377 lines
14 KiB
ReStructuredText
377 lines
14 KiB
ReStructuredText
|
|
||
|
|
===================
|
||
|
|
Classic BPF vs eBPF
|
||
|
|
===================
|
||
|
|
|
||
|
|
eBPF is designed to be JITed with one to one mapping, which can also open up
|
||
|
|
the possibility for GCC/LLVM compilers to generate optimized eBPF code through
|
||
|
|
an eBPF backend that performs almost as fast as natively compiled code.
|
||
|
|
|
||
|
|
Some core changes of the eBPF format from classic BPF:
|
||
|
|
|
||
|
|
- Number of registers increase from 2 to 10:
|
||
|
|
|
||
|
|
The old format had two registers A and X, and a hidden frame pointer. The
|
||
|
|
new layout extends this to be 10 internal registers and a read-only frame
|
||
|
|
pointer. Since 64-bit CPUs are passing arguments to functions via registers
|
||
|
|
the number of args from eBPF program to in-kernel function is restricted
|
||
|
|
to 5 and one register is used to accept return value from an in-kernel
|
||
|
|
function. Natively, x86_64 passes first 6 arguments in registers, aarch64/
|
||
|
|
sparcv9/mips64 have 7 - 8 registers for arguments; x86_64 has 6 callee saved
|
||
|
|
registers, and aarch64/sparcv9/mips64 have 11 or more callee saved registers.
|
||
|
|
|
||
|
|
Thus, all eBPF registers map one to one to HW registers on x86_64, aarch64,
|
||
|
|
etc, and eBPF calling convention maps directly to ABIs used by the kernel on
|
||
|
|
64-bit architectures.
|
||
|
|
|
||
|
|
On 32-bit architectures JIT may map programs that use only 32-bit arithmetic
|
||
|
|
and may let more complex programs to be interpreted.
|
||
|
|
|
||
|
|
R0 - R5 are scratch registers and eBPF program needs spill/fill them if
|
||
|
|
necessary across calls. Note that there is only one eBPF program (== one
|
||
|
|
eBPF main routine) and it cannot call other eBPF functions, it can only
|
||
|
|
call predefined in-kernel functions, though.
|
||
|
|
|
||
|
|
- Register width increases from 32-bit to 64-bit:
|
||
|
|
|
||
|
|
Still, the semantics of the original 32-bit ALU operations are preserved
|
||
|
|
via 32-bit subregisters. All eBPF registers are 64-bit with 32-bit lower
|
||
|
|
subregisters that zero-extend into 64-bit if they are being written to.
|
||
|
|
That behavior maps directly to x86_64 and arm64 subregister definition, but
|
||
|
|
makes other JITs more difficult.
|
||
|
|
|
||
|
|
32-bit architectures run 64-bit eBPF programs via interpreter.
|
||
|
|
Their JITs may convert BPF programs that only use 32-bit subregisters into
|
||
|
|
native instruction set and let the rest being interpreted.
|
||
|
|
|
||
|
|
Operation is 64-bit, because on 64-bit architectures, pointers are also
|
||
|
|
64-bit wide, and we want to pass 64-bit values in/out of kernel functions,
|
||
|
|
so 32-bit eBPF registers would otherwise require to define register-pair
|
||
|
|
ABI, thus, there won't be able to use a direct eBPF register to HW register
|
||
|
|
mapping and JIT would need to do combine/split/move operations for every
|
||
|
|
register in and out of the function, which is complex, bug prone and slow.
|
||
|
|
Another reason is the use of atomic 64-bit counters.
|
||
|
|
|
||
|
|
- Conditional jt/jf targets replaced with jt/fall-through:
|
||
|
|
|
||
|
|
While the original design has constructs such as ``if (cond) jump_true;
|
||
|
|
else jump_false;``, they are being replaced into alternative constructs like
|
||
|
|
``if (cond) jump_true; /* else fall-through */``.
|
||
|
|
|
||
|
|
- Introduces bpf_call insn and register passing convention for zero overhead
|
||
|
|
calls from/to other kernel functions:
|
||
|
|
|
||
|
|
Before an in-kernel function call, the eBPF program needs to
|
||
|
|
place function arguments into R1 to R5 registers to satisfy calling
|
||
|
|
convention, then the interpreter will take them from registers and pass
|
||
|
|
to in-kernel function. If R1 - R5 registers are mapped to CPU registers
|
||
|
|
that are used for argument passing on given architecture, the JIT compiler
|
||
|
|
doesn't need to emit extra moves. Function arguments will be in the correct
|
||
|
|
registers and BPF_CALL instruction will be JITed as single 'call' HW
|
||
|
|
instruction. This calling convention was picked to cover common call
|
||
|
|
situations without performance penalty.
