2014-05-09 05:10:52 +08:00
|
|
|
/*
|
|
|
|
|
* Testsuite for BPF interpreter and BPF JIT compiler
|
|
|
|
|
*
|
|
|
|
|
* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
|
|
|
* License as published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful, but
|
|
|
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* General Public License for more details.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
|
#include <linux/filter.h>
|
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
|
#include <linux/if_vlan.h>
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
/* General test specific settings */
|
2014-05-09 05:10:52 +08:00
|
|
|
#define MAX_SUBTESTS 3
|
2014-05-24 00:44:00 +08:00
|
|
|
#define MAX_TESTRUNS 10000
|
2014-05-09 05:10:52 +08:00
|
|
|
#define MAX_DATA 128
|
|
|
|
|
#define MAX_INSNS 512
|
|
|
|
|
#define MAX_K 0xffffFFFF
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
/* Few constants used to init test 'skb' */
|
2014-05-09 05:10:52 +08:00
|
|
|
#define SKB_TYPE 3
|
|
|
|
|
#define SKB_MARK 0x1234aaaa
|
|
|
|
|
#define SKB_HASH 0x1234aaab
|
|
|
|
|
#define SKB_QUEUE_MAP 123
|
|
|
|
|
#define SKB_VLAN_TCI 0xffff
|
|
|
|
|
#define SKB_DEV_IFINDEX 577
|
|
|
|
|
#define SKB_DEV_TYPE 588
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
/* Redefine REGs to make tests less verbose */
|
|
|
|
|
#define R0 BPF_REG_0
|
|
|
|
|
#define R1 BPF_REG_1
|
|
|
|
|
#define R2 BPF_REG_2
|
|
|
|
|
#define R3 BPF_REG_3
|
|
|
|
|
#define R4 BPF_REG_4
|
|
|
|
|
#define R5 BPF_REG_5
|
|
|
|
|
#define R6 BPF_REG_6
|
|
|
|
|
#define R7 BPF_REG_7
|
|
|
|
|
#define R8 BPF_REG_8
|
|
|
|
|
#define R9 BPF_REG_9
|
|
|
|
|
#define R10 BPF_REG_10
|
|
|
|
|
|
|
|
|
|
/* Flags that can be passed to test cases */
|
|
|
|
|
#define FLAG_NO_DATA BIT(0)
|
|
|
|
|
#define FLAG_EXPECTED_FAIL BIT(1)
|
|
|
|
|
|
|
|
|
|
enum {
|
|
|
|
|
CLASSIC = BIT(6), /* Old BPF instructions only. */
|
|
|
|
|
INTERNAL = BIT(7), /* Extended instruction set. */
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define TEST_TYPE_MASK (CLASSIC | INTERNAL)
|
2014-05-09 05:10:52 +08:00
|
|
|
|
|
|
|
|
struct bpf_test {
|
|
|
|
|
const char *descr;
|
|
|
|
|
union {
|
|
|
|
|
struct sock_filter insns[MAX_INSNS];
|
2014-07-25 07:38:21 +08:00
|
|
|
struct bpf_insn insns_int[MAX_INSNS];
|
2014-05-23 01:16:46 +08:00
|
|
|
} u;
|
2014-05-24 00:44:00 +08:00
|
|
|
__u8 aux;
|
2014-05-09 05:10:52 +08:00
|
|
|
__u8 data[MAX_DATA];
|
|
|
|
|
struct {
|
|
|
|
|
int data_size;
|
|
|
|
|
__u32 result;
|
|
|
|
|
} test[MAX_SUBTESTS];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct bpf_test tests[] = {
|
|
|
|
|
{
|
|
|
|
|
"TAX",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:52 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_NEG, 0), /* A == -3 */
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0), /* X == len - 3 */
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_IND, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:52 +08:00
|
|
|
{ 10, 20, 30, 40, 50 },
|
|
|
|
|
{ { 2, 10 }, { 3, 20 }, { 4, 30 } },
|
|
|
|
|
},
|
2014-05-09 05:10:53 +08:00
|
|
|
{
|
|
|
|
|
"TXA",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0) /* A == len * 2 */
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 10, 20, 30, 40, 50 },
|
|
|
|
|
{ { 1, 2 }, { 3, 6 }, { 4, 8 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"ADD_SUB_MUL_K",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 2),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 3),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_SUB | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0xffffffff),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_MUL | BPF_K, 3),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 0xfffffffd } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"DIV_KX",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 8),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_DIV | BPF_K, 2),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 0xffffffff),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_DIV | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 0xffffffff),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_DIV | BPF_K, 0x70000000),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 0x40000001 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"AND_OR_LSH_K",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 0xff),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xf0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 27),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 0xf),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_OR | BPF_K, 0xf0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 0x800000ff }, { 1, 0x800000ff } },
|
|
|
|
|
},
|
net: filter: fix length calculation in BPF testsuite
The current probe_filter_length() (the function that calculates the
length of a test BPF filter) behavior is to declare the end of the
filter as soon as it finds {0, *, *, 0}. This is actually a valid
insn ("ld #0"), so any filter with includes "BPF_STMT(BPF_LD | BPF_IMM, 0)"
fails (its length is cut short).
We are changing probe_filter_length() so as to start from the end, and
declare the end of the filter as the first instruction which is not
{0, *, *, 0}. This solution produces a simpler patch than the
alternative of using an explicit end-of-filter mark. It is technically
incorrect if your filter ends up with "ld #0", but that should not
happen anyway.
We also add a new test (LD_IMM_0) that includes ld #0 (does not work
without this patch).
