1
2
3
4
5 #ifndef __TOOLS_LINUX_FILTER_H
6 #define __TOOLS_LINUX_FILTER_H
7
8 #include <linux/bpf.h>
9
10
11
12
13
14 #define BPF_REG_ARG1 BPF_REG_1
15 #define BPF_REG_ARG2 BPF_REG_2
16 #define BPF_REG_ARG3 BPF_REG_3
17 #define BPF_REG_ARG4 BPF_REG_4
18 #define BPF_REG_ARG5 BPF_REG_5
19 #define BPF_REG_CTX BPF_REG_6
20 #define BPF_REG_FP BPF_REG_10
21
22
23 #define BPF_REG_A BPF_REG_0
24 #define BPF_REG_X BPF_REG_7
25 #define BPF_REG_TMP BPF_REG_8
26
27
28 #define MAX_BPF_STACK 512
29
30
31
32
33
34 #define BPF_ALU64_REG(OP, DST, SRC) \
35 ((struct bpf_insn) { \
36 .code = BPF_ALU64 | BPF_OP(OP) | BPF_X, \
37 .dst_reg = DST, \
38 .src_reg = SRC, \
39 .off = 0, \
40 .imm = 0 })
41
42 #define BPF_ALU32_REG(OP, DST, SRC) \
43 ((struct bpf_insn) { \
44 .code = BPF_ALU | BPF_OP(OP) | BPF_X, \
45 .dst_reg = DST, \
46 .src_reg = SRC, \
47 .off = 0, \
48 .imm = 0 })
49
50
51
52 #define BPF_ALU64_IMM(OP, DST, IMM) \
53 ((struct bpf_insn) { \
54 .code = BPF_ALU64 | BPF_OP(OP) | BPF_K, \
55 .dst_reg = DST, \
56 .src_reg = 0, \
57 .off = 0, \
58 .imm = IMM })
59
60 #define BPF_ALU32_IMM(OP, DST, IMM) \
61 ((struct bpf_insn) { \
62 .code = BPF_ALU | BPF_OP(OP) | BPF_K, \
63 .dst_reg = DST, \
64 .src_reg = 0, \
65 .off = 0, \
66 .imm = IMM })
67
68
69
70 #define BPF_ENDIAN(TYPE, DST, LEN) \
71 ((struct bpf_insn) { \
72 .code = BPF_ALU | BPF_END | BPF_SRC(TYPE), \
73 .dst_reg = DST, \
74 .src_reg = 0, \
75 .off = 0, \
76 .imm = LEN })
77
78
79
80 #define BPF_MOV64_REG(DST, SRC) \
81 ((struct bpf_insn) { \
82 .code = BPF_ALU64 | BPF_MOV | BPF_X, \
83 .dst_reg = DST, \
84 .src_reg = SRC, \
85 .off = 0, \
86 .imm = 0 })
87
88 #define BPF_MOV32_REG(DST, SRC) \
89 ((struct bpf_insn) { \
90 .code = BPF_ALU | BPF_MOV | BPF_X, \
91 .dst_reg = DST, \
92 .src_reg = SRC, \
93 .off = 0, \
94 .imm = 0 })
95
96
97
98 #define BPF_MOV64_IMM(DST, IMM) \
99 ((struct bpf_insn) { \
100 .code = BPF_ALU64 | BPF_MOV | BPF_K, \
101 .dst_reg = DST, \
102 .src_reg = 0, \
103 .off = 0, \
104 .imm = IMM })
105
106 #define BPF_MOV32_IMM(DST, IMM) \
107 ((struct bpf_insn) { \
108 .code = BPF_ALU | BPF_MOV | BPF_K, \
109 .dst_reg = DST, \
110 .src_reg = 0, \
111 .off = 0, \
112 .imm = IMM })
113
114
115
116 #define BPF_MOV64_RAW(TYPE, DST, SRC, IMM) \
117 ((struct bpf_insn) { \
118 .code = BPF_ALU64 | BPF_MOV | BPF_SRC(TYPE), \
119 .dst_reg = DST, \
120 .src_reg = SRC, \
121 .off = 0, \
122 .imm = IMM })
123
124 #define BPF_MOV32_RAW(TYPE, DST, SRC, IMM) \
125 ((struct bpf_insn) { \
126 .code = BPF_ALU | BPF_MOV | BPF_SRC(TYPE), \
127 .dst_reg = DST, \
128 .src_reg = SRC, \
129 .off = 0, \
130 .imm = IMM })
131
132
133
134 #define BPF_LD_ABS(SIZE, IMM) \
135 ((struct bpf_insn) { \
136 .code = BPF_LD | BPF_SIZE(SIZE) | BPF_ABS, \
137 .dst_reg = 0, \
138 .src_reg = 0, \
139 .off = 0, \
140 .imm = IMM })
141
142
143
144 #define BPF_LD_IND(SIZE, SRC, IMM) \
145 ((struct bpf_insn) { \
146 .code = BPF_LD | BPF_SIZE(SIZE) | BPF_IND, \
147 .dst_reg = 0, \
148 .src_reg = SRC, \
149 .off = 0, \
150 .imm = IMM })
151
152
153
154 #define BPF_LDX_MEM(SIZE, DST, SRC, OFF) \
155 ((struct bpf_insn) { \
156 .code = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM, \
157 .dst_reg = DST, \
158 .src_reg = SRC, \
159 .off = OFF, \
160 .imm = 0 })
161
162
163
164 #define BPF_STX_MEM(SIZE, DST, SRC, OFF) \
165 ((struct bpf_insn) { \
166 .code = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM, \
