insn_ptr, &insn);
  466. }
  467. }
  468. ebpf::JSGT_REG => {
  469. if reg[_dst] as i64 > reg[_src] as i64 {
  470. do_jump(&mut insn_ptr, &insn);
  471. }
  472. }
  473. ebpf::JSGE_IMM => {
  474. if reg[_dst] as i64 >= insn.imm as i64 {
  475. do_jump(&mut insn_ptr, &insn);
  476. }
  477. }
  478. ebpf::JSGE_REG => {
  479. if reg[_dst] as i64 >= reg[_src] as i64 {
  480. do_jump(&mut insn_ptr, &insn);
  481. }
  482. }
  483. ebpf::JSLT_IMM => {
  484. if (reg[_dst] as i64) < insn.imm as i64 {
  485. do_jump(&mut insn_ptr, &insn);
  486. }
  487. }
  488. ebpf::JSLT_REG => {
  489. if (reg[_dst] as i64) < reg[_src] as i64 {
  490. do_jump(&mut insn_ptr, &insn);
  491. }
  492. }
  493. ebpf::JSLE_IMM => {
  494. if reg[_dst] as i64 <= insn.imm as i64 {
  495. do_jump(&mut insn_ptr, &insn);
  496. }
  497. }
  498. ebpf::JSLE_REG => {
  499. if reg[_dst] as i64 <= reg[_src] as i64 {
  500. do_jump(&mut insn_ptr, &insn);
  501. }
  502. }
  503. // BPF_JMP32 class
  504. ebpf::JEQ_IMM32 => {
  505. if reg[_dst] as u32 == insn.imm as u32 {
  506. do_jump(&mut insn_ptr, &insn);
  507. }
  508. }
  509. ebpf::JEQ_REG32 => {
  510. if reg[_dst] as u32 == reg[_src] as u32 {
  511. do_jump(&mut insn_ptr, &insn);
  512. }
  513. }
  514. ebpf::JGT_IMM32 => {
  515. if reg[_dst] as u32 > insn.imm as u32 {
  516. do_jump(&mut insn_ptr, &insn);
  517. }
  518. }
  519. ebpf::JGT_REG32 => {
  520. if reg[_dst] as u32 > reg[_src] as u32 {
  521. do_jump(&mut insn_ptr, &insn);
  522. }
  523. }
  524. ebpf::JGE_IMM32 => {
  525. if reg[_dst] as u32 >= insn.imm as u32 {
  526. do_jump(&mut insn_ptr, &insn);
  527. }
  528. }
  529. ebpf::JGE_REG32 => {
  530. if reg[_dst] as u32 >= reg[_src] as u32 {
  531. do_jump(&mut insn_ptr, &insn);
  532. }
  533. }
  534. ebpf::JLT_IMM32 => {
  535. if (reg[_dst] as u32) < insn.imm as u32 {
  536. do_jump(&mut insn_ptr, &insn);
  537. }
  538. }
  539. ebpf::JLT_REG32 => {
  540. if (reg[_dst] as u32) < reg[_src] as u32 {
  541. do_jump(&mut insn_ptr, &insn);
  542. }
  543. }
  544. ebpf::JLE_IMM32 => {
  545. if reg[_dst] as u32 <= insn.imm as u32 {
  546. do_jump(&mut insn_ptr, &insn);
  547. }
  548. }
  549. ebpf::JLE_REG32 => {
  550. if reg[_dst] as u32 <= reg[_src] as u32 {
  551. do_jump(&mut insn_ptr, &insn);
  552. }
  553. }
  554. ebpf::JSET_IMM32 => {
  555. if reg[_dst] as u32 & insn.imm as u32 != 0 {
  556. do_jump(&mut insn_ptr, &insn);
  557. }
  558. }
  559. ebpf::JSET_REG32 => {
  560. if reg[_dst] as u32 & reg[_src] as u32 != 0 {
  561. do_jump(&mut insn_ptr, &insn);
  562. }
  563. }
  564. ebpf::JNE_IMM32 => {
  565. if reg[_dst] as u32 != insn.imm as u32 {
  566. do_jump(&mut insn_ptr, &insn);
  567. }
  568. }
  569. ebpf::JNE_REG32 => {
  570. if reg[_dst] as u32 != reg[_src] as u32 {
  571. do_jump(&mut insn_ptr, &insn);
  572. }
  573. }
  574. ebpf::JSGT_IMM32 => {
  575. if reg[_dst] as i32 > insn.imm {
  576. do_jump(&mut insn_ptr, &insn);
  577. }
  578. }
  579. ebpf::JSGT_REG32 => {
  580. if reg[_dst] as i32 > reg[_src] as i32 {
  581. do_jump(&mut insn_ptr, &insn);
  582. }
  583. }
  584. ebpf::JSGE_IMM32 => {
  585. if reg[_dst] as i32 >= insn.imm {
  586. do_jump(&mut insn_ptr, &insn);
  587. }
  588. }
  589. ebpf::JSGE_REG32 => {