Signed-off-by: Chema Gonzalez <chema@google.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-05-31 01:15:12 +08:00
|
|
|
{
|
|
|
|
|
"LD_IMM_0",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 0), /* ld #0 */
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 1, 1 } },
|
|
|
|
|
},
|
2014-05-09 05:10:53 +08:00
|
|
|
{
|
|
|
|
|
"LD_IND",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_IND, MAX_K),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, 0 }, { 10, 0 }, { 60, 0 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_ABS",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 1000),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, 0 }, { 10, 0 }, { 60, 0 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_ABS_LL",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, SKF_LL_OFF),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, SKF_LL_OFF + 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 1, 2, 3 },
|
|
|
|
|
{ { 1, 0 }, { 2, 3 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_IND_LL",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, SKF_LL_OFF - 1),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 1, 2, 3, 0xff },
|
|
|
|
|
{ { 1, 1 }, { 3, 3 }, { 4, 0xff } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_ABS_NET",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, SKF_NET_OFF),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, SKF_NET_OFF + 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 3 },
|
|
|
|
|
{ { 15, 0 }, { 16, 3 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_IND_NET",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, SKF_NET_OFF - 15),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 3 },
|
|
|
|
|
{ { 14, 0 }, { 15, 1 }, { 17, 3 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_PKTTYPE",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PKTTYPE),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SKB_TYPE, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PKTTYPE),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SKB_TYPE, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PKTTYPE),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SKB_TYPE, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, 3 }, { 10, 3 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_MARK",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_MARK),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, SKB_MARK}, { 10, SKB_MARK} },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_RXHASH",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_RXHASH),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, SKB_HASH}, { 10, SKB_HASH} },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_QUEUE",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_QUEUE),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, SKB_QUEUE_MAP }, { 10, SKB_QUEUE_MAP } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_PROTOCOL",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 1),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 20, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PROTOCOL),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 30, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 10, 20, 30 },
|
|
|
|
|
{ { 10, ETH_P_IP }, { 100, ETH_P_IP } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_VLAN_TAG",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_VLAN_TAG),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{
|
|
|
|
|
{ 1, SKB_VLAN_TCI & ~VLAN_TAG_PRESENT },
|
|
|
|
|
{ 10, SKB_VLAN_TCI & ~VLAN_TAG_PRESENT }
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_VLAN_TAG_PRESENT",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{
|
|
|
|
|
{ 1, !!(SKB_VLAN_TCI & VLAN_TAG_PRESENT) },
|
|
|
|
|
{ 10, !!(SKB_VLAN_TCI & VLAN_TAG_PRESENT) }
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_IFINDEX",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_IFINDEX),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, SKB_DEV_IFINDEX }, { 10, SKB_DEV_IFINDEX } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_HATYPE",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_HATYPE),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, SKB_DEV_TYPE }, { 10, SKB_DEV_TYPE } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_CPU",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_CPU),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_CPU),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_SUB | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, 0 }, { 10, 0 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_NLATTR",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 3),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-06-07 08:48:20 +08:00
|
|
|
#ifdef __BIG_ENDIAN
|
|
|
|
|
{ 0xff, 0xff, 0, 4, 0, 2, 0, 4, 0, 3 },
|
|
|
|
|
#else
|
|
|
|
|
{ 0xff, 0xff, 4, 0, 2, 0, 4, 0, 3, 0 },
|
|
|
|
|
#endif
|
|
|
|
|
{ { 4, 0 }, { 20, 6 } },
|
2014-05-09 05:10:53 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_NLATTR_NEST",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 3),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
2014-06-07 08:48:20 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_NLATTR_NEST),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-06-07 08:48:20 +08:00
|
|
|
#ifdef __BIG_ENDIAN
|
|
|
|
|
{ 0xff, 0xff, 0, 12, 0, 1, 0, 4, 0, 2, 0, 4, 0, 3 },
|
|
|
|
|
#else
|
|
|
|
|
{ 0xff, 0xff, 12, 0, 1, 0, 4, 0, 2, 0, 4, 0, 3, 0 },
|
|
|
|
|
#endif
|
|
|
|
|
{ { 4, 0 }, { 20, 10 } },
|
2014-05-09 05:10:53 +08:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_PAYLOAD_OFF",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PAY_OFFSET),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PAY_OFFSET),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PAY_OFFSET),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PAY_OFFSET),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_PAY_OFFSET),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
/* 00:00:00:00:00:00 > 00:00:00:00:00:00, ethtype IPv4 (0x0800),
|
|
|
|
|
* length 98: 127.0.0.1 > 127.0.0.1: ICMP echo request,
|
|
|
|
|
* id 9737, seq 1, length 64
|
|
|
|
|
*/
|
|
|
|
|
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
|
|
|
0x08, 0x00,
|
|
|
|
|
0x45, 0x00, 0x00, 0x54, 0xac, 0x8b, 0x40, 0x00, 0x40,
|
|
|
|
|
0x01, 0x90, 0x1b, 0x7f, 0x00, 0x00, 0x01 },
|
|
|
|
|
{ { 30, 0 }, { 100, 42 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"LD_ANC_XOR",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 10),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 300),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_ALU_XOR_X),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 4, 10 ^ 300 }, { 20, 10 ^ 300 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"SPILL_FILL",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 2),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_RSH, 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_XOR | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_ST, 1), /* M1 = 1 ^ len */
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_XOR | BPF_K, 0x80000000),
|
|
|
|
|
BPF_STMT(BPF_ST, 2), /* M2 = 1 ^ len ^ 0x80000000 */
|
|
|
|
|
BPF_STMT(BPF_STX, 15), /* M3 = len */
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 1),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_MEM, 2),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_XOR | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 15),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_XOR | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 1, 0x80000001 }, { 2, 0x80000002 }, { 60, 0x80000000 ^ 60 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"JEQ",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, 0, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, MAX_K)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 3, 3, 3, 3, 3 },
|
|
|
|
|
{ { 1, 0 }, { 3, 1 }, { 4, MAX_K } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"JGT",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGT | BPF_X, 0, 0, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, MAX_K)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 4, 4, 4, 3, 3 },
|
|
|
|
|
{ { 2, 0 }, { 3, 1 }, { 4, MAX_K } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"JGE",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_IND, MAX_K),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, 1, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 10),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, 2, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 20),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, 3, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, 4, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 40),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, MAX_K)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 1, 2, 3, 4, 5 },
