Squashed 'external/capstone/' content from commit e46f64fa
git-subtree-dir: external/capstone git-subtree-split: e46f64fadb351e9ecd05264fab26f2772feb0994
This commit is contained in:
@@ -0,0 +1,269 @@
|
||||
/* Capstone Disassembly Engine */
|
||||
/* BPF Backend by david942j <david942j@gmail.com>, 2019 */
|
||||
/* SPDX-FileCopyrightText: 2024 Roee Toledano <roeetoledano10@gmail.com> */
|
||||
/* SPDX-License-Identifier: BSD-3 */
|
||||
|
||||
#ifndef CAPSTONE_BPF_H
|
||||
#define CAPSTONE_BPF_H
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include "platform.h"
|
||||
#include "cs_operand.h"
|
||||
|
||||
#ifdef _MSC_VER
|
||||
#pragma warning(disable : 4201)
|
||||
#endif
|
||||
|
||||
#define NUM_BPF_OPS 3
|
||||
/// Operand type for instruction's operands
|
||||
typedef enum bpf_op_type {
|
||||
BPF_OP_INVALID = CS_OP_INVALID,
|
||||
BPF_OP_REG = CS_OP_REG,
|
||||
BPF_OP_IMM = CS_OP_IMM,
|
||||
BPF_OP_OFF = CS_OP_SPECIAL + 0,
|
||||
BPF_OP_MSH = CS_OP_SPECIAL + 1, ///< corresponds to cBPF's BPF_MSH mode
|
||||
BPF_OP_EXT = CS_OP_SPECIAL + 2, ///< cBPF's extension (not eBPF)
|
||||
BPF_OP_MMEM = CS_OP_MEM | (CS_OP_SPECIAL + 3), ///< M[k] in cBPF
|
||||
BPF_OP_MEM = CS_OP_MEM,
|
||||
} bpf_op_type;
|
||||
|
||||
/// BPF registers
|
||||
typedef enum bpf_reg {
|
||||
BPF_REG_INVALID = 0,
|
||||
|
||||
///< cBPF
|
||||
BPF_REG_A,
|
||||
BPF_REG_X,
|
||||
|
||||
///< eBPF
|
||||
BPF_REG_R0,
|
||||
BPF_REG_R1,
|
||||
BPF_REG_R2,
|
||||
BPF_REG_R3,
|
||||
BPF_REG_R4,
|
||||
BPF_REG_R5,
|
||||
BPF_REG_R6,
|
||||
BPF_REG_R7,
|
||||
BPF_REG_R8,
|
||||
BPF_REG_R9,
|
||||
BPF_REG_R10,
|
||||
|
||||
BPF_REG_ENDING,
|
||||
} bpf_reg;
|
||||
|
||||
/// Instruction's operand referring to memory
|
||||
/// This is associated with BPF_OP_MEM operand type above
|
||||
typedef struct bpf_op_mem {
|
||||
bpf_reg base; ///< base register
|
||||
uint32_t disp; ///< offset value
|
||||
} bpf_op_mem;
|
||||
|
||||
typedef enum bpf_ext_type {
|
||||
BPF_EXT_INVALID = 0,
|
||||
|
||||
BPF_EXT_LEN,
|
||||
} bpf_ext_type;
|
||||
|
||||
/// Instruction operand
|
||||
typedef struct cs_bpf_op {
|
||||
bpf_op_type type;
|
||||
union {
|
||||
uint8_t reg; ///< register value for REG operand
|
||||
uint64_t imm; ///< immediate value IMM operand
|
||||
uint32_t off; ///< offset value, used in jump & call
|
||||
bpf_op_mem mem; ///< base/disp value for MEM operand
|
||||
/* cBPF only */
|
||||
uint32_t mmem; ///< M[k] in cBPF
|
||||
uint32_t msh; ///< corresponds to cBPF's BPF_MSH mode
|
||||
uint32_t ext; ///< cBPF's extension (not eBPF)
|
||||
};
|
||||
|
||||
bool is_signed; ///< is this operand signed? It is set for memory, immediate and offset operands.
|
||||
bool is_pkt; ///< is this operand referring to packet data? It is set for memory operands.
