/src/capstonev5/arch/BPF/BPFDisassembler.c

Source (jump to first uncovered line)
/* Capstone Disassembly Engine */
/* BPF Backend by david942j <david942j@gmail.com>, 2019 */

#ifdef CAPSTONE_HAS_BPF

#include <string.h>
#include <stddef.h> // offsetof macro

#include "BPFConstants.h"
#include "BPFDisassembler.h"
#include "BPFMapping.h"
#include "../../cs_priv.h"

static uint16_t read_u16(cs_struct *ud, const uint8_t *code)
{
  if (MODE_IS_BIG_ENDIAN(ud->mode))
    return (((uint16_t)code[0] << 8) | code[1]);
  else
    return (((uint16_t)code[1] << 8) | code[0]);
}

static uint32_t read_u32(cs_struct *ud, const uint8_t *code)
{
  if (MODE_IS_BIG_ENDIAN(ud->mode))
    return ((uint32_t)read_u16(ud, code) << 16) | read_u16(ud, code + 2);
  else
    return ((uint32_t)read_u16(ud, code + 2) << 16) | read_u16(ud, code);
}

///< Malloc bpf_internal, also checks if code_len is large enough.
static bpf_internal *alloc_bpf_internal(size_t code_len)
{
  bpf_internal *bpf;

  if (code_len < 8)
    return NULL;
  bpf = cs_mem_malloc(sizeof(bpf_internal));
  if (bpf == NULL)
    return NULL;
  /* default value */
  bpf->insn_size = 8;
  return bpf;
}

///< Fetch a cBPF structure from code
static bpf_internal* fetch_cbpf(cs_struct *ud, const uint8_t *code,
    size_t code_len)
{
  bpf_internal *bpf;

  bpf = alloc_bpf_internal(code_len);
  if (bpf == NULL)
    return NULL;

  bpf->op = read_u16(ud, code);
  bpf->jt = code[2];
  bpf->jf = code[3];
  bpf->k = read_u32(ud, code + 4);
  return bpf;
}

///< Fetch an eBPF structure from code
static bpf_internal* fetch_ebpf(cs_struct *ud, const uint8_t *code,
    size_t code_len)
{
  bpf_internal *bpf;

  bpf = alloc_bpf_internal(code_len);
  if (bpf == NULL)
    return NULL;

  bpf->op = (uint16_t)code[0];
  bpf->dst = code[1] & 0xf;
  bpf->src = (code[1] & 0xf0) >> 4;

  // eBPF has one 16-byte instruction: BPF_LD | BPF_DW | BPF_IMM,
  // in this case imm is combined with the next block's imm.
  if (bpf->op == (BPF_CLASS_LD | BPF_SIZE_DW | BPF_MODE_IMM)) {
    if (code_len < 16) {
      cs_mem_free(bpf);
      return NULL;
    }
    bpf->k = read_u32(ud, code + 4) | (((uint64_t)read_u32(ud, code + 12)) << 32);
    bpf->insn_size = 16;
  }
  else {
    bpf->offset = read_u16(ud, code + 2);
    bpf->k = read_u32(ud, code + 4);
  }
  return bpf;
}

#define CHECK_READABLE_REG(ud, reg) do { \
    if (! ((reg) >= BPF_REG_R0 && (reg) <= BPF_REG_R10)) \
      return false; \
  } while (0)

#define CHECK_WRITABLE_REG(ud, reg) do { \
    if (! ((reg) >= BPF_REG_R0 && (reg) < BPF_REG_R10)) \
      return false; \
  } while (0)

#define CHECK_READABLE_AND_PUSH(ud, MI, r) do { \
    CHECK_READABLE_REG(ud, r + BPF_REG_R0); \
    MCOperand_CreateReg0(MI, r + BPF_REG_R0); \
  } while (0)

#define CHECK_WRITABLE_AND_PUSH(ud, MI, r) do { \
    CHECK_WRITABLE_REG(ud, r + BPF_REG_R0); \
    MCOperand_CreateReg0(MI, r + BPF_REG_R0); \
  } while (0)