|
|
|
|
|
{ { 1, 20 }, { 3, 40 }, { 5, MAX_K } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"JSET",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_JUMP(BPF_JMP | BPF_JA, 0, 0, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JA, 1, 1, 1),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JA, 0, 0, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JA, 0, 0, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_LEN, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_SUB | BPF_K, 4),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_IND, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 1, 0, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 10),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0x80000000, 0, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 20),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0xffffff, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0xffffff, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0xffffff, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0xffffff, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0xffffff, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 30),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, MAX_K)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 0, 0xAA, 0x55, 1 },
|
|
|
|
|
{ { 4, 10 }, { 5, 20 }, { 6, MAX_K } },
|
|
|
|
|
},
|
2014-05-09 05:10:52 +08:00
|
|
|
{
|
|
|
|
|
"tcpdump port 22",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-27 02:17:35 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 12),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x86dd, 0, 8), /* IPv6 */
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 20),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x84, 2, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x6, 1, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x11, 0, 17),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 54),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 14, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 56),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 12, 13),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0800, 0, 12), /* IPv4 */
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 23),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x84, 2, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x6, 1, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x11, 0, 8),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 20),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0x1fff, 6, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 14),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_IND, 14),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 2, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_IND, 16),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 0, 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0xffff),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0),
|
2014-05-09 05:10:52 +08:00
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:52 +08:00
|
|
|
/* 3c:07:54:43:e5:76 > 10:bf:48:d6:43:d6, ethertype IPv4(0x0800)
|
|
|
|
|
* length 114: 10.1.1.149.49700 > 10.1.2.10.22: Flags [P.],
|
|
|
|
|
* seq 1305692979:1305693027, ack 3650467037, win 65535,
|
|
|
|
|
* options [nop,nop,TS val 2502645400 ecr 3971138], length 48
|
|
|
|
|
*/
|
|
|
|
|
{ 0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
|
|
|
|
|
0x3c, 0x07, 0x54, 0x43, 0xe5, 0x76,
|
|
|
|
|
0x08, 0x00,
|
|
|
|
|
0x45, 0x10, 0x00, 0x64, 0x75, 0xb5,
|
|
|
|
|
0x40, 0x00, 0x40, 0x06, 0xad, 0x2e, /* IP header */
|
|
|
|
|
0x0a, 0x01, 0x01, 0x95, /* ip src */
|
|
|
|
|
0x0a, 0x01, 0x02, 0x0a, /* ip dst */
|
|
|
|
|
0xc2, 0x24,
|
|
|
|
|
0x00, 0x16 /* dst port */ },
|
|
|
|
|
{ { 10, 0 }, { 30, 0 }, { 100, 65535 } },
|
|
|
|
|
},
|
2014-05-09 05:10:53 +08:00
|
|
|
{
|
|
|
|
|
"tcpdump complex",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
/* tcpdump -nei eth0 'tcp port 22 and (((ip[2:2] -
|
|
|
|
|
* ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) and
|
|
|
|
|
* (len > 115 or len < 30000000000)' -d
|
|
|
|
|
*/
|
2014-05-27 02:17:35 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 12),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x86dd, 30, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x800, 0, 29),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 23),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x6, 0, 27),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 20),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, 0x1fff, 25, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 14),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_IND, 14),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 2, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_IND, 16),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 22, 0, 20),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 16),
|
|
|
|
|
BPF_STMT(BPF_ST, 1),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 14),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xf),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 2),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0x5), /* libpcap emits K on TAX */
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_MEM, 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_SUB | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_ST, 5),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 14),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_B | BPF_IND, 26),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xf0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 2),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0x9), /* libpcap emits K on TAX */
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_MEM, 5),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, 4, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_LEN, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, 0x73, 1, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, 0xfc23ac00, 1, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0xffff),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0),
|
2014-05-09 05:10:53 +08:00
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
|
|
|
|
|
0x3c, 0x07, 0x54, 0x43, 0xe5, 0x76,
|
|
|
|
|
0x08, 0x00,
|
|
|
|
|
0x45, 0x10, 0x00, 0x64, 0x75, 0xb5,
|
|
|
|
|
0x40, 0x00, 0x40, 0x06, 0xad, 0x2e, /* IP header */
|
|
|
|
|
0x0a, 0x01, 0x01, 0x95, /* ip src */
|
|
|
|
|
0x0a, 0x01, 0x02, 0x0a, /* ip dst */
|
|
|
|
|
0xc2, 0x24,
|
|
|
|
|
0x00, 0x16 /* dst port */ },
|
|
|
|
|
{ { 10, 0 }, { 30, 0 }, { 100, 65535 } },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"RET_A",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
/* check that unitialized X and A contain zeros */
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC,
|
|
|
|
|
{ },
|
2014-05-09 05:10:53 +08:00
|
|
|
{ {1, 0}, {2, 0} },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: ADD trivial",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R1, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R1, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MUL, R1, 3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MOV, R0, R1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 0xfffffffd } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: MUL_X",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R2),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 0xfffffffd, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 1 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: MUL_X2",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU32_IMM(BPF_MOV, R0, -1),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R1, -1),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R2, 3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R1, 8),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 0x2ffffff, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 1 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: MUL32_X",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU32_IMM(BPF_MOV, R0, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, -1),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R2, 3),
|
|
|
|
|
BPF_ALU32_REG(BPF_MUL, R1, R2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R1, 8),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 0xffffff, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 1 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
/* Have to test all register combinations, since
|
|
|
|
|
* JITing of different registers will produce
|
|
|
|
|
* different asm code.
