Página inicial Explorar Ajuda
Entrar
DragonOS-Community
/
rbpf
mirror de https://github.com/DragonOS-Community/rbpf
4
0
Fork 0
Arquivos Issues 0 Wiki
Tree: 115c4a362b
Branches Tags
rbpf
/
src
/
ebpf.rs

ebpf.rs 11 KB
Histórico Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262 
  1. // Copyright 2016 6WIND S.A. <quentin.monnet@6wind.com>
    2. 

  2. //
    3. 

  3. // Licensed under the Apache License, Version 2.0 <http://www.apache.org/licenses/LICENSE-2.0> or
    4. 

  4. // the MIT license <http://opensource.org/licenses/MIT>, at your option. This file may not be
    5. 

  5. // copied, modified, or distributed except according to those terms.
    6. 

  6. 

  7. 

  8. //! This module contains all the definitions related to eBPF.
    9. 

  9. //!
    10. 

  10. //! The number of bytes in an instruction, the maximum number of instructions in a program, and
    11. 

  11. //! also all operation codes are defined here as constants.
    12. 

  12. //!
    13. 

  13. //! The structure for an instruction used by this crate, as well as the function to extract it from
    14. 

  14. //! a program, is also defined in the module.
    15. 

  15. //!
    16. 

  16. //! To learn more about these instructions, see the Linux kernel documentation:
    17. 

  17. //! <https://www.kernel.org/doc/Documentation/networking/filter.txt>, or for a shorter version of
    18. 

  18. //! the list of the operation codes: <https://github.com/iovisor/bpf-docs/blob/master/eBPF.md>
    19. 

  19. 

  20. use std;
    21. 

  21. 

  22. /// Maximum number of instructions in an eBPF program.
    23. 

  23. pub const PROG_MAX_INSNS: usize = 4096;
    24. 

  24. /// Size of an eBPF instructions, in bytes.
    25. 

  25. pub const INSN_SIZE: usize = 8;
    26. 

  26. /// Maximum size of an eBPF program, in bytes.
    27. 

  27. pub const PROG_MAX_SIZE: usize = PROG_MAX_INSNS * INSN_SIZE;
    28. 

  28. /// Stack for the eBPF stack, in bytes.
    29. 

  29. pub const STACK_SIZE: usize = 512;
    30. 

  30. 

  31. // eBPF op codes.
    32. 

  32. // See also https://www.kernel.org/doc/Documentation/networking/filter.txt
    33. 

  33. 

  34. // Three least significant bits are operation class:
    35. 

  35. pub const BPF_LD    : u8 = 0x00;
    36. 

  36. pub const BPF_LDX   : u8 = 0x01;
    37. 

  37. pub const BPF_ST    : u8 = 0x02;
    38. 

  38. pub const BPF_STX   : u8 = 0x03;
    39. 

  39. pub const BPF_ALU   : u8 = 0x04;
    40. 

  40. pub const BPF_JMP   : u8 = 0x05;
    41. 

  41. // [ class 6 unused, reserved for future use ]
    42. 

  42. pub const BPF_ALU64 : u8 = 0x07;
    43. 

  43. 

  44. // For load and store instructions:
    45. 

  45. // +------------+--------+------------+
    46. 

  46. // |   3 bits   | 2 bits |   3 bits   |
    47. 

  47. // |    mode    |  size  | insn class |
    48. 

  48. // +------------+--------+------------+
    49. 

  49. // (MSB)                          (LSB)
    50. 

  50. 

  51. // Size modifiers:
    52. 

  52. pub const BPF_W     : u8 = 0x00; // word
    53. 

  53. pub const BPF_H     : u8 = 0x08; // half-word
    54. 

  54. pub const BPF_B     : u8 = 0x10; // byte
    55. 

  55. pub const BPF_DW    : u8 = 0x18; // double word
    56. 

  56. 

  57. // Mode modifiers:
    58. 

