blob: e4897e281f7e3df42d7b10f3aab0c4997942a88f [file] [log] [blame]
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -07001/* bpf.h
2 * Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
3 * Use of this source code is governed by a BSD-style license that can be
4 * found in the LICENSE file.
5 *
6 * Berkeley Packet Filter functions.
7 */
8
9#ifndef BPF_H
10#define BPF_H
11
12#include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
Samuel Tan68db15c2015-10-09 14:13:05 -070013#include <endian.h>
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -070014#include <linux/audit.h>
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070015#include <linux/filter.h>
16#include <stddef.h>
17#include <sys/user.h>
18
Jorge Lucangeli Obesa67bd6a2016-08-19 15:33:48 -040019#ifdef __cplusplus
20extern "C" {
21#endif
22
Jorge Lucangeli Obes8b488a52014-09-26 14:40:37 -070023#include "arch.h"
24
Jorge Lucangeli Obes8a56ec22013-02-04 10:03:43 -080025#if __BITS_PER_LONG == 32 || defined(__ILP32__)
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070026#define BITS32
27#elif __BITS_PER_LONG == 64
28#define BITS64
29#endif
30
31/* Constants for comparison operators. */
32#define MIN_OPERATOR 128
Jorge Lucangeli Obesa67bd6a2016-08-19 15:33:48 -040033enum {
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070034 EQ = MIN_OPERATOR,
35 NE,
36 LT,
37 LE,
38 GT,
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080039 GE,
40 SET
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070041};
42
43/*
44 * BPF return values and data structures,
45 * since they're not yet in the kernel.
46 */
47#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
48#define SECCOMP_RET_TRAP 0x00030000U /* return SIGSYS */
49#define SECCOMP_RET_ERRNO 0x00050000U /* return -1 and set errno */
50#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
51
52#define SECCOMP_RET_DATA 0x0000ffffU /* mask for return value */
53
54struct seccomp_data {
55 int nr;
56 __u32 arch;
57 __u64 instruction_pointer;
58 __u64 args[6];
59};
60
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -070061#define syscall_nr (offsetof(struct seccomp_data, nr))
62#define arch_nr (offsetof(struct seccomp_data, arch))
63
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070064/* Size-dependent defines. */
65#if defined(BITS32)
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080066/*
67 * On 32 bits, comparisons take 2 instructions: 1 for loading the argument,
68 * 1 for the actual comparison.
69 */
70#define BPF_LOAD_ARG_LEN 1U
71#define BPF_COMP_LEN 1U
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070072#define BPF_ARG_COMP_LEN (BPF_LOAD_ARG_LEN + BPF_COMP_LEN)
73
74#define bpf_comp_jeq bpf_comp_jeq32
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080075#define bpf_comp_jset bpf_comp_jset32
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070076
77#define LO_ARG(idx) offsetof(struct seccomp_data, args[(idx)])
78
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080079#elif defined(BITS64)
80/*
81 * On 64 bits, comparisons take 7 instructions: 4 for loading the argument,
82 * and 3 for the actual comparison.