|
|
|
|
|
*/
|
|
|
|
|
"INT: ADD 64-bit",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 0),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R3, 3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R4, 4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R5, 5),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R6, 6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R7, 7),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R8, 8),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R9, 9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R0, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R1, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R2, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R3, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R4, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R5, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R6, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R7, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R8, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R9, 20),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R0, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R1, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R2, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R3, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R4, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R5, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R6, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R7, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R8, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R9, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R0, R9), /* R0 == 155 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 155, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R1, R9), /* R1 == 456 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 456, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R2, R9), /* R2 == 1358 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R2, 1358, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R3, R9), /* R3 == 4063 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R3, 4063, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R4, R9), /* R4 == 12177 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R4, 12177, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R5, R9), /* R5 == 36518 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R5, 36518, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R6, R9), /* R6 == 109540 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R6, 109540, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R7, R9), /* R7 == 328605 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R7, 328605, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R9), /* R8 == 985799 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R8, 985799, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R9, R9), /* R9 == 2957380 */
|
|
|
|
|
BPF_ALU64_REG(BPF_MOV, R0, R9),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 2957380 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: ADD 32-bit",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU32_IMM(BPF_MOV, R0, 20),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R3, 3),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R4, 4),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R5, 5),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R6, 6),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R7, 7),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R8, 8),
|
|
|
|
|
BPF_ALU32_IMM(BPF_MOV, R9, 9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R1, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R2, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R3, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R4, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R5, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R6, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R7, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R8, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R9, 10),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R0, R9), /* R0 == 155 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 155, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R1, R9), /* R1 == 456 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 456, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R2, R9), /* R2 == 1358 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R2, 1358, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R3, R9), /* R3 == 4063 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R3, 4063, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R4, R9), /* R4 == 12177 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R4, 12177, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R5, R9), /* R5 == 36518 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R5, 36518, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R6, R9), /* R6 == 109540 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R6, 109540, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R7, R9), /* R7 == 328605 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R7, 328605, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R8, R9), /* R8 == 985799 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R8, 985799, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R0),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R1),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R2),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R3),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R4),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R5),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R6),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R7),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R8),
|
|
|
|
|
BPF_ALU32_REG(BPF_ADD, R9, R9), /* R9 == 2957380 */
|
|
|
|
|
BPF_ALU32_REG(BPF_MOV, R0, R9),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 2957380 } }
|
|
|
|
|
},
|
|
|
|
|
{ /* Mainly checking JIT here. */
|
|
|
|
|
"INT: SUB",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 0),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R3, 3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R4, 4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R5, 5),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R6, 6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R7, 7),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R8, 8),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R9, 9),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R0, 10),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, -55, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R1, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R2, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R3, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R4, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R5, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R6, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R7, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R8, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R8),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R9, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, R0, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_NEG, R0, 0),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R9),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 11 } }
|
|
|
|
|
},
|
|
|
|
|
{ /* Mainly checking JIT here. */
|
|
|
|
|
"INT: XOR",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_REG(BPF_SUB, R0, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R1, R1),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R0, R1, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, -1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R2, R2),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R1, R2, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R2, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R3, R3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, -1),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R2, R3, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R3, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R4, R4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R5, -1),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R3, R4, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R4, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R5, R5),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R3, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R7, -1),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R5, R4, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R5, 1),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R5, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R6, R6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R8, -1),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R5, R6, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R6, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R7, R7),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R7, R6, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R7, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R8, R8),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R7, R8, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R8, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R9, R9),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R9, R8, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R9, R9),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R0, R0),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R9, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, R1, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_XOR, R0, R0),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R9, R0, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 1 } }
|
|
|
|
|
},
|
|
|
|
|
{ /* Mainly checking JIT here. */
|
|
|
|
|
"INT: MUL",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 11),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R1, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R3, 3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R4, 4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R5, 5),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R6, 6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R7, 7),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R8, 8),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R9, 9),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R0, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MUL, R0, 10),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 439084800, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R1, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MUL, R1, 10),
|
|
|
|
|
BPF_ALU64_REG(BPF_MOV, R2, R1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R2, 32),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R2, 0x5a924, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, R1, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ARSH, R1, 32),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R1, 0xebb90000, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R0),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R1),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R3),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R4),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R5),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R6),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R7),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R8),
|
|
|
|
|
BPF_ALU64_REG(BPF_MUL, R2, R9),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MUL, R2, 10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R2, 32),
|
|
|
|
|