  58. pub const BPF_IMM   : u8 = 0x00;
    59. 

  59. pub const BPF_ABS   : u8 = 0x20;
    60. 

  60. pub const BPF_IND   : u8 = 0x40;
    61. 

  61. pub const BPF_MEM   : u8 = 0x60;
    62. 

  62. // [ 0x80 reserved ]
    63. 

  63. // [ 0xa0 reserved ]
    64. 

  64. pub const BPF_XADD  : u8 = 0xc0; // exclusive add
    65. 

  65. 

  66. // For arithmetic (BPF_ALU/BPF_ALU64) and jump (BPF_JMP) instructions:
    67. 

  67. // +----------------+--------+--------+
    68. 

  68. // |     4 bits     |1 b.|   3 bits   |
    69. 

  69. // | operation code | src| insn class |
    70. 

  70. // +----------------+----+------------+
    71. 

  71. // (MSB)                          (LSB)
    72. 

  72. 

  73. // Source modifiers:
    74. 

  74. pub const BPF_K     : u8 = 0x00; // use 32-bit immediate as source operand
    75. 

  75. pub const BPF_X     : u8 = 0x08; // use `src` register as source operand
    76. 

  76. 

  77. // Operation codes -- BPF_ALU or BPF_ALU64 classes:
    78. 

  78. pub const BPF_ADD   : u8 = 0x00;
    79. 

  79. pub const BPF_SUB   : u8 = 0x10;
    80. 

  80. pub const BPF_MUL   : u8 = 0x20;
    81. 

  81. pub const BPF_DIV   : u8 = 0x30;
    82. 

  82. pub const BPF_OR    : u8 = 0x40;
    83. 

  83. pub const BPF_AND   : u8 = 0x50;
    84. 

  84. pub const BPF_LSH   : u8 = 0x60;
    85. 

  85. pub const BPF_RSH   : u8 = 0x70;
    86. 

  86. pub const BPF_NEG   : u8 = 0x80;
    87. 

  87. pub const BPF_MOD   : u8 = 0x90;
    88. 

  88. pub const BPF_XOR   : u8 = 0xa0;
    89. 

  89. pub const BPF_MOV   : u8 = 0xb0; // mov reg to reg
    90. 

  90. pub const BPF_ARSH  : u8 = 0xc0; // sign extending shift right
    91. 

  91. pub const BPF_END   : u8 = 0xd0; // endianness conversion
    92. 

  92. 

  93. // Operation codes -- BPF_JMP class:
    94. 

  94. pub const BPF_JA    : u8 = 0x00;
    95. 

  95. pub const BPF_JEQ   : u8 = 0x10;
    96. 

  96. pub const BPF_JGT   : u8 = 0x20;
    97. 

  97. pub const BPF_JGE   : u8 = 0x30;
    98. 

  98. pub const BPF_JSET  : u8 = 0x40;
    99. 

  99. pub const BPF_JNE   : u8 = 0x50; // jump !=
    100. 

  100. pub const BPF_JSGT  : u8 = 0x60; // signed '>'
    101. 

  101. pub const BPF_JSGE  : u8 = 0x70; // signed '>='
    102. 

  102. pub const BPF_CALL  : u8 = 0x80; // function call
    103. 

  103. pub const BPF_EXIT  : u8 = 0x90; // function return
    104. 

  104. 

  105. // Op codes
    106. 

  106. // (Following operation names are not “official”, but may be proper to rbpf; Linux kernel only
    107. 

  107. // combines above flags and does not attribute a name per operation.)
    108. 

  108. 

  109. pub const LD_ABS_B   : u8 = BPF_LD    | BPF_ABS | BPF_B;
    110. 

  110. pub const LD_ABS_H   : u8 = BPF_LD    | BPF_ABS | BPF_H;
    111. 

  111. pub const LD_ABS_W   : u8 = BPF_LD    | BPF_ABS | BPF_W;
    112. 