static bool decodeLoad(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  if (!EBPF_MODE(ud)) {
    /*
     *  +-----+-----------+--------------------+
     *  | ldb |    [k]    |       [x+k]        |
     *  | ldh |    [k]    |       [x+k]        |
     *  +-----+-----------+--------------------+
     */
    if (BPF_SIZE(bpf->op) == BPF_SIZE_DW)
      return false;
    if (BPF_SIZE(bpf->op) == BPF_SIZE_B || BPF_SIZE(bpf->op) == BPF_SIZE_H) {
      /* no ldx */
      if (BPF_CLASS(bpf->op) != BPF_CLASS_LD)
        return false;
      /* can only be BPF_ABS and BPF_IND */
      if (BPF_MODE(bpf->op) == BPF_MODE_ABS) {
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
      else if (BPF_MODE(bpf->op) == BPF_MODE_IND) {
        MCOperand_CreateReg0(MI, BPF_REG_X);
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
      return false;
    }
    /*
     *  +-----+----+------+------+-----+-------+
     *  | ld  | #k | #len | M[k] | [k] | [x+k] |
     *  +-----+----+------+------+-----+-------+
     *  | ldx | #k | #len | M[k] | 4*([k]&0xf) |
     *  +-----+----+------+------+-------------+
     */
    switch (BPF_MODE(bpf->op)) {
    default:
      break;
    case BPF_MODE_IMM:
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    case BPF_MODE_LEN:
      return true;
    case BPF_MODE_MEM:
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    }
    if (BPF_CLASS(bpf->op) == BPF_CLASS_LD) {
      if (BPF_MODE(bpf->op) == BPF_MODE_ABS) {
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
      else if (BPF_MODE(bpf->op) == BPF_MODE_IND) {
        MCOperand_CreateReg0(MI, BPF_REG_X);
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
    }
    else { /* LDX */
      if (BPF_MODE(bpf->op) == BPF_MODE_MSH) {
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
    }
    return false;
  }

  /* eBPF mode */
  /*
   * - IMM: lddw dst, imm64
   * - ABS: ld{w,h,b,dw} [k]
   * - IND: ld{w,h,b,dw} [src+k]
   * - MEM: ldx{w,h,b,dw} dst, [src+off]
   */
  if (BPF_CLASS(bpf->op) == BPF_CLASS_LD) {
    switch (BPF_MODE(bpf->op)) {
    case BPF_MODE_IMM:
      if (bpf->op != (BPF_CLASS_LD | BPF_SIZE_DW | BPF_MODE_IMM))
        return false;
      CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    case BPF_MODE_ABS:
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    case BPF_MODE_IND:
      CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    }
    return false;

  }
  /* LDX */
  if (BPF_MODE(bpf->op) == BPF_MODE_MEM) {
    CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
    MCOperand_CreateImm0(MI, bpf->offset);
    return true;
  }
  return false;
}

static bool decodeStore(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  /* in cBPF, only BPF_ST* | BPF_MEM | BPF_W is valid
   * while in eBPF:
   * - BPF_STX | BPF_XADD | BPF_{W,DW}
   * - BPF_ST* | BPF_MEM | BPF_{W,H,B,DW}
   * are valid
   */
  if (!EBPF_MODE(ud)) {
    /* can only store to M[] */
    if (bpf->op != (BPF_CLASS(bpf->op) | BPF_MODE_MEM | BPF_SIZE_W))
      return false;
    MCOperand_CreateImm0(MI, bpf->k);
    return true;
  }

  /* eBPF */

  if (BPF_MODE(bpf->op) == BPF_MODE_XADD) {
    if (BPF_CLASS(bpf->op) != BPF_CLASS_STX)
      return false;
    if (BPF_SIZE(bpf->op) != BPF_SIZE_W && BPF_SIZE(bpf->op) != BPF_SIZE_DW)
      return false;
    /* xadd [dst + off], src */
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
    MCOperand_CreateImm0(MI, bpf->offset);
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
    return true;
  }

  if (BPF_MODE(bpf->op) != BPF_MODE_MEM)
    return false;

  /* st [dst + off], src */
  CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
  MCOperand_CreateImm0(MI, bpf->offset);
  if (BPF_CLASS(bpf->op) == BPF_CLASS_ST)
    MCOperand_CreateImm0(MI, bpf->k);
  else
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
  return true;
}

static bool decodeALU(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  /* Set MI->Operands */

  /* cBPF */
  if (!EBPF_MODE(ud)) {
    if (BPF_OP(bpf->op) > BPF_ALU_XOR)
      return false;
    /* cBPF's NEG has no operands */
    if (BPF_OP(bpf->op) == BPF_ALU_NEG)
      return true;
    if (BPF_SRC(bpf->op) == BPF_SRC_K)
      MCOperand_CreateImm0(MI, bpf->k);
    else /* BPF_SRC_X */
      MCOperand_CreateReg0(MI, BPF_REG_X);
    return true;
  }