BPF_ALU64_REG(BPF_MOV, R0, R2),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, 0x35d97ef2 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: ALU MIX",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 11),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, R0, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_XOR, R2, 3),
|
|
|
|
|
BPF_ALU64_REG(BPF_DIV, R0, R2),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 10, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOD, R0, 3),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 1, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, -1),
|
2014-08-26 03:27:02 +08:00
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
INTERNAL,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 0, -1 } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"INT: shifts by register",
|
|
|
|
|
.u.insns_int = {
|
|
|
|
|
BPF_MOV64_IMM(R0, -1234),
|
|
|
|
|
BPF_MOV64_IMM(R1, 1),
|
|
|
|
|
BPF_ALU32_REG(BPF_RSH, R0, R1),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, 0x7ffffd97, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(R2, 1),
|
|
|
|
|
BPF_ALU64_REG(BPF_LSH, R0, R2),
|
|
|
|
|
BPF_MOV32_IMM(R4, -1234),
|
|
|
|
|
BPF_JMP_REG(BPF_JEQ, R0, R4, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_AND, R4, 63),
|
|
|
|
|
BPF_ALU64_REG(BPF_LSH, R0, R4), /* R0 <= 46 */
|
|
|
|
|
BPF_MOV64_IMM(R3, 47),
|
|
|
|
|
BPF_ALU64_REG(BPF_ARSH, R0, R3),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R0, -617, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(R2, 1),
|
|
|
|
|
BPF_ALU64_REG(BPF_LSH, R4, R2), /* R4 = 46 << 1 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R4, 92, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(R4, 4),
|
|
|
|
|
BPF_ALU64_REG(BPF_LSH, R4, R4), /* R4 = 4 << 4 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R4, 64, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(R4, 5),
|
|
|
|
|
BPF_ALU32_REG(BPF_LSH, R4, R4), /* R4 = 5 << 5 */
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R4, 160, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(R0, -1),
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ { 0, -1 } }
|
|
|
|
|
},
|
2014-05-09 05:10:52 +08:00
|
|
|
{
|
|
|
|
|
"INT: DIV + ABS",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:52 +08:00
|
|
|
BPF_ALU64_REG(BPF_MOV, R6, R1),
|
|
|
|
|
BPF_LD_ABS(BPF_B, 3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R2, 2),
|
|
|
|
|
BPF_ALU32_REG(BPF_DIV, R0, R2),
|
|
|
|
|
BPF_ALU64_REG(BPF_MOV, R8, R0),
|
|
|
|
|
BPF_LD_ABS(BPF_B, 4),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, R8, R0),
|
|
|
|
|
BPF_LD_IND(BPF_B, R8, -70),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:52 +08:00
|
|
|
{ 10, 20, 30, 40, 50 },
|
|
|
|
|
{ { 4, 0 }, { 5, 10 } }
|
|
|
|
|
},
|
2014-05-09 05:10:53 +08:00
|
|
|
{
|
|
|
|
|
"INT: DIV by zero",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns_int = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_ALU64_REG(BPF_MOV, R6, R1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R7, 0),
|
|
|
|
|
BPF_LD_ABS(BPF_B, 3),
|
|
|
|
|
BPF_ALU32_REG(BPF_DIV, R0, R7),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
INTERNAL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ 10, 20, 30, 40, 50 },
|
|
|
|
|
{ { 3, 0 }, { 4, 0 } }
|
|
|
|
|
},
|
2014-05-09 05:10:52 +08:00
|
|
|
{
|
|
|
|
|
"check: missing ret",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:52 +08:00
|
|
|
BPF_STMT(BPF_LD | BPF_IMM, 1),
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
2014-05-09 05:10:52 +08:00
|
|
|
{ },
|
|
|
|
|
{ }
|
|
|
|
|
},
|
2014-05-09 05:10:53 +08:00
|
|
|
{
|
|
|
|
|
"check: div_k_0",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_ALU | BPF_DIV | BPF_K, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"check: unknown insn",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
/* seccomp insn, rejected in socket filter */
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_W | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_EXPECTED_FAIL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"check: out of range spill/fill",
|
2014-05-23 01:16:46 +08:00
|
|
|
.u.insns = {
|
2014-05-09 05:10:53 +08:00
|
|
|
BPF_STMT(BPF_STX, 16),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 0)
|
|
|
|
|
},
|
2014-05-24 00:44:00 +08:00
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
2014-05-09 05:10:53 +08:00
|
|
|
{ },
|
|
|
|
|
{ }
|
|
|
|
|
},
|
2014-05-24 00:44:01 +08:00
|
|
|
{
|
|
|
|
|
"JUMPS + HOLES",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE, 0, 13, 15),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x90c2894d, 3, 4),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x90c2894d, 1, 2),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE, 0, 14, 15),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE, 0, 13, 14),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x2ac28349, 2, 3),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x2ac28349, 1, 2),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE, 0, 14, 15),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JGE, 0, 13, 14),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x90d2ff41, 2, 3),
|
|
|
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ, 0x90d2ff41, 1, 2),
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC,
|
2014-05-27 02:17:35 +08:00
|
|
|
{ 0x00, 0x1b, 0x21, 0x3c, 0x9d, 0xf8,
|
|
|
|
|
0x90, 0xe2, 0xba, 0x0a, 0x56, 0xb4,
|
|
|
|
|
0x08, 0x00,
|
|
|
|
|
0x45, 0x00, 0x00, 0x28, 0x00, 0x00,
|
|
|
|
|
0x20, 0x00, 0x40, 0x11, 0x00, 0x00, /* IP header */
|
|
|
|
|
0xc0, 0xa8, 0x33, 0x01,
|
|
|
|
|
0xc0, 0xa8, 0x33, 0x02,
|
|
|
|
|
0xbb, 0xb6,
|
|
|
|
|
0xa9, 0xfa,
|
|
|
|
|
0x00, 0x14, 0x00, 0x00,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc,
|
|
|
|
|
0xcc, 0xcc, 0xcc, 0xcc },
|
2014-05-24 00:44:01 +08:00
|
|
|
{ { 88, 0x001b } }
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"check: RET X",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_X, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
|
|
|
|
{ },
|
|
|
|
|
{ },
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"check: LDX + RET X",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 42),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_X, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
|
|
|
|
{ },
|
|
|
|
|
{ },
|
|
|
|
|
},
|
2014-05-27 02:17:34 +08:00
|
|
|
{ /* Mainly checking JIT here. */
|
2014-05-29 16:22:48 +08:00
|
|
|
"M[]: alt STX + LDX",
|
2014-05-27 02:17:34 +08:00
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 100),
|
|
|
|
|
BPF_STMT(BPF_STX, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 1),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 2),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 2),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 3),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 3),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 4),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 4),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 5),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 5),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 6),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 6),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 7),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 7),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 8),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 8),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 9),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 9),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 10),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 10),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 11),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 11),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 12),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 12),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 13),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 13),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 14),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 14),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_STX, 15),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 15),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 1),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TAX, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC | FLAG_NO_DATA,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 0, 116 } },
|
|
|
|
|
},
|
2014-05-29 16:22:48 +08:00
|
|
|
{ /* Mainly checking JIT here. */
|
|
|
|
|
"M[]: full STX + full LDX",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xbadfeedb),
|
|
|
|
|
BPF_STMT(BPF_STX, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xecabedae),
|
|
|
|
|
BPF_STMT(BPF_STX, 1),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xafccfeaf),
|
|
|
|
|
BPF_STMT(BPF_STX, 2),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xbffdcedc),
|
|
|
|
|
BPF_STMT(BPF_STX, 3),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xfbbbdccb),
|
|
|
|
|
BPF_STMT(BPF_STX, 4),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xfbabcbda),
|
|
|
|
|
BPF_STMT(BPF_STX, 5),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xaedecbdb),
|
|
|
|
|
BPF_STMT(BPF_STX, 6),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xadebbade),
|
|
|
|
|
BPF_STMT(BPF_STX, 7),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xfcfcfaec),
|
|
|
|
|
BPF_STMT(BPF_STX, 8),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xbcdddbdc),
|
|
|
|
|
BPF_STMT(BPF_STX, 9),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xfeefdfac),
|
|
|
|
|
BPF_STMT(BPF_STX, 10),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xcddcdeea),
|
|
|
|
|
BPF_STMT(BPF_STX, 11),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xaccfaebb),
|
|
|
|
|
BPF_STMT(BPF_STX, 12),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xbdcccdcf),
|
|
|
|
|
BPF_STMT(BPF_STX, 13),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xaaedecde),
|
|
|
|
|
BPF_STMT(BPF_STX, 14),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_IMM, 0xfaeacdad),
|
|
|
|
|
BPF_STMT(BPF_STX, 15),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 0),
|
|
|
|
|
BPF_STMT(BPF_MISC | BPF_TXA, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 1),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 2),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 3),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 4),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 5),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 6),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 7),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 8),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 9),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 10),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 11),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 12),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 13),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 14),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_LDX | BPF_MEM, 15),
|
|
|
|
|
BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC | FLAG_NO_DATA,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 0, 0x2a5a5e5 } },
|
|
|
|
|
},
|
2014-05-29 16:22:49 +08:00
|
|
|
{
|
|
|
|
|
"check: SKF_AD_MAX",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF + SKF_AD_MAX),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_A, 0),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
|
|
|
|
|
{ },
|
|
|
|
|
{ },
|
|
|
|
|
},
|
|
|
|
|
{ /* Passes checker but fails during runtime. */
|
|
|
|
|
"LD [SKF_AD_OFF-1]",
|
|
|
|
|
.u.insns = {
|
|
|
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
|
|
|
|
|
SKF_AD_OFF - 1),
|
|
|
|
|
BPF_STMT(BPF_RET | BPF_K, 1),
|
|
|
|
|
},
|
|
|
|
|
CLASSIC,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 1, 0 } },
|
|
|
|
|
},
|
net: filter: add "load 64-bit immediate" eBPF instruction
add BPF_LD_IMM64 instruction to load 64-bit immediate value into a register.
All previous instructions were 8-byte. This is first 16-byte instruction.