|
||
|
|
|
||
|
|
After an in-kernel function call, R1 - R5 are reset to unreadable and R0 has
|
||
|
|
a return value of the function. Since R6 - R9 are callee saved, their state
|
||
|
|
is preserved across the call.
|
||
|
|
|
||
|
|
For example, consider three C functions::
|
||
|
|
|
||
|
|
u64 f1() { return (*_f2)(1); }
|
||
|
|
u64 f2(u64 a) { return f3(a + 1, a); }
|
||
|
|
u64 f3(u64 a, u64 b) { return a - b; }
|
||
|
|
|
||
|
|
GCC can compile f1, f3 into x86_64::
|
||
|
|
|
||
|
|
f1:
|
||
|
|
movl $1, %edi
|
||
|
|
movq _f2(%rip), %rax
|
||
|
|
jmp *%rax
|
||
|
|
f3:
|
||
|
|
movq %rdi, %rax
|
||
|
|
subq %rsi, %rax
|
||
|
|
ret
|
||
|
|
|
||
|
|
Function f2 in eBPF may look like::
|
||
|
|
|
||
|
|
f2:
|
||
|
|
bpf_mov R2, R1
|
||
|
|
bpf_add R1, 1
|
||
|
|
bpf_call f3
|
||
|
|
bpf_exit
|
||
|
|
|
||
|
|
If f2 is JITed and the pointer stored to ``_f2``. The calls f1 -> f2 -> f3 and
|
||
|
|
returns will be seamless. Without JIT, __bpf_prog_run() interpreter needs to
|
||
|
|
be used to call into f2.
|
||
|
|
|
||
|
|
For practical reasons all eBPF programs have only one argument 'ctx' which is
|
||
|
|
already placed into R1 (e.g. on __bpf_prog_run() startup) and the programs
|
||
|
|
can call kernel functions with up to 5 arguments. Calls with 6 or more arguments
|
||
|
|
are currently not supported, but these restrictions can be lifted if necessary
|
||
|
|
in the future.
|
||
|
|
|
||
|
|
On 64-bit architectures all register map to HW registers one to one. For
|
||
|
|
example, x86_64 JIT compiler can map them as ...
|
||
|
|
|
||
|
|
::
|
||
|
|
|
||
|
|
R0 - rax
|
||
|
|
R1 - rdi
|
||
|
|
R2 - rsi
|
||
|
|
R3 - rdx
|
||
|
|
R4 - rcx
|
||
|
|
R5 - r8
|
||
|
|
R6 - rbx
|
||
|
|
R7 - r13
|
||
|
|
R8 - r14
|
||
|
|
R9 - r15
|
||
|
|
R10 - rbp
|
||
|
|
|
||
|
|
... since x86_64 ABI mandates rdi, rsi, rdx, rcx, r8, r9 for argument passing
|
||
|
|
and rbx, r12 - r15 are callee saved.