  /* eBPF */

  if (BPF_OP(bpf->op) > BPF_ALU_END)
    return false;
  /* ALU64 class doesn't have ENDian */
  /* ENDian's imm must be one of 16, 32, 64 */
  if (BPF_OP(bpf->op) == BPF_ALU_END) {
    if (BPF_CLASS(bpf->op) == BPF_CLASS_ALU64)
      return false;
    if (bpf->k != 16 && bpf->k != 32 && bpf->k != 64)
      return false;
  }

  /* - op dst, imm
   * - op dst, src
   * - neg dst
   * - le<imm> dst
   */
  /* every ALU instructions have dst op */
  CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);

  /* special cases */
  if (BPF_OP(bpf->op) == BPF_ALU_NEG)
    return true;
  if (BPF_OP(bpf->op) == BPF_ALU_END) {
    /* bpf->k must be one of 16, 32, 64 */
    MCInst_setOpcode(MI, MCInst_getOpcode(MI) | ((uint32_t)bpf->k << 4));
    return true;
  }

  /* normal cases */
  if (BPF_SRC(bpf->op) == BPF_SRC_K) {
    MCOperand_CreateImm0(MI, bpf->k);
  }
  else { /* BPF_SRC_X */
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
  }
  return true;
}

static bool decodeJump(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  /* cBPF and eBPF are very different in class jump */
  if (!EBPF_MODE(ud)) {
    if (BPF_OP(bpf->op) > BPF_JUMP_JSET)
      return false;

    /* ja is a special case of jumps */
    if (BPF_OP(bpf->op) == BPF_JUMP_JA) {
      MCOperand_CreateImm0(MI, bpf->k);
      return true;
    }

    if (BPF_SRC(bpf->op) == BPF_SRC_K)
      MCOperand_CreateImm0(MI, bpf->k);
    else /* BPF_SRC_X */
      MCOperand_CreateReg0(MI, BPF_REG_X);
    MCOperand_CreateImm0(MI, bpf->jt);
    MCOperand_CreateImm0(MI, bpf->jf);
  }
  else {
    if (BPF_OP(bpf->op) > BPF_JUMP_JSLE)
      return false;

    /* No operands for exit */
    if (BPF_OP(bpf->op) == BPF_JUMP_EXIT)
      return bpf->op == (BPF_CLASS_JMP | BPF_JUMP_EXIT);
    if (BPF_OP(bpf->op) == BPF_JUMP_CALL) {
      if (bpf->op == (BPF_CLASS_JMP | BPF_JUMP_CALL)) {
        MCOperand_CreateImm0(MI, bpf->k);
        return true;
      }
      if (bpf->op == (BPF_CLASS_JMP | BPF_JUMP_CALL | BPF_SRC_X)) {
        CHECK_READABLE_AND_PUSH(ud, MI, bpf->k);
        return true;
      }
      return false;
    }

    /* ja is a special case of jumps */
    if (BPF_OP(bpf->op) == BPF_JUMP_JA) {
      if (BPF_SRC(bpf->op) != BPF_SRC_K)
        return false;
      MCOperand_CreateImm0(MI, bpf->offset);
      return true;
    }

    /* <j>  dst, src, +off */
    CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
    if (BPF_SRC(bpf->op) == BPF_SRC_K)
      MCOperand_CreateImm0(MI, bpf->k);
    else
      CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
    MCOperand_CreateImm0(MI, bpf->offset);
  }
  return true;
}

static bool decodeReturn(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  /* Here only handles the BPF_RET class in cBPF */
  switch (BPF_RVAL(bpf->op)) {
  case BPF_SRC_K:
    MCOperand_CreateImm0(MI, bpf->k);
    return true;
  case BPF_SRC_X:
    MCOperand_CreateReg0(MI, BPF_REG_X);
    return true;
  case BPF_SRC_A:
    MCOperand_CreateReg0(MI, BPF_REG_A);
    return true;
  }
  return false;
}

static bool decodeMISC(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  uint16_t op = bpf->op ^ BPF_CLASS_MISC;
  return op == BPF_MISCOP_TAX || op == BPF_MISCOP_TXA;
}

///< 1. Check if the instruction is valid
///< 2. Set MI->opcode
///< 3. Set MI->Operands
static bool getInstruction(cs_struct *ud, MCInst *MI, bpf_internal *bpf)
{
  cs_detail *detail;

  detail = MI->flat_insn->detail;
  // initialize detail
  if (detail) {
    memset(detail, 0, offsetof(cs_detail, bpf) + sizeof(cs_bpf));
  }