Two consecutive 'struct bpf_insn' blocks are interpreted as single instruction:
insn[0].code = BPF_LD | BPF_DW | BPF_IMM
insn[0].dst_reg = destination register
insn[0].imm = lower 32-bit
insn[1].code = 0
insn[1].imm = upper 32-bit
All unused fields must be zero.
Classic BPF has similar instruction: BPF_LD | BPF_W | BPF_IMM
which loads 32-bit immediate value into a register.
x64 JITs it as single 'movabsq %rax, imm64'
arm64 may JIT as sequence of four 'movk x0, #imm16, lsl #shift' insn
Note that old eBPF programs are binary compatible with new interpreter.
It helps eBPF programs load 64-bit constant into a register with one
instruction instead of using two registers and 4 instructions:
BPF_MOV32_IMM(R1, imm32)
BPF_ALU64_IMM(BPF_LSH, R1, 32)
BPF_MOV32_IMM(R2, imm32)
BPF_ALU64_REG(BPF_OR, R1, R2)
User space generated programs will use this instruction to load constants only.
To tell kernel that user space needs a pointer the _pseudo_ variant of
this instruction may be added later, which will use extra bits of encoding
to indicate what type of pointer user space is asking kernel to provide.
For example 'off' or 'src_reg' fields can be used for such purpose.
src_reg = 1 could mean that user space is asking kernel to validate and
load in-kernel map pointer.
src_reg = 2 could mean that user space needs readonly data section pointer
src_reg = 3 could mean that user space needs a pointer to per-cpu local data
All such future pseudo instructions will not be carrying the actual pointer
as part of the instruction, but rather will be treated as a request to kernel
to provide one. The kernel will verify the request_for_a_pointer, then
will drop _pseudo_ marking and will store actual internal pointer inside
the instruction, so the end result is the interpreter and JITs never
see pseudo BPF_LD_IMM64 insns and only operate on generic BPF_LD_IMM64 that
loads 64-bit immediate into a register. User space never operates on direct
pointers and verifier can easily recognize request_for_pointer vs other
instructions.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-09-05 13:17:17 +08:00
|
|
|
{
|
|
|
|
|
"load 64-bit immediate",
|
|
|
|
|
.u.insns_int = {
|
2014-09-20 04:53:51 +08:00
|
|
|
BPF_LD_IMM64(R1, 0x567800001234LL),
|
net: filter: add "load 64-bit immediate" eBPF instruction
add BPF_LD_IMM64 instruction to load 64-bit immediate value into a register.
All previous instructions were 8-byte. This is first 16-byte instruction.
Two consecutive 'struct bpf_insn' blocks are interpreted as single instruction:
insn[0].code = BPF_LD | BPF_DW | BPF_IMM
insn[0].dst_reg = destination register
insn[0].imm = lower 32-bit
insn[1].code = 0
insn[1].imm = upper 32-bit
All unused fields must be zero.
Classic BPF has similar instruction: BPF_LD | BPF_W | BPF_IMM
which loads 32-bit immediate value into a register.
x64 JITs it as single 'movabsq %rax, imm64'
arm64 may JIT as sequence of four 'movk x0, #imm16, lsl #shift' insn
Note that old eBPF programs are binary compatible with new interpreter.
It helps eBPF programs load 64-bit constant into a register with one
instruction instead of using two registers and 4 instructions:
BPF_MOV32_IMM(R1, imm32)
BPF_ALU64_IMM(BPF_LSH, R1, 32)
BPF_MOV32_IMM(R2, imm32)
BPF_ALU64_REG(BPF_OR, R1, R2)
User space generated programs will use this instruction to load constants only.
To tell kernel that user space needs a pointer the _pseudo_ variant of
this instruction may be added later, which will use extra bits of encoding
to indicate what type of pointer user space is asking kernel to provide.
For example 'off' or 'src_reg' fields can be used for such purpose.
src_reg = 1 could mean that user space is asking kernel to validate and
load in-kernel map pointer.
src_reg = 2 could mean that user space needs readonly data section pointer
src_reg = 3 could mean that user space needs a pointer to per-cpu local data
All such future pseudo instructions will not be carrying the actual pointer
as part of the instruction, but rather will be treated as a request to kernel
to provide one. The kernel will verify the request_for_a_pointer, then
will drop _pseudo_ marking and will store actual internal pointer inside
the instruction, so the end result is the interpreter and JITs never
see pseudo BPF_LD_IMM64 insns and only operate on generic BPF_LD_IMM64 that
loads 64-bit immediate into a register. User space never operates on direct
pointers and verifier can easily recognize request_for_pointer vs other
instructions.
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-09-05 13:17:17 +08:00
|
|
|
BPF_MOV64_REG(R2, R1),
|
|
|
|
|
BPF_MOV64_REG(R3, R2),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R2, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, R3, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, R3, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 0),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R2, 0x5678, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, R3, 0x1234, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MOV, R0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
INTERNAL,
|
|
|
|
|
{ },
|
|
|
|
|
{ { 0, 1 } }
|
|
|
|
|
},
|
2014-05-09 05:10:52 +08:00
|
|
|
};
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
static struct net_device dev;
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
static struct sk_buff *populate_skb(char *buf, int size)
|
2014-05-09 05:10:52 +08:00
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
|
|
|
|
|
if (size >= MAX_DATA)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
skb = alloc_skb(MAX_DATA, GFP_KERNEL);
|
|
|
|
|
if (!skb)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
memcpy(__skb_put(skb, size), buf, size);
|
2014-05-24 00:44:00 +08:00
|
|
|
|
|
|
|
|
/* Initialize a fake skb with test pattern. */
|
2014-05-09 05:10:52 +08:00
|
|
|
skb_reset_mac_header(skb);
|
|
|
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
|
skb->pkt_type = SKB_TYPE;
|
|
|
|
|
skb->mark = SKB_MARK;
|
|
|
|
|
skb->hash = SKB_HASH;
|
|
|
|
|
skb->queue_mapping = SKB_QUEUE_MAP;
|
|
|
|
|
skb->vlan_tci = SKB_VLAN_TCI;
|
|
|
|
|
skb->dev = &dev;
|
|
|
|
|
skb->dev->ifindex = SKB_DEV_IFINDEX;
|
|
|
|
|
skb->dev->type = SKB_DEV_TYPE;
|
|
|
|
|
skb_set_network_header(skb, min(size, ETH_HLEN));
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
static void *generate_test_data(struct bpf_test *test, int sub)
|
2014-05-09 05:10:52 +08:00
|
|
|
{
|
2014-05-24 00:44:00 +08:00
|
|
|
if (test->aux & FLAG_NO_DATA)
|
|
|
|
|
return NULL;
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
/* Test case expects an skb, so populate one. Various
|
|
|
|
|
* subtests generate skbs of different sizes based on
|
|
|
|
|
* the same data.