  112. pub const LD_ABS_DW  : u8 = BPF_LD    | BPF_ABS | BPF_DW;
    113. 

  113. pub const LD_IND_B   : u8 = BPF_LD    | BPF_IND | BPF_B;
    114. 

  114. pub const LD_IND_H   : u8 = BPF_LD    | BPF_IND | BPF_H;
    115. 

  115. pub const LD_IND_W   : u8 = BPF_LD    | BPF_IND | BPF_W;
    116. 

  116. pub const LD_IND_DW  : u8 = BPF_LD    | BPF_IND | BPF_DW;
    117. 

  117. 

  118. pub const LD_DW_IMM  : u8 = BPF_LD    | BPF_IMM | BPF_DW;
    119. 

  119. pub const LD_B_REG   : u8 = BPF_LDX   | BPF_MEM | BPF_B;
    120. 

  120. pub const LD_H_REG   : u8 = BPF_LDX   | BPF_MEM | BPF_H;
    121. 

  121. pub const LD_W_REG   : u8 = BPF_LDX   | BPF_MEM | BPF_W;
    122. 

  122. pub const LD_DW_REG  : u8 = BPF_LDX   | BPF_MEM | BPF_DW;
    123. 

  123. pub const ST_B_IMM   : u8 = BPF_ST    | BPF_MEM | BPF_B;
    124. 

  124. pub const ST_H_IMM   : u8 = BPF_ST    | BPF_MEM | BPF_H;
    125. 

  125. pub const ST_W_IMM   : u8 = BPF_ST    | BPF_MEM | BPF_W;
    126. 

  126. pub const ST_DW_IMM  : u8 = BPF_ST    | BPF_MEM | BPF_DW;
    127. 

  127. pub const ST_B_REG   : u8 = BPF_STX   | BPF_MEM | BPF_B;
    128. 

  128. pub const ST_H_REG   : u8 = BPF_STX   | BPF_MEM | BPF_H;
    129. 

  129. pub const ST_W_REG   : u8 = BPF_STX   | BPF_MEM | BPF_W;
    130. 

  130. pub const ST_DW_REG  : u8 = BPF_STX   | BPF_MEM | BPF_DW;
    131. 

  131. 

  132. pub const ST_W_XADD  : u8 = BPF_STX   | BPF_XADD | BPF_W;
    133. 

  133. pub const ST_DW_XADD : u8 = BPF_STX   | BPF_XADD | BPF_DW;
    134. 

  134. 

  135. pub const ADD32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_ADD;
    136. 

  136. pub const ADD32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_ADD;
    137. 

  137. pub const SUB32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_SUB;
    138. 

  138. pub const SUB32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_SUB;
    139. 

  139. pub const MUL32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_MUL;
    140. 

  140. pub const MUL32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_MUL;
    141. 

  141. pub const DIV32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_DIV;
    142. 

  142. pub const DIV32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_DIV;
    143. 

  143. pub const OR32_IMM   : u8 = BPF_ALU   | BPF_K   | BPF_OR;
    144. 

  144. pub const OR32_REG   : u8 = BPF_ALU   | BPF_X   | BPF_OR;
    145. 

  145. pub const AND32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_AND;
    146. 

  146. pub const AND32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_AND;
    147. 

  147. pub const LSH32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_LSH;
    148. 

  148. pub const LSH32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_LSH;
    149. 

  149. pub const RSH32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_RSH;
    150. 

  150. pub const RSH32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_RSH;
    151. 

  151. pub const NEG32      : u8 = BPF_ALU   | BPF_NEG;
    152. 

  152. pub const MOD32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_MOD;
    153. 

  153. pub const MOD32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_MOD;
    154. 

  154. pub const XOR32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_XOR;
    155. 

  155. pub const XOR32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_XOR;
    156. 