  MCInst_clear(MI);
  MCInst_setOpcode(MI, bpf->op);

  switch (BPF_CLASS(bpf->op)) {
  default: /* should never happen */
    return false;
  case BPF_CLASS_LD:
  case BPF_CLASS_LDX:
    return decodeLoad(ud, MI, bpf);
  case BPF_CLASS_ST:
  case BPF_CLASS_STX:
    return decodeStore(ud, MI, bpf);
  case BPF_CLASS_ALU:
    return decodeALU(ud, MI, bpf);
  case BPF_CLASS_JMP:
    return decodeJump(ud, MI, bpf);
  case BPF_CLASS_RET:
    /* eBPF doesn't have this class */
    if (EBPF_MODE(ud))
      return false;
    return decodeReturn(ud, MI, bpf);
  case BPF_CLASS_MISC:
  /* case BPF_CLASS_ALU64: */
    if (EBPF_MODE(ud))
      return decodeALU(ud, MI, bpf);
    else
      return decodeMISC(ud, MI, bpf);
  }
}

bool BPF_getInstruction(csh ud, const uint8_t *code, size_t code_len,
    MCInst *instr, uint16_t *size, uint64_t address, void *info)
{
  cs_struct *cs;
  bpf_internal *bpf;

  cs = (cs_struct*)ud;
  if (EBPF_MODE(cs))
    bpf = fetch_ebpf(cs, code, code_len);
  else
    bpf = fetch_cbpf(cs, code, code_len);
  if (bpf == NULL)
    return false;
  if (!getInstruction(cs, instr, bpf)) {
    cs_mem_free(bpf);
    return false;
  }

  *size = bpf->insn_size;
  cs_mem_free(bpf);

