1. 21 3月, 2013 1 次提交
    • D
      filter: add minimal BPF JIT image disassembler · e306e2c1
      Daniel Borkmann 提交于
      This is a minimal stand-alone user space helper, that allows for debugging or
      verification of emitted BPF JIT images. This is in particular useful for
      emitted opcode debugging, since minor bugs in the JIT compiler can be fatal.
      The disassembler is architecture generic and uses libopcodes and libbfd.
      
      How to get to the disassembly, example:
      
        1) `echo 2 > /proc/sys/net/core/bpf_jit_enable`
        2) Load a BPF filter (e.g. `tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24`)
        3) Run e.g. `bpf_jit_disasm -o` to disassemble the most recent JIT code output
      
      `bpf_jit_disasm -o` will display the related opcodes to a particular instruction
      as well. Example for x86_64:
      
      $ ./bpf_jit_disasm
      94 bytes emitted from JIT compiler (pass:3, flen:9)
      ffffffffa0356000 + <x>:
         0:	push   %rbp
         1:	mov    %rsp,%rbp
         4:	sub    $0x60,%rsp
         8:	mov    %rbx,-0x8(%rbp)
         c:	mov    0x68(%rdi),%r9d
        10:	sub    0x6c(%rdi),%r9d
        14:	mov    0xe0(%rdi),%r8
        1b:	mov    $0xc,%esi
        20:	callq  0xffffffffe0d01b71
        25:	cmp    $0x86dd,%eax
        2a:	jne    0x000000000000003d
        2c:	mov    $0x14,%esi
        31:	callq  0xffffffffe0d01b8d
        36:	cmp    $0x6,%eax
      [...]
        5c:	leaveq
        5d:	retq
      
      $ ./bpf_jit_disasm -o
      94 bytes emitted from JIT compiler (pass:3, flen:9)
      ffffffffa0356000 + <x>:
         0:	push   %rbp
      	55
         1:	mov    %rsp,%rbp
      	48 89 e5
         4:	sub    $0x60,%rsp
      	48 83 ec 60
         8:	mov    %rbx,-0x8(%rbp)
      	48 89 5d f8
         c:	mov    0x68(%rdi),%r9d
      	44 8b 4f 68
        10:	sub    0x6c(%rdi),%r9d
      	44 2b 4f 6c
      [...]
        5c:	leaveq
      	c9
        5d:	retq
      	c3
      Signed-off-by: NDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e306e2c1
  2. 30 1月, 2013 1 次提交
  3. 08 1月, 2013 1 次提交
  4. 20 11月, 2012 1 次提交
  5. 15 11月, 2012 1 次提交
  6. 12 4月, 2012 3 次提交