|
||
|
|
|
||
|
|
Then the following eBPF pseudo-program::
|
||
|
|
|
||
|
|
bpf_mov R6, R1 /* save ctx */
|
||
|
|
bpf_mov R2, 2
|
||
|
|
bpf_mov R3, 3
|
||
|
|
bpf_mov R4, 4
|
||
|
|
bpf_mov R5, 5
|
||
|
|
bpf_call foo
|
||
|
|
bpf_mov R7, R0 /* save foo() return value */
|
||
|
|
bpf_mov R1, R6 /* restore ctx for next call */
|
||
|
|
bpf_mov R2, 6
|
||
|
|
bpf_mov R3, 7
|
||
|
|
bpf_mov R4, 8
|
||
|
|
bpf_mov R5, 9
|
||
|
|
bpf_call bar
|
||
|
|
bpf_add R0, R7
|
||
|
|
bpf_exit
|
||
|
|
|
||
|
|
After JIT to x86_64 may look like::
|
||
|
|
|
||
|
|
push %rbp
|
||
|
|
mov %rsp,%rbp
|
||
|
|
sub $0x228,%rsp
|
||
|
|
mov %rbx,-0x228(%rbp)
|
||
|
|
mov %r13,-0x220(%rbp)
|
||
|
|
mov %rdi,%rbx
|
||
|
|
mov $0x2,%esi
|
||
|
|
mov $0x3,%edx
|
||
|
|
mov $0x4,%ecx
|
||
|
|
mov $0x5,%r8d
|
||
|
|
callq foo
|
||
|
|
mov %rax,%r13
|
||
|
|
mov %rbx,%rdi
|
||
|
|
mov $0x6,%esi
|
||
|
|
mov $0x7,%edx
|
||
|
|
mov $0x8,%ecx
|
||
|
|
mov $0x9,%r8d
|
||
|
|
callq bar
|
||
|
|
add %r13,%rax
|
||
|
|
mov -0x228(%rbp),%rbx
|
||
|
|
mov -0x220(%rbp),%r13
|
||
|
|
leaveq
|
||
|
|
retq
|
||
|
|
|
||
|
|
Which is in this example equivalent in C to::
|
||
|
|
|
||
|
|
u64 bpf_filter(u64 ctx)
|
||
|
|
{
|
||
|
|
return foo(ctx, 2, 3, 4, 5) + bar(ctx, 6, 7, 8, 9);
|
||
|
|
}
|
||
|
|
|
||
|
|
In-kernel functions foo() and bar() with prototype: u64 (*)(u64 arg1, u64
|
||
|
|
arg2, u64 arg3, u64 arg4, u64 arg5); will receive arguments in proper
|
||
|
|
registers and place their return value into ``%rax`` which is R0 in eBPF.
|
||
|
|
Prologue and epilogue are emitted by JIT and are implicit in the
|
||
|
|
interpreter. R0-R5 are scratch registers, so eBPF program needs to preserve
|
||
|
|
them across the calls as defined by calling convention.
|
||
|
|
|
||
|
|
For example the following program is invalid::
|
||
|
|
|
||
|
|
bpf_mov R1, 1
|
||
|
|
bpf_call foo
|
||
|
|
bpf_mov R0, R1
|
||
|
|
bpf_exit
|
||
|
|
|
||
|
|
After the call the registers R1-R5 contain junk values and cannot be read.
|
||
|
|
An in-kernel verifier.rst is used to validate eBPF programs.
|
||
|
|
|
||
|
|
Also in the new design, eBPF is limited to 4096 insns, which means that any
|
||
|
|
program will terminate quickly and will only call a fixed number of kernel
|
||
|
|
functions. Original BPF and eBPF are two operand instructions,
|
||
|
|
which helps to do one-to-one mapping between eBPF insn and x86 insn during JIT.
|
||
|
|
|
||
|
|
The input context pointer for invoking the interpreter function is generic,
|
||
|
|
its content is defined by a specific use case. For seccomp register R1 points
|
||
|
|
to seccomp_data, for converted BPF filters R1 points to a skb.
|
||
|
|
|
||
|
|
A program, that is translated internally consists of the following elements::
|
||
|
|
|
||
|
|
op:16, jt:8, jf:8, k:32 ==> op:8, dst_reg:4, src_reg:4, off:16, imm:32
|
||
|
|
|
||
|
|
So far 87 eBPF instructions were implemented. 8-bit 'op' opcode field
|
||
|
|
has room for new instructions. Some of them may use 16/24/32 byte encoding. New
|
||
|
|
instructions must be multiple of 8 bytes to preserve backward compatibility.
|
||
|
|
|
||
|
|
eBPF is a general purpose RISC instruction set. Not every register and
|
||
|
|
every instruction are used during translation from original BPF to eBPF.
|
||
|
|
For example, socket filters are not using ``exclusive add`` instruction, but
|
||
|
|
tracing filters may do to maintain counters of events, for example. Register R9
|
||
|
|
is not used by socket filters either, but more complex filters may be running
|
||
|
|
out of registers and would have to resort to spill/fill to stack.
|
||
|
|
|
||
|
|
eBPF can be used as a generic assembler for last step performance
|
||
|
|
optimizations, socket filters and seccomp are using it as assembler. Tracing
|
||
|
|
filters may use it as assembler to generate code from kernel. In kernel usage
|
||
|
|
may not be bounded by security considerations, since generated eBPF code
|
||
|
|
may be optimizing internal code path and not being exposed to the user space.
|
||
|
|
Safety of eBPF can come from the verifier.rst. In such use cases as
|
||
|
|
described, it may be used as safe instruction set.