  return true;
}

#endif

Coverage Report

Created: 2024-09-08 06:22

Line	Count	Source (jump to first uncovered line)
1		/* Capstone Disassembly Engine */
2		/* BPF Backend by david942j <david942j@gmail.com>, 2019 */
3
4		#ifdef CAPSTONE_HAS_BPF
5
6		#include <string.h>
7		#include <stddef.h> // offsetof macro
8
9		#include "BPFConstants.h"
10		#include "BPFDisassembler.h"
11		#include "BPFMapping.h"
12		#include "../../cs_priv.h"
13
14		static uint16_t read_u16(cs_struct ud, const uint8_t code)
15	96.2k	{
16	96.2k	if (MODE_IS_BIG_ENDIAN(ud->mode))
17	48.1k	return (((uint16_t)code[0] << 8) \| code[1]);
18	48.0k	else
19	48.0k	return (((uint16_t)code[1] << 8) \| code[0]);
20	96.2k	}
21
22		static uint32_t read_u32(cs_struct ud, const uint8_t code)
23	32.4k	{
24	32.4k	if (MODE_IS_BIG_ENDIAN(ud->mode))
25	16.2k	return ((uint32_t)read_u16(ud, code) << 16) \| read_u16(ud, code + 2);
26	16.2k	else
27	16.2k	return ((uint32_t)read_u16(ud, code + 2) << 16) \| read_u16(ud, code);
28	32.4k	}
29
30		///< Malloc bpf_internal, also checks if code_len is large enough.
31		static bpf_internal *alloc_bpf_internal(size_t code_len)
32	32.3k	{
33	32.3k	bpf_internal *bpf;
34
35	32.3k	if (code_len < 8)
36	479	return NULL;
37	31.8k	bpf = cs_mem_malloc(sizeof(bpf_internal));
38	31.8k	if (bpf == NULL)
39	0	return NULL;
40		/* default value */
41	31.8k	bpf->insn_size = 8;
42	31.8k	return bpf;
43	31.8k	}
44
45		///< Fetch a cBPF structure from code
46		static bpf_internal* fetch_cbpf(cs_struct ud, const uint8_t code,
47		size_t code_len)
48	13.5k	{
49	13.5k	bpf_internal *bpf;
50
51	13.5k	bpf = alloc_bpf_internal(code_len);
52	13.5k	if (bpf == NULL)
53	184	return NULL;
54
55	13.3k	bpf->op = read_u16(ud, code);
56	13.3k	bpf->jt = code[2];
57	13.3k	bpf->jf = code[3];
58	13.3k	bpf->k = read_u32(ud, code + 4);
59	13.3k	return bpf;
60	13.5k	}
61
62		///< Fetch an eBPF structure from code
63		static bpf_internal* fetch_ebpf(cs_struct ud, const uint8_t code,
64		size_t code_len)
65	18.8k	{
66	18.8k	bpf_internal *bpf;
67
68	18.8k	bpf = alloc_bpf_internal(code_len);
69	18.8k	if (bpf == NULL)
70	295	return NULL;
71
72	18.5k	bpf->op = (uint16_t)code[0];
73	18.5k	bpf->dst = code[1] & 0xf;
74	18.5k	bpf->src = (code[1] & 0xf0) >> 4;
75
76		// eBPF has one 16-byte instruction: BPF_LD \| BPF_DW \| BPF_IMM,
77		// in this case imm is combined with the next block's imm.
78	18.5k	if (bpf->op == (BPF_CLASS_LD \| BPF_SIZE_DW \| BPF_MODE_IMM)) {
79	583	if (code_len < 16) {
80	2	cs_mem_free(bpf);
81	2	return NULL;
82	2	}
83	581	bpf->k = read_u32(ud, code + 4) \| (((uint64_t)read_u32(ud, code + 12)) << 32);
84	581	bpf->insn_size = 16;
85	581	}
86	17.9k	else {
87	17.9k	bpf->offset = read_u16(ud, code + 2);
88	17.9k	bpf->k = read_u32(ud, code + 4);
89	17.9k	}
90	18.5k	return bpf;
91	18.5k	}
92
93	10.9k	#define CHECK_READABLE_REG(ud, reg) do { \
94	10.9k	if (! ((reg) >= BPF_REG_R0 && (reg) <= BPF_REG_R10)) \
95	10.9k	return false; \
96	10.9k	} while (0)
97
98	4.76k	#define CHECK_WRITABLE_REG(ud, reg) do { \
99	4.76k	if (! ((reg) >= BPF_REG_R0 && (reg) < BPF_REG_R10)) \
100	4.76k	return false; \
101	4.76k	} while (0)
102
103	10.9k	#define CHECK_READABLE_AND_PUSH(ud, MI, r) do { \
104	10.9k	CHECK_READABLE_REG(ud, r + BPF_REG_R0); \
105	10.9k	MCOperand_CreateReg0(MI, r + BPF_REG_R0); \
106	10.8k	} while (0)
107
108	4.76k	#define CHECK_WRITABLE_AND_PUSH(ud, MI, r) do { \
109	4.76k	CHECK_WRITABLE_REG(ud, r + BPF_REG_R0); \
110	4.76k	MCOperand_CreateReg0(MI, r + BPF_REG_R0); \
111	4.74k	} while (0)
112
113		static bool decodeLoad(cs_struct ud, MCInst MI, bpf_internal *bpf)