  590. if reg[_dst] as i32 >= reg[_src] as i32 {
  591. do_jump(&mut insn_ptr, &insn);
  592. }
  593. }
  594. ebpf::JSLT_IMM32 => {
  595. if (reg[_dst] as i32) < insn.imm {
  596. do_jump(&mut insn_ptr, &insn);
  597. }
  598. }
  599. ebpf::JSLT_REG32 => {
  600. if (reg[_dst] as i32) < reg[_src] as i32 {
  601. do_jump(&mut insn_ptr, &insn);
  602. }
  603. }
  604. ebpf::JSLE_IMM32 => {
  605. if reg[_dst] as i32 <= insn.imm {
  606. do_jump(&mut insn_ptr, &insn);
  607. }
  608. }
  609. ebpf::JSLE_REG32 => {
  610. if reg[_dst] as i32 <= reg[_src] as i32 {
  611. do_jump(&mut insn_ptr, &insn);
  612. }
  613. }
  614. // Do not delegate the check to the verifier, since registered functions can be
  615. // changed after the program has been verified.
  616. ebpf::CALL => {
  617. // See https://www.kernel.org/doc/html/latest/bpf/standardization/instruction-set.html#id16
  618. let src_reg = _src;
  619. let call_func_res = match src_reg {
  620. 0 => {
  621. // Handle call by address to external function.
  622. if let Some(function) = helpers.get(&(insn.imm as u32)) {
  623. reg[0] = function(reg[1], reg[2], reg[3], reg[4], reg[5]);
  624. Ok(())
  625. }else {
  626. Err(format!(
  627. "Error: unknown helper function (id: {:#x}) [{}], (instruction #{})",
  628. insn.imm as u32,BPF_FUNC_MAPPER[insn.imm as usize],insn_ptr
  629. ))
  630. }
  631. }
  632. 1 => {
  633. // bpf to bpf call
  634. // The function is in the same program, so we can just jump to the address
  635. if stacks.len() >= ebpf::RBPF_MAX_CALL_DEPTH{
  636. Err(format!(
  637. "Error: bpf to bpf call stack limit reached (instruction #{}) max depth: {}",
  638. insn_ptr, ebpf::RBPF_MAX_CALL_DEPTH
  639. ))
  640. }else {
  641. let mut pre_stack = stacks.last_mut().unwrap();
  642. // Save the callee saved registers
  643. pre_stack.save_registers(&reg[6..=9]);
  644. // Save the return address
  645. pre_stack.save_return_address(insn_ptr as u64);
  646. // save the stack pointer
  647. pre_stack.save_sp(reg[10]);
  648. let mut stack = StackFrame::new();
  649. log::trace!("BPF TO BPF CALL: new pc: {} + {} = {}",insn_ptr ,insn.imm,insn_ptr + insn.imm as usize);
  650. reg[10] = stack.as_ptr() as u64 + stack.len() as u64;
  651. stacks.push(stack);
  652. insn_ptr += insn.imm as usize;
  653. Ok(())
  654. }
  655. }
  656. _ =>{
  657. Err(format!(
  658. "Error: the function call type (id: {:#x}) [{}], (instruction #{}) not supported",
  659. insn.imm as u32,BPF_FUNC_MAPPER[insn.imm as usize],insn_ptr
  660. ))
  661. }
  662. };
  663. if let Err(e) = call_func_res {
  664. Err(Error::new(ErrorKind::Other, e))?;
  665. }
  666. }
  667. ebpf::TAIL_CALL => unimplemented!(),
  668. ebpf::EXIT => {
  669. if stacks.len() == 1 {
  670. return Ok(reg[0]);
  671. } else {
  672. // Pop the stack
  673. stacks.pop();
  674. let stack = stacks.last().unwrap();
  675. // Restore the callee saved registers
  676. reg[6..=9].copy_from_slice(&stack.get_registers());
  677. // Restore the return address
  678. insn_ptr = stack.get_return_address() as usize;
  679. // Restore the stack pointer
  680. reg[10] = stack.get_sp();
  681. log::trace!("EXIT: new pc: {}", insn_ptr);
  682. }
  683. }
  684. _ => unreachable!(),
  685. }
  686. }
  687. unreachable!()
  688. }