|
||||
/// How is this operand accessed? (READ, WRITE or READ|WRITE)
|
||||
/// This field is combined of cs_ac_type.
|
||||
/// NOTE: this field is irrelevant if engine is compiled in DIET mode.
|
||||
cs_ac_type access;
|
||||
} cs_bpf_op;
|
||||
|
||||
/// Instruction structure
|
||||
typedef struct cs_bpf {
|
||||
uint8_t op_count;
|
||||
cs_bpf_op operands[4];
|
||||
} cs_bpf;
|
||||
|
||||
/// BPF instruction
|
||||
typedef enum bpf_insn {
|
||||
BPF_INS_INVALID = 0,
|
||||
|
||||
///< ALU
|
||||
BPF_INS_ADD,
|
||||
BPF_INS_SUB,
|
||||
BPF_INS_MUL,
|
||||
BPF_INS_DIV,
|
||||
BPF_INS_SDIV,
|
||||
BPF_INS_OR,
|
||||
BPF_INS_AND,
|
||||
BPF_INS_LSH,
|
||||
BPF_INS_RSH,
|
||||
BPF_INS_NEG,
|
||||
BPF_INS_MOD,
|
||||
BPF_INS_SMOD,
|
||||
BPF_INS_XOR,
|
||||
BPF_INS_MOV, ///< eBPF only
|
||||
BPF_INS_MOVSB, ///< eBPF only
|
||||
BPF_INS_MOVSH, ///< eBPF only
|
||||
BPF_INS_ARSH, ///< eBPF only
|
||||
|
||||
///< ALU64, eBPF only
|
||||
BPF_INS_ADD64,
|
||||
BPF_INS_SUB64,
|
||||
BPF_INS_MUL64,
|
||||
BPF_INS_DIV64,
|
||||
BPF_INS_SDIV64,
|
||||
BPF_INS_OR64,
|
||||
BPF_INS_AND64,
|
||||
BPF_INS_LSH64,
|
||||
BPF_INS_RSH64,
|
||||
BPF_INS_NEG64,
|
||||
BPF_INS_MOD64,
|
||||
BPF_INS_SMOD64,
|
||||
BPF_INS_XOR64,
|
||||
BPF_INS_MOV64,
|
||||
BPF_INS_MOVSB64,
|
||||
BPF_INS_MOVSH64,
|
||||
BPF_INS_MOVSW64,
|
||||
BPF_INS_ARSH64,
|
||||
|
||||
///< Byteswap, eBPF only
|
||||
BPF_INS_LE16,
|
||||
BPF_INS_LE32,
|
||||
BPF_INS_LE64,
|
||||
BPF_INS_BE16,
|
||||
BPF_INS_BE32,
|
||||
BPF_INS_BE64,
|
||||
BPF_INS_BSWAP16,
|
||||
BPF_INS_BSWAP32,
|
||||
BPF_INS_BSWAP64,
|
||||
|
||||
///< Load
|
||||
BPF_INS_LDW, ///< eBPF only
|
||||
BPF_INS_LDH,
|
||||
BPF_INS_LDB,
|
||||
BPF_INS_LDDW, ///< eBPF only: load 64-bit imm
|
||||
BPF_INS_LDXW, ///< eBPF only
|
||||
BPF_INS_LDXH, ///< eBPF only
|
||||
BPF_INS_LDXB, ///< eBPF only
|
||||
BPF_INS_LDXDW, ///< eBPF only
|
||||
///< Packet data access
|
||||
BPF_INS_LDABSW, ///< eBPF only
|
||||
BPF_INS_LDABSH, ///< eBPF only
|
||||
BPF_INS_LDABSB, ///< eBPF only
|
||||
BPF_INS_LDINDW, ///< eBPF only
|
||||
BPF_INS_LDINDH, ///< eBPF only
|
||||
BPF_INS_LDINDB, ///< eBPF only
|
||||
|
||||
///< Store
|
||||
BPF_INS_STW, ///< eBPF only
|
||||
BPF_INS_STH, ///< eBPF only
|
||||
BPF_INS_STB, ///< eBPF only
|
||||
BPF_INS_STDW, ///< eBPF only
|
||||
BPF_INS_STXW, ///< eBPF only