114	10.1k	{
115	10.1k	if (!EBPF_MODE(ud)) {
116		/*
117		* +-----+-----------+--------------------+
118		* \| ldb \| [k] \| [x+k] \|
119		* \| ldh \| [k] \| [x+k] \|
120		* +-----+-----------+--------------------+
121		*/
122	5.43k	if (BPF_SIZE(bpf->op) == BPF_SIZE_DW)
123	10	return false;
124	5.42k	if (BPF_SIZE(bpf->op) == BPF_SIZE_B \|\| BPF_SIZE(bpf->op) == BPF_SIZE_H) {
125		/* no ldx */
126	1.74k	if (BPF_CLASS(bpf->op) != BPF_CLASS_LD)
127	6	return false;
128		/* can only be BPF_ABS and BPF_IND */
129	1.74k	if (BPF_MODE(bpf->op) == BPF_MODE_ABS) {
130	705	MCOperand_CreateImm0(MI, bpf->k);
131	705	return true;
132	705	}
133	1.03k	else if (BPF_MODE(bpf->op) == BPF_MODE_IND) {
134	1.02k	MCOperand_CreateReg0(MI, BPF_REG_X);
135	1.02k	MCOperand_CreateImm0(MI, bpf->k);
136	1.02k	return true;
137	1.02k	}
138	10	return false;
139	1.74k	}
140		/*
141		* +-----+----+------+------+-----+-------+
142		* \| ld \| #k \| #len \| M[k] \| [k] \| [x+k] \|
143		* +-----+----+------+------+-----+-------+
144		* \| ldx \| #k \| #len \| M[k] \| 4*([k]&0xf) \|
145		* +-----+----+------+------+-------------+
146		*/
147	3.67k	switch (BPF_MODE(bpf->op)) {
148	1.22k	default:
149	1.22k	break;
150	1.65k	case BPF_MODE_IMM:
151	1.65k	MCOperand_CreateImm0(MI, bpf->k);
152	1.65k	return true;
153	401	case BPF_MODE_LEN:
154	401	return true;
155	401	case BPF_MODE_MEM:
156	401	MCOperand_CreateImm0(MI, bpf->k);
157	401	return true;
158	3.67k	}
159	1.22k	if (BPF_CLASS(bpf->op) == BPF_CLASS_LD) {
160	885	if (BPF_MODE(bpf->op) == BPF_MODE_ABS) {
161	460	MCOperand_CreateImm0(MI, bpf->k);
162	460	return true;
163	460	}
164	425	else if (BPF_MODE(bpf->op) == BPF_MODE_IND) {
165	422	MCOperand_CreateReg0(MI, BPF_REG_X);
166	422	MCOperand_CreateImm0(MI, bpf->k);
167	422	return true;
168	422	}
169	885	}
170	336	else { /* LDX */
171	336	if (BPF_MODE(bpf->op) == BPF_MODE_MSH) {
172	329	MCOperand_CreateImm0(MI, bpf->k);
173	329	return true;
174	329	}
175	336	}
176	10	return false;
177	1.22k	}
178
179		/* eBPF mode */
180		/*
181		* - IMM: lddw dst, imm64
182		* - ABS: ld{w,h,b,dw} [k]
183		* - IND: ld{w,h,b,dw} [src+k]
184		* - MEM: ldx{w,h,b,dw} dst, [src+off]
185		*/
186	4.73k	if (BPF_CLASS(bpf->op) == BPF_CLASS_LD) {
187	3.33k	switch (BPF_MODE(bpf->op)) {
188	623	case BPF_MODE_IMM:
189	623	if (bpf->op != (BPF_CLASS_LD \| BPF_SIZE_DW \| BPF_MODE_IMM))
190	42	return false;
191	581	CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);
192	577	MCOperand_CreateImm0(MI, bpf->k);
193	577	return true;
194	1.51k	case BPF_MODE_ABS:
195	1.51k	MCOperand_CreateImm0(MI, bpf->k);
196	1.51k	return true;
197	1.18k	case BPF_MODE_IND:
198	1.18k	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
199	1.17k	MCOperand_CreateImm0(MI, bpf->k);
200	1.17k	return true;
201	3.33k	}
202	13	return false;
203
204	3.33k	}
205		/* LDX */
206	1.40k	if (BPF_MODE(bpf->op) == BPF_MODE_MEM) {
207	1.39k	CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);
208	1.39k	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
209	1.38k	MCOperand_CreateImm0(MI, bpf->offset);
210	1.38k	return true;
211	1.39k	}
212	13	return false;
213	1.40k	}
214
215		static bool decodeStore(cs_struct ud, MCInst MI, bpf_internal *bpf)
216	3.32k	{
217		/* in cBPF, only BPF_ST* \| BPF_MEM \| BPF_W is valid
218		* while in eBPF:
219		* - BPF_STX \| BPF_XADD \| BPF_{W,DW}
220		* - BPF_ST* \| BPF_MEM \| BPF_{W,H,B,DW}
221		* are valid
222		*/
223	3.32k	if (!EBPF_MODE(ud)) {
224		/* can only store to M[] */
225	168	if (bpf->op != (BPF_CLASS(bpf->op) \| BPF_MODE_MEM \| BPF_SIZE_W))
226	38	return false;