|
||
|
|
|
||
|
|
Just like the original BPF, eBPF runs within a controlled environment,
|
||
|
|
is deterministic and the kernel can easily prove that. The safety of the program
|
||
|
|
can be determined in two steps: first step does depth-first-search to disallow
|
||
|
|
loops and other CFG validation; second step starts from the first insn and
|
||
|
|
descends all possible paths. It simulates execution of every insn and observes
|
||
|
|
the state change of registers and stack.
|
||
|
|
|
||
|
|
opcode encoding
|
||
|
|
===============
|
||
|
|
|
||
|
|
eBPF is reusing most of the opcode encoding from classic to simplify conversion
|
||
|
|
of classic BPF to eBPF.
|
||
|
|
|
||
|
|
For arithmetic and jump instructions the 8-bit 'code' field is divided into three
|
||
|
|
parts::
|
||
|
|
|
||
|
|
+----------------+--------+--------------------+
|
||
|
|
| 4 bits | 1 bit | 3 bits |
|
||
|
|
| operation code | source | instruction class |
|
||
|
|
+----------------+--------+--------------------+
|
||
|
|
(MSB) (LSB)
|
||
|
|
|
||
|
|
Three LSB bits store instruction class which is one of:
|
||
|
|
|
||
|
|
=================== ===============
|
||
|
|
Classic BPF classes eBPF classes
|
||
|
|
=================== ===============
|
||
|
|
BPF_LD 0x00 BPF_LD 0x00
|
||
|
|
BPF_LDX 0x01 BPF_LDX 0x01
|
||
|
|
BPF_ST 0x02 BPF_ST 0x02
|
||
|
|
BPF_STX 0x03 BPF_STX 0x03
|
||
|
|
BPF_ALU 0x04 BPF_ALU 0x04
|
||
|
|
BPF_JMP 0x05 BPF_JMP 0x05
|
||
|
|
BPF_RET 0x06 BPF_JMP32 0x06
|
||
|
|
BPF_MISC 0x07 BPF_ALU64 0x07
|
||
|
|
=================== ===============
|
||
|
|
|
||
|
|
The 4th bit encodes the source operand ...
|
||
|
|
|
||
|
|
::
|
||
|
|
|
||
|
|
BPF_K 0x00
|
||
|
|
BPF_X 0x08
|
||
|
|
|
||
|
|
* in classic BPF, this means::
|
||
|
|
|
||
|
|
BPF_SRC(code) == BPF_X - use register X as source operand
|
||
|
|
BPF_SRC(code) == BPF_K - use 32-bit immediate as source operand
|
||
|
|
|
||
|
|
* in eBPF, this means::
|
||
|
|
|
||
|
|
BPF_SRC(code) == BPF_X - use 'src_reg' register as source operand
|
||
|
|
BPF_SRC(code) == BPF_K - use 32-bit immediate as source operand
|
||
|
|
|
||
|
|
... and four MSB bits store operation code.
|
||
|
|
|
||
|
|
If BPF_CLASS(code) == BPF_ALU or BPF_ALU64 [ in eBPF ], BPF_OP(code) is one of::
|
||
|
|
|
||
|
|
BPF_ADD 0x00
|
||
|
|
BPF_SUB 0x10
|
||
|
|
BPF_MUL 0x20
|
||
|
|
BPF_DIV 0x30
|
||
|
|
BPF_OR 0x40
|
||
|
|
BPF_AND 0x50
|
||
|
|
BPF_LSH 0x60
|
||
|
|
BPF_RSH 0x70
|
||
|
|
BPF_NEG 0x80
|
||
|
|
BPF_MOD 0x90
|
||
|
|
BPF_XOR 0xa0
|
||
|
|
BPF_MOV 0xb0 /* eBPF only: mov reg to reg */
|
||
|
|
BPF_ARSH 0xc0 /* eBPF only: sign extending shift right */
|
||
|
|
BPF_END 0xd0 /* eBPF only: endianness conversion */
|
||
|
|
|
||
|
|
If BPF_CLASS(code) == BPF_JMP or BPF_JMP32 [ in eBPF ], BPF_OP(code) is one of::
|
||
|
|
|
||
|
|
BPF_JA 0x00 /* BPF_JMP only */
|
||
|
|
BPF_JEQ 0x10
|
||
|
|
BPF_JGT 0x20
|
||
|
|
BPF_JGE 0x30
|
||
|
|
BPF_JSET 0x40
|
||
|
|
BPF_JNE 0x50 /* eBPF only: jump != */
|
||
|
|
BPF_JSGT 0x60 /* eBPF only: signed '>' */
|
||
|
|
BPF_JSGE 0x70 /* eBPF only: signed '>=' */
|
||
|
|
BPF_CALL 0x80 /* eBPF BPF_JMP only: function call */
|
||
|
|
BPF_EXIT 0x90 /* eBPF BPF_JMP only: function return */
|
||
|
|
BPF_JLT 0xa0 /* eBPF only: unsigned '<' */
|
||
|
|
BPF_JLE 0xb0 /* eBPF only: unsigned '<=' */
|
||
|
|
BPF_JSLT 0xc0 /* eBPF only: signed '<' */
|
||
|
|
BPF_JSLE 0xd0 /* eBPF only: signed '<=' */
|
||
|
|
|
||
|
|
So BPF_ADD | BPF_X | BPF_ALU means 32-bit addition in both classic BPF
|
||
|
|
and eBPF. There are only two registers in classic BPF, so it means A += X.