167 .dst_reg = DST, \
168 .src_reg = SRC, \
169 .off = OFF, \
170 .imm = 0 })
171
172
173
174 #define BPF_STX_XADD(SIZE, DST, SRC, OFF) \
175 ((struct bpf_insn) { \
176 .code = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD, \
177 .dst_reg = DST, \
178 .src_reg = SRC, \
179 .off = OFF, \
180 .imm = 0 })
181
182
183
184 #define BPF_ST_MEM(SIZE, DST, OFF, IMM) \
185 ((struct bpf_insn) { \
186 .code = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM, \
187 .dst_reg = DST, \
188 .src_reg = 0, \
189 .off = OFF, \
190 .imm = IMM })
191
192
193
194 #define BPF_JMP_REG(OP, DST, SRC, OFF) \
195 ((struct bpf_insn) { \
196 .code = BPF_JMP | BPF_OP(OP) | BPF_X, \
197 .dst_reg = DST, \
198 .src_reg = SRC, \
199 .off = OFF, \
200 .imm = 0 })
201
202
203
204 #define BPF_JMP32_REG(OP, DST, SRC, OFF) \
205 ((struct bpf_insn) { \
206 .code = BPF_JMP32 | BPF_OP(OP) | BPF_X, \
207 .dst_reg = DST, \
208 .src_reg = SRC, \
209 .off = OFF, \
210 .imm = 0 })
211
212
213
214 #define BPF_JMP_IMM(OP, DST, IMM, OFF) \
215 ((struct bpf_insn) { \
216 .code = BPF_JMP | BPF_OP(OP) | BPF_K, \
217 .dst_reg = DST, \
218 .src_reg = 0, \
219 .off = OFF, \
220 .imm = IMM })
221
222
223
224 #define BPF_JMP32_IMM(OP, DST, IMM, OFF) \
225 ((struct bpf_insn) { \
226 .code = BPF_JMP32 | BPF_OP(OP) | BPF_K, \
227 .dst_reg = DST, \
228 .src_reg = 0, \
229 .off = OFF, \
230 .imm = IMM })
231
232
233
234 #define BPF_JMP_A(OFF) \
235 ((struct bpf_insn) { \
236 .code = BPF_JMP | BPF_JA, \
237 .dst_reg = 0, \
238 .src_reg = 0, \
239 .off = OFF, \
240 .imm = 0 })
241
242
243
244 #define BPF_EMIT_CALL(FUNC) \
245 ((struct bpf_insn) { \
246 .code = BPF_JMP | BPF_CALL, \
247 .dst_reg = 0, \
248 .src_reg = 0, \
249 .off = 0, \
250 .imm = ((FUNC) - BPF_FUNC_unspec) })
251
252
253
254 #define BPF_RAW_INSN(CODE, DST, SRC, OFF, IMM) \
255 ((struct bpf_insn) { \
256 .code = CODE, \
257 .dst_reg = DST, \
258 .src_reg = SRC, \
259 .off = OFF, \
260 .imm = IMM })
261
262
263
264 #define BPF_LD_IMM64(DST, IMM) \
265 BPF_LD_IMM64_RAW(DST, 0, IMM)
266
267 #define BPF_LD_IMM64_RAW(DST, SRC, IMM) \
268 ((struct bpf_insn) { \
269 .code = BPF_LD | BPF_DW | BPF_IMM, \
270 .dst_reg = DST, \
271 .src_reg = SRC, \
272 .off = 0, \
273 .imm = (__u32) (IMM) }), \
274 ((struct bpf_insn) { \
275 .code = 0, \
276 .dst_reg = 0, \
277 .src_reg = 0, \
278 .off = 0, \
279 .imm = ((__u64) (IMM)) >> 32 })
280
281 #define BPF_LD_IMM64_RAW_FULL(DST, SRC, OFF1, OFF2, IMM1, IMM2) \
282 ((struct bpf_insn) { \
283 .code = BPF_LD | BPF_DW | BPF_IMM, \
284 .dst_reg = DST, \
285 .src_reg = SRC, \
286 .off = OFF1, \
287 .imm = IMM1 }), \
288 ((struct bpf_insn) { \
289 .code = 0, \
290 .dst_reg = 0, \
291 .src_reg = 0, \
292 .off = OFF2, \
293 .imm = IMM2 })
294
295
296
297 #define BPF_LD_MAP_FD(DST, MAP_FD) \
298 BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_FD, 0, 0, \
299 MAP_FD, 0)
300
301 #define BPF_LD_MAP_VALUE(DST, MAP_FD, VALUE_OFF) \
302 BPF_LD_IMM64_RAW_FULL(DST, BPF_PSEUDO_MAP_VALUE, 0, 0, \
303 MAP_FD, VALUE_OFF)
304
305
306
307 #define BPF_CALL_REL(TGT) \
308 ((struct bpf_insn) { \
309 .code = BPF_JMP | BPF_CALL, \
310 .dst_reg = 0, \
311 .src_reg = BPF_PSEUDO_CALL, \
312 .off = 0, \
313 .imm = TGT })
314
315
316
317 #define BPF_EXIT_INSN() \
318 ((struct bpf_insn) { \
319 .code = BPF_JMP | BPF_EXIT, \
320 .dst_reg = 0, \
321 .src_reg = 0, \
322 .off = 0, \
323 .imm = 0 })
324
325 #endif