227	130	MCOperand_CreateImm0(MI, bpf->k);
228	130	return true;
229	168	}
230
231		/* eBPF */
232
233	3.15k	if (BPF_MODE(bpf->op) == BPF_MODE_XADD) {
234	109	if (BPF_CLASS(bpf->op) != BPF_CLASS_STX)
235	5	return false;
236	104	if (BPF_SIZE(bpf->op) != BPF_SIZE_W && BPF_SIZE(bpf->op) != BPF_SIZE_DW)
237	4	return false;
238		/* xadd [dst + off], src */
239	100	CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
240	97	MCOperand_CreateImm0(MI, bpf->offset);
241	97	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
242	91	return true;
243	97	}
244
245	3.04k	if (BPF_MODE(bpf->op) != BPF_MODE_MEM)
246	25	return false;
247
248		/* st [dst + off], src */
249	3.02k	CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
250	3.01k	MCOperand_CreateImm0(MI, bpf->offset);
251	3.01k	if (BPF_CLASS(bpf->op) == BPF_CLASS_ST)
252	1.38k	MCOperand_CreateImm0(MI, bpf->k);
253	1.62k	else
254	1.62k	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
255	3.01k	return true;
256	3.01k	}
257
258		static bool decodeALU(cs_struct ud, MCInst MI, bpf_internal *bpf)
259	4.67k	{
260		/* Set MI->Operands */
261
262		/* cBPF */
263	4.67k	if (!EBPF_MODE(ud)) {
264	1.84k	if (BPF_OP(bpf->op) > BPF_ALU_XOR)
265	3	return false;
266		/* cBPF's NEG has no operands */
267	1.84k	if (BPF_OP(bpf->op) == BPF_ALU_NEG)
268	367	return true;
269	1.47k	if (BPF_SRC(bpf->op) == BPF_SRC_K)
270	832	MCOperand_CreateImm0(MI, bpf->k);
271	644	else /* BPF_SRC_X */
272	644	MCOperand_CreateReg0(MI, BPF_REG_X);
273	1.47k	return true;
274	1.84k	}
275
276		/* eBPF */
277
278	2.82k	if (BPF_OP(bpf->op) > BPF_ALU_END)
279	11	return false;
280		/* ALU64 class doesn't have ENDian */
281		/* ENDian's imm must be one of 16, 32, 64 */
282	2.81k	if (BPF_OP(bpf->op) == BPF_ALU_END) {
283	64	if (BPF_CLASS(bpf->op) == BPF_CLASS_ALU64)
284	1	return false;
285	63	if (bpf->k != 16 && bpf->k != 32 && bpf->k != 64)
286	19	return false;
287	63	}
288
289		/* - op dst, imm
290		* - op dst, src
291		* - neg dst
292		* - le<imm> dst
293		*/
294		/* every ALU instructions have dst op */
295	2.79k	CHECK_WRITABLE_AND_PUSH(ud, MI, bpf->dst);
296
297		/* special cases */
298	2.78k	if (BPF_OP(bpf->op) == BPF_ALU_NEG)
299	619	return true;
300	2.16k	if (BPF_OP(bpf->op) == BPF_ALU_END) {
301		/* bpf->k must be one of 16, 32, 64 */
302	44	MCInst_setOpcode(MI, MCInst_getOpcode(MI) \| ((uint32_t)bpf->k << 4));
303	44	return true;
304	44	}
305
306		/* normal cases */
307	2.11k	if (BPF_SRC(bpf->op) == BPF_SRC_K) {
308	1.88k	MCOperand_CreateImm0(MI, bpf->k);
309	1.88k	}
310	236	else { /* BPF_SRC_X */
311	236	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
312	236	}
313	2.11k	return true;
314	2.11k	}
315
316		static bool decodeJump(cs_struct ud, MCInst MI, bpf_internal *bpf)
317	7.17k	{
318		/* cBPF and eBPF are very different in class jump */
319	7.17k	if (!EBPF_MODE(ud)) {
320	1.94k	if (BPF_OP(bpf->op) > BPF_JUMP_JSET)
321	7	return false;
322
323		/* ja is a special case of jumps */
324	1.93k	if (BPF_OP(bpf->op) == BPF_JUMP_JA) {
325	666	MCOperand_CreateImm0(MI, bpf->k);
326	666	return true;
327	666	}
328
329	1.27k	if (BPF_SRC(bpf->op) == BPF_SRC_K)
330	653	MCOperand_CreateImm0(MI, bpf->k);
331	619	else /* BPF_SRC_X */
332	619	MCOperand_CreateReg0(MI, BPF_REG_X);
333	1.27k	MCOperand_CreateImm0(MI, bpf->jt);
334	1.27k	MCOperand_CreateImm0(MI, bpf->jf);
335	1.27k	}
336	5.23k	else {
337	5.23k	if (BPF_OP(bpf->op) > BPF_JUMP_JSLE)
338	4	return false;
339
340		/* No operands for exit */
341	5.22k	if (BPF_OP(bpf->op) == BPF_JUMP_EXIT)
342	590	return bpf->op == (BPF_CLASS_JMP \| BPF_JUMP_EXIT);
