1  /*
       2   * Decoder of socket filter programs.
       3   *
       4   * Copyright (c) 2017 Dmitry V. Levin <ldv@strace.io>
       5   * Copyright (c) 2017-2022 The strace developers.
       6   * All rights reserved.
       7   *
       8   * SPDX-License-Identifier: LGPL-2.1-or-later
       9   */
      10  
      11  #include "defs.h"
      12  
      13  #include "bpf_filter.h"
      14  
      15  #include <linux/filter.h>
      16  #include "xlat/skf_ad.h"
      17  #define XLAT_MACROS_ONLY
      18  # include "xlat/skf_off.h"
      19  #undef XLAT_MACROS_ONLY
      20  
      21  static bool
      22  print_sock_filter_k(const struct bpf_filter_block *const fp)
      23  {
      24  	if (BPF_CLASS(fp->code) == BPF_LD && BPF_MODE(fp->code) == BPF_ABS) {
      25  		if (fp->k >= (unsigned int) SKF_AD_OFF) {
      26  			print_xlat32(SKF_AD_OFF);
      27  			tprint_plus();
      28  			printxval(skf_ad, fp->k - (unsigned int) SKF_AD_OFF,
      29  				  "SKF_AD_???");
      30  			return true;
      31  		} else if (fp->k >= (unsigned int) SKF_NET_OFF) {
      32  			print_xlat32(SKF_NET_OFF);
      33  			tprint_plus();
      34  			PRINT_VAL_U(fp->k - (unsigned int) SKF_NET_OFF);
      35  			return true;
      36  		} else if (fp->k >= (unsigned int) SKF_LL_OFF) {
      37  			print_xlat32(SKF_LL_OFF);
      38  			tprint_plus();
      39  			PRINT_VAL_U(fp->k - (unsigned int) SKF_LL_OFF);
      40  			return true;
      41  		}
      42  	}
      43  
      44  	return false;
      45  }
      46  
      47  void
      48  print_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
      49  		    const unsigned short len)
      50  {
      51  	print_bpf_fprog(tcp, addr, len, print_sock_filter_k);
      52  }
      53  
      54  void
      55  decode_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr)
      56  {
      57  	decode_bpf_fprog(tcp, addr, print_sock_filter_k);
      58  }