|
|
|
|
|
*/
|
|
|
|
|
return populate_skb(test->data, test->test[sub].data_size);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void release_test_data(const struct bpf_test *test, void *data)
|
|
|
|
|
{
|
|
|
|
|
if (test->aux & FLAG_NO_DATA)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
kfree_skb(data);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int probe_filter_length(struct sock_filter *fp)
|
|
|
|
|
{
|
|
|
|
|
int len = 0;
|
|
|
|
|
|
net: filter: fix length calculation in BPF testsuite
The current probe_filter_length() (the function that calculates the
length of a test BPF filter) behavior is to declare the end of the
filter as soon as it finds {0, *, *, 0}. This is actually a valid
insn ("ld #0"), so any filter with includes "BPF_STMT(BPF_LD | BPF_IMM, 0)"
fails (its length is cut short).
We are changing probe_filter_length() so as to start from the end, and
declare the end of the filter as the first instruction which is not
{0, *, *, 0}. This solution produces a simpler patch than the
alternative of using an explicit end-of-filter mark. It is technically
incorrect if your filter ends up with "ld #0", but that should not
happen anyway.
We also add a new test (LD_IMM_0) that includes ld #0 (does not work
without this patch).
Signed-off-by: Chema Gonzalez <chema@google.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-05-31 01:15:12 +08:00
|
|
|
for (len = MAX_INSNS - 1; len > 0; --len)
|
|
|
|
|
if (fp[len].code != 0 || fp[len].k != 0)
|
|
|
|
|
break;
|
2014-05-24 00:44:00 +08:00
|
|
|
|
net: filter: fix length calculation in BPF testsuite
The current probe_filter_length() (the function that calculates the
length of a test BPF filter) behavior is to declare the end of the
filter as soon as it finds {0, *, *, 0}. This is actually a valid
insn ("ld #0"), so any filter with includes "BPF_STMT(BPF_LD | BPF_IMM, 0)"
fails (its length is cut short).
We are changing probe_filter_length() so as to start from the end, and
declare the end of the filter as the first instruction which is not
{0, *, *, 0}. This solution produces a simpler patch than the
alternative of using an explicit end-of-filter mark. It is technically
incorrect if your filter ends up with "ld #0", but that should not
happen anyway.
We also add a new test (LD_IMM_0) that includes ld #0 (does not work
without this patch).
Signed-off-by: Chema Gonzalez <chema@google.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-05-31 01:15:12 +08:00
|
|
|
return len + 1;
|
2014-05-24 00:44:00 +08:00
|
|
|
}
|
|
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
static struct bpf_prog *generate_filter(int which, int *err)
|
2014-05-24 00:44:00 +08:00
|
|
|
{
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
struct bpf_prog *fp;
|
2014-05-24 00:44:00 +08:00
|
|
|
struct sock_fprog_kern fprog;
|
|
|
|
|
unsigned int flen = probe_filter_length(tests[which].u.insns);
|
|
|
|
|
__u8 test_type = tests[which].aux & TEST_TYPE_MASK;
|
|
|
|
|
|
|
|
|
|
switch (test_type) {
|
|
|
|
|
case CLASSIC:
|
|
|
|
|
fprog.filter = tests[which].u.insns;
|
|
|
|
|
fprog.len = flen;
|
|
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
*err = bpf_prog_create(&fp, &fprog);
|
2014-05-24 00:44:00 +08:00
|
|
|
if (tests[which].aux & FLAG_EXPECTED_FAIL) {
|
|
|
|
|
if (*err == -EINVAL) {
|
|
|
|
|
pr_cont("PASS\n");
|
|
|
|
|
/* Verifier rejected filter as expected. */
|
|
|
|
|
*err = 0;
|
|
|
|
|
return NULL;
|
|
|
|
|
} else {
|
|
|
|
|
pr_cont("UNEXPECTED_PASS\n");
|
|
|
|
|
/* Verifier didn't reject the test that's
|
|
|
|
|
* bad enough, just return!
|
|
|
|
|
*/
|
|
|
|
|
*err = -EINVAL;
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
/* We don't expect to fail. */
|
|
|
|
|
if (*err) {
|
|
|
|
|
pr_cont("FAIL to attach err=%d len=%d\n",
|
|
|
|
|
*err, fprog.len);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case INTERNAL:
|
2014-09-03 04:53:44 +08:00
|
|
|
fp = bpf_prog_alloc(bpf_prog_size(flen), 0);
|
2014-05-24 00:44:00 +08:00
|
|
|
if (fp == NULL) {
|
|
|
|
|
pr_cont("UNEXPECTED_FAIL no memory left\n");
|
|
|
|
|
*err = -ENOMEM;
|
|
|
|
|
return NULL;
|
2014-05-09 05:10:52 +08:00
|
|
|
}
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
fp->len = flen;
|
|
|
|
|
memcpy(fp->insnsi, tests[which].u.insns_int,
|
2014-07-25 07:38:21 +08:00
|
|
|
fp->len * sizeof(struct bpf_insn));
|
2014-05-09 05:10:52 +08:00
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
bpf_prog_select_runtime(fp);
|
2014-05-24 00:44:00 +08:00
|
|
|
break;
|
|
|
|
|
}
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
*err = 0;
|
|
|
|
|
return fp;
|
|
|
|
|
}
|
2014-05-09 05:10:52 +08:00
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
static void release_filter(struct bpf_prog *fp, int which)
|
2014-05-24 00:44:00 +08:00
|
|
|
{
|
|
|
|
|
__u8 test_type = tests[which].aux & TEST_TYPE_MASK;
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
switch (test_type) {
|
|
|
|
|
case CLASSIC:
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
bpf_prog_destroy(fp);
|
2014-05-24 00:44:00 +08:00
|
|
|
break;
|
|
|
|
|
case INTERNAL:
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
bpf_prog_free(fp);
|
2014-05-24 00:44:00 +08:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