|
||||
BPF_INS_STXH, ///< eBPF only
|
||||
BPF_INS_STXB, ///< eBPF only
|
||||
BPF_INS_STXDW, ///< eBPF only
|
||||
BPF_INS_XADDW, ///< eBPF only
|
||||
BPF_INS_XADDDW, ///< eBPF only
|
||||
|
||||
///< Jump
|
||||
BPF_INS_JA,
|
||||
BPF_INS_JEQ,
|
||||
BPF_INS_JGT,
|
||||
BPF_INS_JGE,
|
||||
BPF_INS_JSET,
|
||||
BPF_INS_JNE, ///< eBPF only
|
||||
BPF_INS_JSGT, ///< eBPF only
|
||||
BPF_INS_JSGE, ///< eBPF only
|
||||
BPF_INS_CALL, ///< eBPF only
|
||||
BPF_INS_CALLX, ///< eBPF only
|
||||
BPF_INS_EXIT, ///< eBPF only
|
||||
BPF_INS_JLT, ///< eBPF only
|
||||
BPF_INS_JLE, ///< eBPF only
|
||||
BPF_INS_JSLT, ///< eBPF only
|
||||
BPF_INS_JSLE, ///< eBPF only
|
||||
|
||||
///< Jump32, eBPF only
|
||||
BPF_INS_JAL,
|
||||
BPF_INS_JEQ32,
|
||||
BPF_INS_JGT32,
|
||||
BPF_INS_JGE32,
|
||||
BPF_INS_JSET32,
|
||||
BPF_INS_JNE32,
|
||||
BPF_INS_JSGT32,
|
||||
BPF_INS_JSGE32,
|
||||
BPF_INS_JLT32,
|
||||
BPF_INS_JLE32,
|
||||
BPF_INS_JSLT32,
|
||||
BPF_INS_JSLE32,
|
||||
|
||||
///< Return, cBPF only
|
||||
BPF_INS_RET,
|
||||
|
||||
///< Atomic, eBPF only
|
||||
BPF_INS_AADD,
|
||||
BPF_INS_AOR,
|
||||
BPF_INS_AAND,
|
||||
BPF_INS_AXOR,
|
||||
BPF_INS_AFADD,
|
||||
BPF_INS_AFOR,
|
||||
BPF_INS_AFAND,
|
||||
BPF_INS_AFXOR,
|
||||
|
||||
///< Atomic 64-bit, eBPF only
|
||||
BPF_INS_AXCHG64,
|
||||
BPF_INS_ACMPXCHG64,
|
||||
BPF_INS_AADD64,
|
||||
BPF_INS_AOR64,
|
||||
BPF_INS_AAND64,
|
||||
BPF_INS_AXOR64,
|
||||
BPF_INS_AFADD64,
|
||||
BPF_INS_AFOR64,
|
||||
BPF_INS_AFAND64,
|
||||
BPF_INS_AFXOR64,
|
||||
|
||||
///< Misc, cBPF only
|
||||
BPF_INS_TAX,
|
||||
BPF_INS_TXA,
|
||||
|
||||
BPF_INS_ENDING,
|
||||
|
||||
// alias instructions
|
||||
BPF_INS_LD = BPF_INS_LDW, ///< cBPF only
|
||||
BPF_INS_LDX = BPF_INS_LDXW, ///< cBPF only
|
||||
BPF_INS_ST = BPF_INS_STW, ///< cBPF only
|
||||
BPF_INS_STX = BPF_INS_STXW, ///< cBPF only
|
||||
} bpf_insn;
|
||||
|
||||
/// Group of BPF instructions
|
||||
typedef enum bpf_insn_group {
|
||||
BPF_GRP_INVALID = 0, ///< = CS_GRP_INVALID
|
||||
|
||||
BPF_GRP_LOAD,
|
||||
BPF_GRP_STORE,
|
||||
BPF_GRP_ALU,
|
||||
BPF_GRP_JUMP,
|
||||
BPF_GRP_CALL, ///< eBPF only
|
||||
BPF_GRP_RETURN,
|
||||
BPF_GRP_MISC, ///< cBPF only
|
||||
|
||||
BPF_GRP_ENDING,
|
||||
} bpf_insn_group;
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
Reference in New Issue
Block a user