Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(100)

Side by Side Diff: sandbox/linux/seccomp-bpf/codegen.h

Issue 101773003: Linux sandbox: cleanup sandbox-bpf naming. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Address namespace sandbox nits. Created 7 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « sandbox/linux/seccomp-bpf/bpf_tests.h ('k') | sandbox/linux/seccomp-bpf/codegen.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 6 #define SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
7 7
8 #include <map> 8 #include <map>
9 #include <set> 9 #include <set>
10 #include <vector> 10 #include <vector>
11 11
12 #include "sandbox/linux/seccomp-bpf/basicblock.h" 12 #include "sandbox/linux/seccomp-bpf/basicblock.h"
13 #include "sandbox/linux/seccomp-bpf/instruction.h" 13 #include "sandbox/linux/seccomp-bpf/instruction.h"
14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h" 14 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
15 15
16 namespace playground2 { 16 namespace sandbox {
17 17
18 typedef std::vector<Instruction*> Instructions; 18 typedef std::vector<Instruction*> Instructions;
19 typedef std::vector<BasicBlock*> BasicBlocks; 19 typedef std::vector<BasicBlock*> BasicBlocks;
20 typedef std::map<const Instruction*, int> BranchTargets; 20 typedef std::map<const Instruction*, int> BranchTargets;
21 typedef std::map<const Instruction*, BasicBlock*> TargetsToBlocks; 21 typedef std::map<const Instruction*, BasicBlock*> TargetsToBlocks;
22 typedef std::map<const BasicBlock*, int> IncomingBranches; 22 typedef std::map<const BasicBlock*, int> IncomingBranches;
23 23
24 // The code generator instantiates a basic compiler that can convert a 24 // The code generator instantiates a basic compiler that can convert a
25 // graph of BPF instructions into a well-formed stream of BPF instructions. 25 // graph of BPF instructions into a well-formed stream of BPF instructions.
26 // Most notably, it ensures that jumps are always forward and don't exceed 26 // Most notably, it ensures that jumps are always forward and don't exceed
27 // the limit of 255 instructions imposed by the instruction set. 27 // the limit of 255 instructions imposed by the instruction set.
28 // 28 //
29 // Callers would typically create a new CodeGen object and then use it to 29 // Callers would typically create a new CodeGen object and then use it to
30 // build a DAG of Instructions. They'll eventually call Compile() to convert 30 // build a DAG of Instructions. They'll eventually call Compile() to convert
31 // this DAG to a Sandbox::Program. 31 // this DAG to a SandboxBPF::Program.
32 // 32 //
33 // Instructions can be chained at the time when they are created, or they 33 // Instructions can be chained at the time when they are created, or they
34 // can be joined later by calling JoinInstructions(). 34 // can be joined later by calling JoinInstructions().
35 // 35 //
36 // CodeGen gen; 36 // CodeGen gen;
37 // Instruction *dag, *branch; 37 // Instruction *dag, *branch;
38 // dag = 38 // dag =
39 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS, 39 // gen.MakeInstruction(BPF_LD+BPF_W+BPF_ABS,
40 // offsetof(struct arch_seccomp_data, nr), 40 // offsetof(struct arch_seccomp_data, nr),
41 // branch = 41 // branch =
42 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid, 42 // gen.MakeInstruction(BPF_JMP+BPF_EQ+BPF_K, __NR_getpid,
43 // Trap(GetPidHandler, NULL), NULL); 43 // Trap(GetPidHandler, NULL), NULL);
44 // gen.JoinInstructions(branch, 44 // gen.JoinInstructions(branch,
45 // gen.MakeInstruction(BPF_RET+BPF_K, ErrorCode(ErrorCode::ERR_ALLOWED))); 45 // gen.MakeInstruction(BPF_RET+BPF_K, ErrorCode(ErrorCode::ERR_ALLOWED)));
46 // 46 //
47 // // Simplified code follows; in practice, it is important to avoid calling 47 // // Simplified code follows; in practice, it is important to avoid calling
48 // // any C++ destructors after starting the sandbox. 48 // // any C++ destructors after starting the sandbox.
49 // Sandbox::Program program; 49 // SandboxBPF::Program program;
50 // gen.Compile(dag, program); 50 // gen.Compile(dag, program);
51 // const struct sock_fprog prog = { 51 // const struct sock_fprog prog = {
52 // static_cast<unsigned short>(program->size()), &program[0] }; 52 // static_cast<unsigned short>(program->size()), &program[0] };
53 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); 53 // prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
54 // 54 //
55 class CodeGen { 55 class CodeGen {
56 public: 56 public:
57 CodeGen(); 57 CodeGen();
58 ~CodeGen(); 58 ~CodeGen();
59 59
60 // This is a helper method that can be used for debugging purposes. It is 60 // This is a helper method that can be used for debugging purposes. It is
61 // not normally called. 61 // not normally called.
62 static void PrintProgram(const Sandbox::Program& program); 62 static void PrintProgram(const SandboxBPF::Program& program);
63 63
64 // Create a new instruction. Instructions form a DAG. The instruction objects 64 // Create a new instruction. Instructions form a DAG. The instruction objects
65 // are owned by the CodeGen object. They do not need to be explicitly 65 // are owned by the CodeGen object. They do not need to be explicitly
66 // deleted. 66 // deleted.