static int __run_one(const struct bpf_prog *fp, const void *data,
|
2014-05-24 00:44:00 +08:00
|
|
|
int runs, u64 *duration)
|
|
|
|
|
{
|
|
|
|
|
u64 start, finish;
|
2014-09-20 04:53:51 +08:00
|
|
|
int ret = 0, i;
|
2014-05-24 00:44:00 +08:00
|
|
|
|
|
|
|
|
start = ktime_to_us(ktime_get());
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < runs; i++)
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
ret = BPF_PROG_RUN(fp, data);
|
2014-05-24 00:44:00 +08:00
|
|
|
|
|
|
|
|
finish = ktime_to_us(ktime_get());
|
|
|
|
|
|
|
|
|
|
*duration = (finish - start) * 1000ULL;
|
|
|
|
|
do_div(*duration, runs);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
static int run_one(const struct bpf_prog *fp, struct bpf_test *test)
|
2014-05-24 00:44:00 +08:00
|
|
|
{
|
|
|
|
|
int err_cnt = 0, i, runs = MAX_TESTRUNS;
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < MAX_SUBTESTS; i++) {
|
|
|
|
|
void *data;
|
|
|
|
|
u64 duration;
|
|
|
|
|
u32 ret;
|
|
|
|
|
|
|
|
|
|
if (test->test[i].data_size == 0 &&
|
|
|
|
|
test->test[i].result == 0)
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
data = generate_test_data(test, i);
|
|
|
|
|
ret = __run_one(fp, data, runs, &duration);
|
|
|
|
|
release_test_data(test, data);
|
|
|
|
|
|
|
|
|
|
if (ret == test->test[i].result) {
|
|
|
|
|
pr_cont("%lld ", duration);
|
|
|
|
|
} else {
|
|
|
|
|
pr_cont("ret %d != %d ", ret,
|
|
|
|
|
test->test[i].result);
|
2014-05-09 05:10:52 +08:00
|
|
|
err_cnt++;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return err_cnt;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static __init int test_bpf(void)
|
|
|
|
|
{
|
2014-05-24 00:44:00 +08:00
|
|
|
int i, err_cnt = 0, pass_cnt = 0;
|
2014-05-09 05:10:52 +08:00
|
|
|
|
|
|
|
|
for (i = 0; i < ARRAY_SIZE(tests); i++) {
|
net: filter: split 'struct sk_filter' into socket and bpf parts
clean up names related to socket filtering and bpf in the following way:
- everything that deals with sockets keeps 'sk_*' prefix
- everything that is pure BPF is changed to 'bpf_*' prefix
split 'struct sk_filter' into
struct sk_filter {
atomic_t refcnt;
struct rcu_head rcu;
struct bpf_prog *prog;
};
and
struct bpf_prog {
u32 jited:1,
len:31;
struct sock_fprog_kern *orig_prog;
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
struct work_struct work;
};
};
so that 'struct bpf_prog' can be used independent of sockets and cleans up
'unattached' bpf use cases
split SK_RUN_FILTER macro into:
SK_RUN_FILTER to be used with 'struct sk_filter *' and
BPF_PROG_RUN to be used with 'struct bpf_prog *'
__sk_filter_release(struct sk_filter *) gains
__bpf_prog_release(struct bpf_prog *) helper function
also perform related renames for the functions that work
with 'struct bpf_prog *', since they're on the same lines:
sk_filter_size -> bpf_prog_size
sk_filter_select_runtime -> bpf_prog_select_runtime
sk_filter_free -> bpf_prog_free
sk_unattached_filter_create -> bpf_prog_create
sk_unattached_filter_destroy -> bpf_prog_destroy
sk_store_orig_filter -> bpf_prog_store_orig_filter
sk_release_orig_filter -> bpf_release_orig_filter
__sk_migrate_filter -> bpf_migrate_filter
__sk_prepare_filter -> bpf_prepare_filter
API for attaching classic BPF to a socket stays the same:
sk_attach_filter(prog, struct sock *)/sk_detach_filter(struct sock *)
and SK_RUN_FILTER(struct sk_filter *, ctx) to execute a program
which is used by sockets, tun, af_packet
API for 'unattached' BPF programs becomes:
bpf_prog_create(struct bpf_prog **)/bpf_prog_destroy(struct bpf_prog *)
and BPF_PROG_RUN(struct bpf_prog *, ctx) to execute a program
which is used by isdn, ppp, team, seccomp, ptp, xt_bpf, cls_bpf, test_bpf
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-31 11:34:16 +08:00
|
|
|
struct bpf_prog *fp;
|
2014-05-24 00:44:00 +08:00
|
|
|
int err;
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
pr_info("#%d %s ", i, tests[i].descr);
|
2014-05-09 05:10:52 +08:00
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
fp = generate_filter(i, &err);
|
|
|
|
|
if (fp == NULL) {
|
|
|
|
|
if (err == 0) {
|
|
|
|
|
pass_cnt++;
|
|
|
|
|
continue;
|
2014-05-09 05:10:52 +08:00
|
|
|
}
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
2014-05-09 05:10:52 +08:00
|
|
|
err = run_one(fp, &tests[i]);
|
2014-05-24 00:44:00 +08:00
|
|
|
release_filter(fp, i);
|
2014-05-09 05:10:52 +08:00
|
|
|
|
|
|
|
|
if (err) {
|
2014-05-24 00:44:00 +08:00
|
|
|
pr_cont("FAIL (%d times)\n", err);
|
2014-05-09 05:10:52 +08:00
|
|
|
err_cnt++;
|
|
|
|
|
} else {
|
|
|
|
|
pr_cont("PASS\n");
|
2014-05-24 00:44:00 +08:00
|
|
|
pass_cnt++;
|
2014-05-09 05:10:52 +08:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-24 00:44:00 +08:00
|
|
|
pr_info("Summary: %d PASSED, %d FAILED\n", pass_cnt, err_cnt);
|
|
|
|
|
return err_cnt ? -EINVAL : 0;
|
2014-05-09 05:10:52 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int __init test_bpf_init(void)
|
|
|
|
|
{
|
|
|
|
|
return test_bpf();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void __exit test_bpf_exit(void)
|
|
|
|
|
{
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
module_init(test_bpf_init);
|
|
|
|
|
module_exit(test_bpf_exit);
|
2014-05-24 00:44:00 +08:00
|
|
|
|
2014-05-09 05:10:52 +08:00
|
|
|
MODULE_LICENSE("GPL");
|