OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ | 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ |
6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ | 6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" | 11 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" |
12 #include "sandbox/sandbox_export.h" | 12 #include "sandbox/sandbox_export.h" |
13 | 13 |
14 namespace sandbox { | 14 namespace sandbox { |
15 struct BasicBlock; | 15 struct BasicBlock; |
16 class ErrorCode; | |
17 struct Instruction; | 16 struct Instruction; |
18 | 17 |
19 typedef std::vector<Instruction*> Instructions; | 18 typedef std::vector<Instruction*> Instructions; |
20 typedef std::vector<BasicBlock*> BasicBlocks; | 19 typedef std::vector<BasicBlock*> BasicBlocks; |
21 typedef std::map<const Instruction*, int> BranchTargets; | 20 typedef std::map<const Instruction*, int> BranchTargets; |
22 typedef std::map<const Instruction*, BasicBlock*> TargetsToBlocks; | 21 typedef std::map<const Instruction*, BasicBlock*> TargetsToBlocks; |
23 typedef std::map<const BasicBlock*, int> IncomingBranches; | 22 typedef std::map<const BasicBlock*, int> IncomingBranches; |
24 | 23 |
25 // The code generator instantiates a basic compiler that can convert a | 24 // The code generator instantiates a basic compiler that can convert a |
26 // graph of BPF instructions into a well-formed stream of BPF instructions. | 25 // graph of BPF instructions into a well-formed stream of BPF instructions. |
27 // Most notably, it ensures that jumps are always forward and don't exceed | 26 // Most notably, it ensures that jumps are always forward and don't exceed |
28 // the limit of 255 instructions imposed by the instruction set. | 27 // the limit of 255 instructions imposed by the instruction set. |
29 // | 28 // |
30 // Callers would typically create a new CodeGen object and then use it to | 29 // Callers would typically create a new CodeGen object and then use it to |
31 // build a DAG of Instructions. They'll eventually call Compile() to convert | 30 // build a DAG of Instructions. They'll eventually call Compile() to convert |
32 // this DAG to a SandboxBPF::Program. | 31 // this DAG to a SandboxBPF::Program. |
33 // | 32 // |
34 // Instructions can be chained at the time when they are created, or they | 33 // Instructions can be chained at the time when they are created, or they |
35 // can be joined later by calling JoinInstructions(). | 34 // can be joined later by calling JoinInstructions(). |
36 // | 35 // |
37 // CodeGen gen; | 36 // CodeGen gen; |
38 // Instruction *dag, *branch; | 37 // Instruction *dag, *branch; |
39 // dag = | 38 // dag = |
40 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS, | 39 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS, |
41 // offsetof(struct arch_seccomp_data, nr), | 40 // offsetof(struct arch_seccomp_data, nr), |
42 // branch = | 41 // branch = |
43 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid, | 42 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid, |
44 // Trap(GetPidHandler, NULL), NULL); | 43 // Trap(GetPidHandler, NULL), NULL); |
45 // gen.JoinInstructions(branch, | 44 // gen.JoinInstructions(branch, |
46 // gen.MakeInstruction(BPF_RET+BPF_K, ErrorCode(ErrorCode::ERR_ALLOWED))); | 45 // gen.MakeInstruction(BPF_RET+BPF_K, |
| 46 // ErrorCode(ErrorCode::ERR_ALLOWED).err())); |
47 // | 47 // |
48 // // Simplified code follows; in practice, it is important to avoid calling | 48 // // Simplified code follows; in practice, it is important to avoid calling |
49 // // any C++ destructors after starting the sandbox. | 49 // // any C++ destructors after starting the sandbox. |
50 // SandboxBPF::Program program; | 50 // SandboxBPF::Program program; |
51 // gen.Compile(dag, program); | 51 // gen.Compile(dag, program); |
52 // const struct sock_fprog prog = { | 52 // const struct sock_fprog prog = { |
53 // static_cast<unsigned short>(program->size()), &program[0] }; | 53 // static_cast<unsigned short>(program->size()), &program[0] }; |
54 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); | 54 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); |
55 // | 55 // |
56 class SANDBOX_EXPORT CodeGen { | 56 class SANDBOX_EXPORT CodeGen { |
57 public: | 57 public: |
58 CodeGen(); | 58 CodeGen(); |
59 ~CodeGen(); | 59 ~CodeGen(); |
60 | 60 |
61 // This is a helper method that can be used for debugging purposes. It is | 61 // This is a helper method that can be used for debugging purposes. It is |
62 // not normally called. | 62 // not normally called. |
63 static void PrintProgram(const SandboxBPF::Program& program); | 63 static void PrintProgram(const SandboxBPF::Program& program); |
64 | 64 |
65 // Create a new instruction. Instructions form a DAG. The instruction objects | 65 // Create a new instruction. Instructions form a DAG. The instruction objects |
66 // are owned by the CodeGen object. They do not need to be explicitly | 66 // are owned by the CodeGen object. They do not need to be explicitly |
67 // deleted. | 67 // deleted. |
68 // For details on the possible parameters refer to <linux/filter.h> | 68 // For details on the possible parameters refer to <linux/filter.h> |
69 Instruction* MakeInstruction(uint16_t code, | 69 Instruction* MakeInstruction(uint16_t code, |
70 uint32_t k, | 70 uint32_t k, |
71 Instruction* next = NULL); | 71 Instruction* next = NULL); |
72 Instruction* MakeInstruction(uint16_t code, const ErrorCode& err); | |
73 Instruction* MakeInstruction(uint16_t code, | 72 Instruction* MakeInstruction(uint16_t code, |
74 uint32_t k, | 73 uint32_t k, |
75 Instruction* jt, | 74 Instruction* jt, |
76 Instruction* jf); | 75 Instruction* jf); |
77 | 76 |
78 // Join two (sequences of) instructions. This is useful, if the "next" | 77 // Join two (sequences of) instructions. This is useful, if the "next" |
79 // parameter had not originally been given in the call to MakeInstruction(), | 78 // parameter had not originally been given in the call to MakeInstruction(), |
80 // or if a (conditional) jump still has an unsatisfied target. | 79 // or if a (conditional) jump still has an unsatisfied target. |
81 void JoinInstructions(Instruction* head, Instruction* tail); | 80 void JoinInstructions(Instruction* head, Instruction* tail); |
82 | 81 |
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
151 BasicBlocks basic_blocks_; | 150 BasicBlocks basic_blocks_; |
152 | 151 |
153 // Compile() must only ever be called once as it makes destructive changes | 152 // Compile() must only ever be called once as it makes destructive changes |
154 // to the DAG. | 153 // to the DAG. |
155 bool compiled_; | 154 bool compiled_; |
156 }; | 155 }; |
157 | 156 |
158 } // namespace sandbox | 157 } // namespace sandbox |
159 | 158 |
160 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ | 159 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ |
OLD | NEW |