67 // For details on the possible parameters refer to <linux/filter.h> 67 // For details on the possible parameters refer to <linux/filter.h>
68 Instruction* MakeInstruction(uint16_t code, 68 Instruction* MakeInstruction(uint16_t code,
69 uint32_t k, 69 uint32_t k,
70 Instruction* next = NULL); 70 Instruction* next = NULL);
71 Instruction* MakeInstruction(uint16_t code, const ErrorCode& err); 71 Instruction* MakeInstruction(uint16_t code, const ErrorCode& err);
72 Instruction* MakeInstruction(uint16_t code, 72 Instruction* MakeInstruction(uint16_t code,
(...skipping 10 matching lines...) Expand all
83 // Traversal order is implementation-defined. It is acceptable to make 83 // Traversal order is implementation-defined. It is acceptable to make
84 // changes to the graph from within the callback function. These changes 84 // changes to the graph from within the callback function. These changes
85 // do not affect traversal. 85 // do not affect traversal.
86 // The "fnc" function gets called with both the instruction and the opaque 86 // The "fnc" function gets called with both the instruction and the opaque
87 // "aux" pointer. 87 // "aux" pointer.
88 void Traverse(Instruction*, void (*fnc)(Instruction*, void* aux), void* aux); 88 void Traverse(Instruction*, void (*fnc)(Instruction*, void* aux), void* aux);
89 89
90 // Compiles the graph of instructions into a BPF program that can be passed 90 // Compiles the graph of instructions into a BPF program that can be passed
91 // to the kernel. Please note that this function modifies the graph in place 91 // to the kernel. Please note that this function modifies the graph in place
92 // and must therefore only be called once per graph. 92 // and must therefore only be called once per graph.
93 void Compile(Instruction* instructions, Sandbox::Program* program); 93 void Compile(Instruction* instructions, SandboxBPF::Program* program);
94 94
95 private: 95 private:
96 friend class CodeGenUnittestHelper; 96 friend class CodeGenUnittestHelper;
97 97
98 // Find all the instructions that are the target of BPF_JMPs. 98 // Find all the instructions that are the target of BPF_JMPs.
99 void FindBranchTargets(const Instruction& instructions, 99 void FindBranchTargets(const Instruction& instructions,
100 BranchTargets* branch_targets); 100 BranchTargets* branch_targets);
101 101
102 // Combine instructions between "head" and "tail" into a new basic block. 102 // Combine instructions between "head" and "tail" into a new basic block.
103 // Basic blocks are defined as sequences of instructions whose only branch 103 // Basic blocks are defined as sequences of instructions whose only branch
(...skipping 29 matching lines...) Expand all
133 BasicBlocks* basic_blocks); 133 BasicBlocks* basic_blocks);
134 134
135 // Convert jt_ptr_ and jf_ptr_ fields in BPF_JMP instructions to valid 135 // Convert jt_ptr_ and jf_ptr_ fields in BPF_JMP instructions to valid
136 // jt_ and jf_ jump offsets. This can result in BPF_JA instructions being 136 // jt_ and jf_ jump offsets. This can result in BPF_JA instructions being
137 // inserted, if we need to jump over more than 256 instructions. 137 // inserted, if we need to jump over more than 256 instructions.
138 void ComputeRelativeJumps(BasicBlocks* basic_blocks, 138 void ComputeRelativeJumps(BasicBlocks* basic_blocks,
139 const TargetsToBlocks& targets_to_blocks); 139 const TargetsToBlocks& targets_to_blocks);
140 140
141 // Concatenate instructions from all basic blocks into a BPF program that 141 // Concatenate instructions from all basic blocks into a BPF program that
142 // can be passed to the kernel. 142 // can be passed to the kernel.
143 void ConcatenateBasicBlocks(const BasicBlocks&, Sandbox::Program* program); 143 void ConcatenateBasicBlocks(const BasicBlocks&, SandboxBPF::Program* program);
144 144
145 // We stick all instructions and basic blocks into pools that get destroyed 145 // We stick all instructions and basic blocks into pools that get destroyed
146 // when the CodeGen object is destroyed. This way, we neither need to worry 146 // when the CodeGen object is destroyed. This way, we neither need to worry
147 // about explicitly managing ownership, nor do we need to worry about using 147 // about explicitly managing ownership, nor do we need to worry about using
148 // smart pointers in the presence of circular references. 148 // smart pointers in the presence of circular references.
149 Instructions instructions_; 149 Instructions instructions_;
150 BasicBlocks basic_blocks_; 150 BasicBlocks basic_blocks_;
151 151
152 // Compile() must only ever be called once as it makes destructive changes 152 // Compile() must only ever be called once as it makes destructive changes
153 // to the DAG. 153 // to the DAG.
154 bool compiled_; 154 bool compiled_;
155 }; 155 };
156 156
157 } // namespace 157 } // namespace sandbox
158 158
159 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__ 159 #endif // SANDBOX_LINUX_SECCOMP_BPF_CODEGEN_H__
OLDNEW
« no previous file with comments | « sandbox/linux/seccomp-bpf/bpf_tests.h ('k') | sandbox/linux/seccomp-bpf/codegen.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698