343	4.63k	if (BPF_OP(bpf->op) == BPF_JUMP_CALL) {
344	1.12k	if (bpf->op == (BPF_CLASS_JMP \| BPF_JUMP_CALL)) {
345	1.02k	MCOperand_CreateImm0(MI, bpf->k);
346	1.02k	return true;
347	1.02k	}
348	94	if (bpf->op == (BPF_CLASS_JMP \| BPF_JUMP_CALL \| BPF_SRC_X)) {
349	94	CHECK_READABLE_AND_PUSH(ud, MI, bpf->k);
350	21	return true;
351	94	}
352	0	return false;
353	94	}
354
355		/* ja is a special case of jumps */
356	3.51k	if (BPF_OP(bpf->op) == BPF_JUMP_JA) {
357	579	if (BPF_SRC(bpf->op) != BPF_SRC_K)
358	2	return false;
359	577	MCOperand_CreateImm0(MI, bpf->offset);
360	577	return true;
361	579	}
362
363		/* <j> dst, src, +off */
364	2.93k	CHECK_READABLE_AND_PUSH(ud, MI, bpf->dst);
365	2.92k	if (BPF_SRC(bpf->op) == BPF_SRC_K)
366	2.70k	MCOperand_CreateImm0(MI, bpf->k);
367	225	else
368	225	CHECK_READABLE_AND_PUSH(ud, MI, bpf->src);
369	2.92k	MCOperand_CreateImm0(MI, bpf->offset);
370	2.92k	}
371	4.19k	return true;
372	7.17k	}
373
374		static bool decodeReturn(cs_struct ud, MCInst MI, bpf_internal *bpf)
375	1.94k	{
376		/* Here only handles the BPF_RET class in cBPF */
377	1.94k	switch (BPF_RVAL(bpf->op)) {
378	670	case BPF_SRC_K:
379	670	MCOperand_CreateImm0(MI, bpf->k);
380	670	return true;
381	458	case BPF_SRC_X:
382	458	MCOperand_CreateReg0(MI, BPF_REG_X);
383	458	return true;
384	811	case BPF_SRC_A:
385	811	MCOperand_CreateReg0(MI, BPF_REG_A);
386	811	return true;
387	1.94k	}
388	6	return false;
389	1.94k	}
390
391		static bool decodeMISC(cs_struct ud, MCInst MI, bpf_internal *bpf)
392	81	{
393	81	uint16_t op = bpf->op ^ BPF_CLASS_MISC;
394	81	return op == BPF_MISCOP_TAX \|\| op == BPF_MISCOP_TXA;
395	81	}
396
397		///< 1. Check if the instruction is valid
398		///< 2. Set MI->opcode
399		///< 3. Set MI->Operands
400		static bool getInstruction(cs_struct ud, MCInst MI, bpf_internal *bpf)
401	31.8k	{
402	31.8k	cs_detail *detail;
403
404	31.8k	detail = MI->flat_insn->detail;
405		// initialize detail
406	31.8k	if (detail) {
407	31.8k	memset(detail, 0, offsetof(cs_detail, bpf) + sizeof(cs_bpf));
408	31.8k	}
409
410	31.8k	MCInst_clear(MI);
411	31.8k	MCInst_setOpcode(MI, bpf->op);
412
413	31.8k	switch (BPF_CLASS(bpf->op)) {
414	0	default: /* should never happen */
415	0	return false;
416	7.79k	case BPF_CLASS_LD:
417	10.1k	case BPF_CLASS_LDX:
418	10.1k	return decodeLoad(ud, MI, bpf);
419	1.52k	case BPF_CLASS_ST:
420	3.32k	case BPF_CLASS_STX:
421	3.32k	return decodeStore(ud, MI, bpf);
422	5.98k	case BPF_CLASS_ALU:
423	5.98k	return decodeALU(ud, MI, bpf);
424	7.17k	case BPF_CLASS_JMP:
425	7.17k	return decodeJump(ud, MI, bpf);
426	1.96k	case BPF_CLASS_RET:
427		/* eBPF doesn't have this class */
428	1.96k	if (EBPF_MODE(ud))
429	19	return false;
430	1.94k	return decodeReturn(ud, MI, bpf);
431	3.25k	case BPF_CLASS_MISC:
432		/* case BPF_CLASS_ALU64: */
433	3.25k	if (EBPF_MODE(ud))
434	3.17k	return decodeALU(ud, MI, bpf);
435	81	else
436	81	return decodeMISC(ud, MI, bpf);
437	31.8k	}
438	31.8k	}
439
440		bool BPF_getInstruction(csh ud, const uint8_t *code, size_t code_len,
441		MCInst instr, uint16_t size, uint64_t address, void *info)
442	32.3k	{
443	32.3k	cs_struct *cs;
444	32.3k	bpf_internal *bpf;
445
446	32.3k	cs = (cs_struct*)ud;
447	32.3k	if (EBPF_MODE(cs))
448	18.8k	bpf = fetch_ebpf(cs, code, code_len);
449	13.5k	else
450	13.5k	bpf = fetch_cbpf(cs, code, code_len);
451	32.3k	if (bpf == NULL)
452	481	return false;
453	31.8k	if (!getInstruction(cs, instr, bpf)) {
454	466	cs_mem_free(bpf);
455	466	return false;
456	466	}
457
458	31.4k	*size = bpf->insn_size;
459	31.4k	cs_mem_free(bpf);
460
461	31.4k	return true;
462	31.8k	}
463
464		#endif