83 */
84#define BPF_LOAD_ARG_LEN 4U
85#define BPF_COMP_LEN 3U
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070086#define BPF_ARG_COMP_LEN (BPF_LOAD_ARG_LEN + BPF_COMP_LEN)
87
88#define bpf_comp_jeq bpf_comp_jeq64
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080089#define bpf_comp_jset bpf_comp_jset64
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070090
91/* Ensure that we load the logically correct offset. */
Samuel Tan68db15c2015-10-09 14:13:05 -070092#if defined(__LITTLE_ENDIAN__) || __BYTE_ORDER == __LITTLE_ENDIAN
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070093#define LO_ARG(idx) offsetof(struct seccomp_data, args[(idx)])
94#define HI_ARG(idx) offsetof(struct seccomp_data, args[(idx)]) + sizeof(__u32)
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070095#else
Jorge Lucangeli Obesa21c8fc2015-07-15 16:22:34 -070096#error "Unsupported endianness"
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070097#endif
98
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -080099#else
100#error "Unknown bit width"
101
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700102#endif
103
104/* Common jump targets. */
105#define NEXT 0
106#define SKIP 1
107#define SKIPN(_n) (_n)
108
109/* Support for labels in BPF programs. */
110#define JUMP_JT 0xff
111#define JUMP_JF 0xff
112#define LABEL_JT 0xfe
113#define LABEL_JF 0xfe
114
115#define MAX_BPF_LABEL_LEN 32
116
117#define BPF_LABELS_MAX 256
118struct bpf_labels {
119 int count;
120 struct __bpf_label {
121 const char *label;
122 unsigned int location;
123 } labels[BPF_LABELS_MAX];
124};
125
126/* BPF instruction manipulation functions and macros. */
Yunlian Jiang02d06542013-09-25 15:52:13 -0700127static inline size_t set_bpf_instr(struct sock_filter *instr,
Jorge Lucangeli Obesa67bd6a2016-08-19 15:33:48 -0400128 unsigned short code, unsigned int k,
129 unsigned char jt, unsigned char jf)
Yunlian Jiang02d06542013-09-25 15:52:13 -0700130{
131 instr->code = code;
132 instr->k = k;
133 instr->jt = jt;
134 instr->jf = jf;
135 return 1U;
136}
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700137
138#define set_bpf_stmt(_block, _code, _k) \
139 set_bpf_instr((_block), (_code), (_k), 0, 0)
140
141#define set_bpf_jump(_block, _code, _k, _jt, _jf) \
142 set_bpf_instr((_block), (_code), (_k), (_jt), (_jf))
143
144#define set_bpf_lbl(_block, _lbl_id) \
145 set_bpf_jump((_block), BPF_JMP+BPF_JA, (_lbl_id), \
146 LABEL_JT, LABEL_JF)
147
148#define set_bpf_jump_lbl(_block, _lbl_id) \
149 set_bpf_jump((_block), BPF_JMP+BPF_JA, (_lbl_id), \
150 JUMP_JT, JUMP_JF)
151
152#define set_bpf_ret_kill(_block) \
153 set_bpf_stmt((_block), BPF_RET+BPF_K, SECCOMP_RET_KILL)
154
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700155#define set_bpf_ret_trap(_block) \
156 set_bpf_stmt((_block), BPF_RET+BPF_K, SECCOMP_RET_TRAP)
157
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700158#define set_bpf_ret_errno(_block, _errno) \
159 set_bpf_stmt((_block), BPF_RET+BPF_K, \
160 SECCOMP_RET_ERRNO | ((_errno) & SECCOMP_RET_DATA))
161
162#define set_bpf_ret_allow(_block) \
163 set_bpf_stmt((_block), BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
164
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700165#define bpf_load_syscall_nr(_filter) \
166 set_bpf_stmt((_filter), BPF_LD+BPF_W+BPF_ABS, syscall_nr)
167
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700168/* BPF label functions. */
169int bpf_resolve_jumps(struct bpf_labels *labels,
170 struct sock_filter *filter, size_t count);
171int bpf_label_id(struct bpf_labels *labels, const char *label);
172void free_label_strings(struct bpf_labels *labels);
173
174/* BPF helper functions. */
175size_t bpf_load_arg(struct sock_filter *filter, int argidx);
176size_t bpf_comp_jeq(struct sock_filter *filter, unsigned long c,
177 unsigned char jt, unsigned char jf);
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -0800178size_t bpf_comp_jset(struct sock_filter *filter, unsigned long mask,
179 unsigned char jt, unsigned char jf);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700180
181/* Functions called by syscall_filter.c */
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700182#define ARCH_VALIDATION_LEN 3U
183#define ALLOW_SYSCALL_LEN 2U
184
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700185size_t bpf_arg_comp(struct sock_filter **pfilter,
186 int op, int argidx, unsigned long c, unsigned int label_id);
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700187size_t bpf_validate_arch(struct sock_filter *filter);
188size_t bpf_allow_syscall(struct sock_filter *filter, int nr);
189size_t bpf_allow_syscall_args(struct sock_filter *filter,
190 int nr, unsigned int id);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700191
Jorge Lucangeli Obesffec8912012-11-30 14:46:23 -0800192/* Debug functions. */
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700193void dump_bpf_prog(struct sock_fprog *fprog);
194void dump_bpf_filter(struct sock_filter *filter, unsigned short len);
195
Jorge Lucangeli Obesa67bd6a2016-08-19 15:33:48 -0400196#ifdef __cplusplus
197}; /* extern "C" */
198#endif
199
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700200#endif /* BPF_H */