bend-osdev-bpf

Search uses release 0.1.0.0 · 317 definitions

Releases (1)

0.1.0.0 indexed

Definitions (317)

insn.bend

type BpfSrcthe second operand of an ALU or jump instruction: the constant k, or X
type BpfRvalwhat a return instruction answers: the constant k, or A
type BpfOpA decoded instruction.
type BpfRawstruct sock_filter; code is 16 bits and jt, jf are 8 bits when stored
type BpfOrderthe byte order of a stored program, and of a filter's loads
type BpfErrorEvery failure: decoding (BadCode, Truncated, StoredTooLong), validation (Empty to SeccompInsn), installing seccomp filters (PathTooLong), and running a program that was not validated (FellOff, BadScratch).
def bpf_memwordsBPF_MEMWORDS: the scratch memory is M[0] to M[15]
def bpf_stmt
def bpf_jump
def BpfRaw.code
def BpfSize.bits
def BpfAluOp.bits
def BpfCond.bits
def BpfSrc.bits
def BpfSrc.k
def BpfRval.encode
def BpfOp.encodethe sock_filter of an instruction; unused fields are 0
def BpfRaw.decode.pick
def BpfRaw.decodethe instruction a sock_filter holds, or None for an opcode classic BPF does not define; fields the instruction does not use are ignored
def bpf_encode.ref
def bpf_encode.gothe encoded instructions, last first, onto acc
def bpf_encode
def bpf_decode.cons
def bpf_decode.ref.go
def bpf_decode.ref
def bpf_decode.pushone decoded instruction pushed onto the instructions so far (last first)
def bpf_decode.goa: the instructions before pc, last first, or the first failure; the loop stops at the instruction after a failure
def bpf_decodeevery instruction decoded, or the first one that is not classic BPF
def BpfRaw.to_octets
def bpf_to_octets.goeach instruction's 8 bytes, last first, onto acc
def bpf_to_octets
def bpf_field
def BpfRaw.of_octets
def bpf_of_octets.gothe next n instructions, onto acc (last first), then all of them in order
def bpf_of_octets.rem
def bpf_of_octets.fin
def bpf_of_octets.fitsover: the input's byte at offset max, if it has one
def bpf_octets_max8 * BPF_MAXINSNS: the bytes of the longest program validation accepts by default (LAWS.bend: octets_max_default ties it to bpf_maxinsns)
def bpf_of_octets_witha stored program's instructions: at most max bytes, a multiple of 8.
def bpf_of_octetsthe same, with the default limit, bpf_octets_max()
def BpfError.show

seccomp.bend

type SeccompData
def SeccompData.field32
def SeccompData.field64
def SeccompData.to_octetsthe 64 bytes of struct seccomp_data, in the given byte order
def SeccompData.input
def seccomp_orderthe byte order of x86-64 and arm64, the usual hosts
def seccomp_data_size
def seccomp_arch_x86_64AUDIT_ARCH_* values for seccomp_data.arch, and the x32 system call bit
def seccomp_arch_i386
def seccomp_arch_aarch64
def seccomp_x32_syscall_bit
type SeccompAction
def SeccompAction.pick
def SeccompAction.of_u32the action of a SECCOMP_RET_* value: SECCOMP_RET_ACTION_FULL (0xffff0000) selects the action, SECCOMP_RET_DATA (0xffff) the data
def SeccompAction.to_u32the SECCOMP_RET_* value of an action, with the low 16 bits of its data
def SeccompAction.clipthe same action with its data cut to the 16 bits a return value holds
def SeccompAction.rankthe precedence: 0 for KILL_PROCESS, the most restrictive, to 7 for ALLOW
def SeccompAction.show
def seccomp_combine.pick
def seccomp_combinethe answer of two filters, given each one's: the higher precedence, and on a tie the newer filter's action (with its data)
def seccomp_check.word
def seccomp_check.abs
def seccomp_check.alu
def seccomp_check.op
def seccomp_check.gook is the verdict so far; the loop stops at the instruction after a failure
def seccomp_validate.go
def seccomp_validate_withbpf_validate's rules, only aligned 32-bit loads inside seccomp_data, and no BPF_MOD (checked once bpf_validate's rules hold)
def seccomp_validatethe default options (what Linux checks), with this instruction limit
def seccomp_run.fin
def seccomp_runone filter's action for a system call
def seccomp_eval.join
def seccomp_evalthe action of a stack of filters, the most recently installed first; with no filter, ALLOW
type SeccompLimitsthe limits on one filter (BPF_MAXINSNS) and on all the filters of a thread together (MAX_INSNS_PER_PATH), where each filter already installed counts 4 instructions more than its length
def seccomp_limits
def seccomp_path_len
def seccomp_install.fit
def seccomp_install.ok
def seccomp_install.go
def seccomp_installdecode a stored filter, validate it for seccomp, and put it on top of the stack, as SECCOMP_SET_MODE_FILTER does

validate.bend

def bpf_maxinsnsBPF_MAXINSNS: the usual instruction limit
type BpfValidateOptionsthe choices validation offers: the instruction limit, and whether every scratch read must follow a write on every path
def BpfValidateOptions.defaultwhat Linux checks: at most 4096 instructions, scratch written before read
def BpfValidateOptions.permissivethe rules of bpf(4) alone: scratch memory may be read before it is written
def bpf_chk
def bpf_both
def bpf_check.nextan instruction that goes on to the next one must not be the last
def bpf_check.k_div
def bpf_check.div
def bpf_check.mem
def bpf_check.jmp
def bpf_check.opthe checks of one instruction at index pc, with r instructions after it
def bpf_check.allthe instructions' own checks, structurally: the reference the proofs reason about (PROOF.bend: F_check ties bpf_check.go to it)
def bpf_check.gothe same as a tail call: ok is the verdict so far, and n counts the instructions from pc on; the loop stops at the instruction after a failure
def bpf_count.gothe number of instructions, as a tail call (PROOF.bend: F_count)
def bpf_count
def bpf_check.len
def bpf_mem.bit.go
def bpf_mem.bit
def bpf_mem.meet.gomeet the n-th mask ahead with m (acc: the masks before it, last first)