Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(703)

Side by Side Diff: sandbox/linux/seccomp-bpf/codegen.h

Issue 565713004: Linux sandbox: Remove CodeGen::JoinInstructions. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Rebase Created 6 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | sandbox/linux/seccomp-bpf/codegen.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
7 7
8 #include <map> 8 #include <map>
9 #include <vector> 9 #include <vector>
10 10
(...skipping 12 matching lines...) Expand all
23 23
24 // The code generator instantiates a basic compiler that can convert a 24 // The code generator instantiates a basic compiler that can convert a
25 // graph of BPF instructions into a well-formed stream of BPF instructions. 25 // graph of BPF instructions into a well-formed stream of BPF instructions.
26 // Most notably, it ensures that jumps are always forward and don't exceed 26 // Most notably, it ensures that jumps are always forward and don't exceed
27 // the limit of 255 instructions imposed by the instruction set. 27 // the limit of 255 instructions imposed by the instruction set.
28 // 28 //
29 // Callers would typically create a new CodeGen object and then use it to 29 // Callers would typically create a new CodeGen object and then use it to
30 // build a DAG of Instructions. They'll eventually call Compile() to convert 30 // build a DAG of Instructions. They'll eventually call Compile() to convert
31 // this DAG to a SandboxBPF::Program. 31 // this DAG to a SandboxBPF::Program.
32 // 32 //
33 // Instructions can be chained at the time when they are created, or they 33 // CodeGen gen;
34 // can be joined later by calling JoinInstructions(). 34 // Instruction *allow, *branch, *dag;
35 // 35 //
36 // CodeGen gen; 36 // allow =
37 // Instruction *dag, *branch; 37 // gen.MakeInstruction(BPF_RET+BPF_K,
38 // ErrorCode(ErrorCode::ERR_ALLOWED).err()));
39 // branch =
40 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid,
41 // Trap(GetPidHandler, NULL), allow);
38 // dag = 42 // dag =
39 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS, 43 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS,
40 // offsetof(struct arch_seccomp_data, nr), 44 // offsetof(struct arch_seccomp_data, nr), branch);
41 // branch =
42 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid,
43 // Trap(GetPidHandler, NULL), NULL);
44 // gen.JoinInstructions(branch,
45 // gen.MakeInstruction(BPF_RET+BPF_K,
46 // ErrorCode(ErrorCode::ERR_ALLOWED).err()));
47 // 45 //
48 // // Simplified code follows; in practice, it is important to avoid calling 46 // // Simplified code follows; in practice, it is important to avoid calling
49 // // any C++ destructors after starting the sandbox. 47 // // any C++ destructors after starting the sandbox.
50 // SandboxBPF::Program program; 48 // SandboxBPF::Program program;
51 // gen.Compile(dag, program); 49 // gen.Compile(dag, program);
52 // const struct sock_fprog prog = { 50 // const struct sock_fprog prog = {
53 // static_cast<unsigned short>(program->size()), &program[0] }; 51 // static_cast<unsigned short>(program->size()), &program[0] };
54 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 52 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
55 // 53 //
56 class SANDBOX_EXPORT CodeGen { 54 class SANDBOX_EXPORT CodeGen {
(...skipping 10 matching lines...) Expand all
67 // deleted. 65 // deleted.
68 // For details on the possible parameters refer to <linux/filter.h> 66 // For details on the possible parameters refer to <linux/filter.h>
69 Instruction* MakeInstruction(uint16_t code, 67 Instruction* MakeInstruction(uint16_t code,
70 uint32_t k, 68 uint32_t k,
71 Instruction* next = NULL); 69 Instruction* next = NULL);
72 Instruction* MakeInstruction(uint16_t code, 70 Instruction* MakeInstruction(uint16_t code,
73 uint32_t k, 71 uint32_t k,
74 Instruction* jt, 72 Instruction* jt,
75 Instruction* jf); 73 Instruction* jf);
76 74
77 // Join two (sequences of) instructions. This is useful, if the "next"
78 // parameter had not originally been given in the call to MakeInstruction(),
79 // or if a (conditional) jump still has an unsatisfied target.
80 void JoinInstructions(Instruction* head, Instruction* tail);
81
82 // Traverse the graph of instructions and visit each instruction once. 75 // Traverse the graph of instructions and visit each instruction once.
83 // Traversal order is implementation-defined. It is acceptable to make 76 // Traversal order is implementation-defined. It is acceptable to make
84 // changes to the graph from within the callback function. These changes 77 // changes to the graph from within the callback function. These changes
85 // do not affect traversal. 78 // do not affect traversal.
86 // The "fnc" function gets called with both the instruction and the opaque 79 // The "fnc" function gets called with both the instruction and the opaque
87 // "aux" pointer. 80 // "aux" pointer.
88 void Traverse(Instruction*, void (*fnc)(Instruction*, void* aux), void* aux); 81 void Traverse(Instruction*, void (*fnc)(Instruction*, void* aux), void* aux);
89 82
90 // Compiles the graph of instructions into a BPF program that can be passed 83 // Compiles the graph of instructions into a BPF program that can be passed
91 // to the kernel. Please note that this function modifies the graph in place 84 // to the kernel. Please note that this function modifies the graph in place
(...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after
150 BasicBlocks basic_blocks_; 143 BasicBlocks basic_blocks_;
151 144
152 // Compile() must only ever be called once as it makes destructive changes 145 // Compile() must only ever be called once as it makes destructive changes
153 // to the DAG. 146 // to the DAG.
154 bool compiled_; 147 bool compiled_;
155 }; 148 };
156 149
157 } // namespace sandbox 150 } // namespace sandbox
158 151
159 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 152 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
OLDNEW
« no previous file with comments | « no previous file | sandbox/linux/seccomp-bpf/codegen.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698