  156. pub const MOV32_IMM  : u8 = BPF_ALU   | BPF_K   | BPF_MOV;
    157. 

  157. pub const MOV32_REG  : u8 = BPF_ALU   | BPF_X   | BPF_MOV;
    158. 

  158. pub const ARSH32_IMM : u8 = BPF_ALU   | BPF_K   | BPF_ARSH;
    159. 

  159. pub const ARSH32_REG : u8 = BPF_ALU   | BPF_X   | BPF_ARSH;
    160. 

  160. 

  161. pub const LE         : u8 = BPF_ALU   | BPF_K   | BPF_END;
    162. 

  162. pub const BE         : u8 = BPF_ALU   | BPF_X   | BPF_END;
    163. 

  163. 

  164. pub const ADD64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_ADD;
    165. 

  165. pub const ADD64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_ADD;
    166. 

  166. pub const SUB64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_SUB;
    167. 

  167. pub const SUB64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_SUB;
    168. 

  168. pub const MUL64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_MUL;
    169. 

  169. pub const MUL64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_MUL;
    170. 

  170. pub const DIV64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_DIV;
    171. 

  171. pub const DIV64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_DIV;
    172. 

  172. pub const OR64_IMM   : u8 = BPF_ALU64 | BPF_K   | BPF_OR;
    173. 

  173. pub const OR64_REG   : u8 = BPF_ALU64 | BPF_X   | BPF_OR;
    174. 

  174. pub const AND64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_AND;
    175. 

  175. pub const AND64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_AND;
    176. 

  176. pub const LSH64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_LSH;
    177. 

  177. pub const LSH64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_LSH;
    178. 

  178. pub const RSH64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_RSH;
    179. 

  179. pub const RSH64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_RSH;
    180. 

  180. pub const NEG64      : u8 = BPF_ALU64 | BPF_NEG;
    181. 

  181. pub const MOD64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_MOD;
    182. 

  182. pub const MOD64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_MOD;
    183. 

  183. pub const XOR64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_XOR;
    184. 

  184. pub const XOR64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_XOR;
    185. 

  185. pub const MOV64_IMM  : u8 = BPF_ALU64 | BPF_K   | BPF_MOV;
    186. 

  186. pub const MOV64_REG  : u8 = BPF_ALU64 | BPF_X   | BPF_MOV;
    187. 

  187. pub const ARSH64_IMM : u8 = BPF_ALU64 | BPF_K   | BPF_ARSH;
    188. 

  188. pub const ARSH64_REG : u8 = BPF_ALU64 | BPF_X   | BPF_ARSH;
    189. 

  189. 

  190. pub const JA         : u8 = BPF_JMP   | BPF_JA;
    191. 

  191. pub const JEQ_IMM    : u8 = BPF_JMP   | BPF_K   | BPF_JEQ;
    192. 

  192. pub const JEQ_REG    : u8 = BPF_JMP   | BPF_X   | BPF_JEQ;
    193. 

  193. pub const JGT_IMM    : u8 = BPF_JMP   | BPF_K   | BPF_JGT;
    194. 

  194. pub const JGT_REG    : u8 = BPF_JMP   | BPF_X   | BPF_JGT;
    195. 

  195. pub const JGE_IMM    : u8 = BPF_JMP   | BPF_K   | BPF_JGE;
    196. 

  196. pub const JGE_REG    : u8 = BPF_JMP   | BPF_X   | BPF_JGE;
    197. 

  197. pub const JSET_IMM   : u8 = BPF_JMP   | BPF_K   | BPF_JSET;
    198. 

  198. pub const JSET_REG   : u8 = BPF_JMP   | BPF_X   | BPF_JSET;
    199. 

  199. pub const JNE_IMM    : u8 = BPF_JMP   | BPF_K   | BPF_JNE;
    200. 

  200. pub const JNE_REG    : u8 = BPF_JMP   | BPF_X   | BPF_JNE;
    201. 