|
||
|
|
In eBPF it means dst_reg = (u32) dst_reg + (u32) src_reg; similarly,
|
||
|
|
BPF_XOR | BPF_K | BPF_ALU means A ^= imm32 in classic BPF and analogous
|
||
|
|
src_reg = (u32) src_reg ^ (u32) imm32 in eBPF.
|
||
|
|
|
||
|
|
Classic BPF is using BPF_MISC class to represent A = X and X = A moves.
|
||
|
|
eBPF is using BPF_MOV | BPF_X | BPF_ALU code instead. Since there are no
|
||
|
|
BPF_MISC operations in eBPF, the class 7 is used as BPF_ALU64 to mean
|
||
|
|
exactly the same operations as BPF_ALU, but with 64-bit wide operands
|
||
|
|
instead. So BPF_ADD | BPF_X | BPF_ALU64 means 64-bit addition, i.e.:
|
||
|
|
dst_reg = dst_reg + src_reg
|
||
|
|
|
||
|
|
Classic BPF wastes the whole BPF_RET class to represent a single ``ret``
|
||
|
|
operation. Classic BPF_RET | BPF_K means copy imm32 into return register
|
||
|
|
and perform function exit. eBPF is modeled to match CPU, so BPF_JMP | BPF_EXIT
|
||
|
|
in eBPF means function exit only. The eBPF program needs to store return
|
||
|
|
value into register R0 before doing a BPF_EXIT. Class 6 in eBPF is used as
|
||
|
|
BPF_JMP32 to mean exactly the same operations as BPF_JMP, but with 32-bit wide
|
||
|
|
operands for the comparisons instead.
|
||
|
|
|
||
|
|
For load and store instructions the 8-bit 'code' field is divided as::
|
||
|
|
|
||
|
|
+--------+--------+-------------------+
|
||
|
|
| 3 bits | 2 bits | 3 bits |
|
||
|
|
| mode | size | instruction class |
|
||
|
|
+--------+--------+-------------------+
|
||
|
|
(MSB) (LSB)
|
||
|
|
|
||
|
|
Size modifier is one of ...
|
||
|
|
|
||
|
|
::
|
||
|
|
|
||
|
|
BPF_W 0x00 /* word */
|
||
|
|
BPF_H 0x08 /* half word */
|
||
|
|
BPF_B 0x10 /* byte */
|
||
|
|
BPF_DW 0x18 /* eBPF only, double word */
|
||
|
|
|
||
|
|
... which encodes size of load/store operation::
|
||
|
|
|
||
|
|
B - 1 byte
|
||
|
|
H - 2 byte
|
||
|
|
W - 4 byte
|
||
|
|
DW - 8 byte (eBPF only)
|
||
|
|
|
||
|
|
Mode modifier is one of::
|
||
|
|
|
||
|
|
BPF_IMM 0x00 /* used for 32-bit mov in classic BPF and 64-bit in eBPF */
|
||
|
|
BPF_ABS 0x20
|
||
|
|
BPF_IND 0x40
|
||
|
|
BPF_MEM 0x60
|
||
|
|
BPF_LEN 0x80 /* classic BPF only, reserved in eBPF */
|
||
|
|
BPF_MSH 0xa0 /* classic BPF only, reserved in eBPF */
|
||
|
|
BPF_ATOMIC 0xc0 /* eBPF only, atomic operations */
|