  201. pub const JSGT_IMM   : u8 = BPF_JMP   | BPF_K   | BPF_JSGT;
    202. 

  202. pub const JSGT_REG   : u8 = BPF_JMP   | BPF_X   | BPF_JSGT;
    203. 

  203. pub const JSGE_IMM   : u8 = BPF_JMP   | BPF_K   | BPF_JSGE;
    204. 

  204. pub const JSGE_REG   : u8 = BPF_JMP   | BPF_X   | BPF_JSGE;
    205. 

  205. 

  206. pub const CALL       : u8 = BPF_JMP   | BPF_CALL;
    207. 

  207. pub const TAIL_CALL  : u8 = BPF_JMP   | BPF_X | BPF_CALL;
    208. 

  208. pub const EXIT       : u8 = BPF_JMP   | BPF_EXIT;
    209. 

  209. 

  210. // Used in JIT
    211. 

  211. pub const BPF_CLS_MASK    : u8 = 0x07;
    212. 

  212. pub const BPF_ALU_OP_MASK : u8 = 0xf0;
    213. 

  213. 

  214. /// An eBPF instruction. See <https://www.kernel.org/doc/Documentation/networking/filter.txt> for
    215. 

  215. /// the Linux kernel documentation about eBPF, or
    216. 

  216. /// <https://github.com/iovisor/bpf-docs/blob/master/eBPF.md> for a more concise version.
    217. 

  217. #[derive(Debug)]
    218. 

  218. pub struct Insn {
    219. 

  219.     /// Operation code.
    220. 

  220.     pub opc: u8,
    221. 

  221.     /// Destination register operand.
    222. 

  222.     pub dst: u8,
    223. 

  223.     /// Source register operand.
    224. 

  224.     pub src: u8,
    225. 

  225.     /// Offset operand.
    226. 

  226.     pub off: i16,
    227. 

  227.     /// Immediate value operand.
    228. 

  228.     pub imm: i32,
    229. 

  229. }
    230. 

  230. 

  231. /// Get the instruction at `idx` of an eBPF program. `idx` is the index (number) of the
    232. 

  232. /// instruction (not a byte offset). The first instruction has index 0.
    233. 

  233. ///
    234. 

  234. /// # Examples
    235. 

  235. ///
    236. 

  236. /// ```
    237. 

  237. /// use rbpf::ebpf;
    238. 

  238. ///
    239. 

  239. /// let prog = vec![
    240. 

  240. ///     0xb7, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    241. 

  241. ///     0x95, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    242. 

  242. ///     ];
    243. 

  243. /// let insn = ebpf::get_insn(&prog, 1);
    244. 

  244. /// assert_eq!(insn.opc, 0x95);
    245. 

  245. /// ```
    246. 

  246. pub fn get_insn(prog: &std::vec::Vec<u8>, idx: usize) -> Insn {
    247. 

  247.     // TODO panic if size problem? Should have been checked by verifier, though.
    248. 

  248.     // Update: this function is publicly available and user can call it with any idx, so we should
    249. 

  249.     // definitely add a guard here.
    250. 

  250.     let insn = Insn {
    251. 

  251.         opc:  prog[INSN_SIZE * idx],
    252. 

  252.         dst:  prog[INSN_SIZE * idx + 1] & 0x0f,
    253. 

  253.         src: (prog[INSN_SIZE * idx + 1] & 0xf0) >> 4,
    254. 

  254.         off: unsafe {
    255. 

  255.             let x = prog.as_ptr().offset((INSN_SIZE * idx + 2) as isize) as *const i16; *x
    256. 

  256.         },
    257. 

  257.         imm: unsafe {
    258. 

  258.             let x = prog.as_ptr().offset((INSN_SIZE * idx + 4) as isize) as *const i32; *x
    259. 

  259.         },
    260. 

  260.     };
    261. 

  261.     insn
    262. 

  262. }
    263.