Tests if c-macro format accepts all valid instructions
CLI
asm - -a x86_64 -f c-macro
STDIN
goto end
$A = $syscall_nr
$A = $arch
$A = $low_pc
$A = $high_pc
$A = $low_args[0]
$A = $low_args[5]
$A = $high_args[0]
$A = $high_args[5]
if ($A == $X) goto end
if ($A < i386) goto end
if !($A & prctl) goto end
if ($A == x86_64.seccomp) goto end
if ($A == 3333) goto end
return NOTIFY
return TRACE(32)
return TRAP(0)
return ERRNO
return 0x3333
end:
$A = $scmp_data_len
$X = $scmp_data_len
$A += 3
$A -= $X
$A *= 5
$A /= $X
$A &= 0xffffffff
$A |= $X
$A <<= 1
$A >>= 1
$A ^= 2
$A = -$A
$A = 32
$X = 64
$A = $X
$X = $A
$mem[1] = $X
$A = $mem[1]
$mem[2] = $A
$X = $mem[2]
return $A
STDOUT
BPF_JUMP(BPF_JMP | BPF_JA, 0x12, 0, 0),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, instruction_pointer)),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, instruction_pointer) + 4),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[0])),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[5])),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[0]) + 4),
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[5]) + 4),
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, 9, 0),
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, SCMP_ARCH_X86, 0, 8),
BPF_JUMP(BPF_JMP | BPF_JSET | BPF_K, SYS_prctl, 0, 7),
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x13d, 6, 0),
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xd05, 5, 0),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_USER_NOTIF),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRACE | 0x20),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP | 0),
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | 0),
BPF_STMT(BPF_RET | BPF_K, 0x3333),
BPF_STMT(BPF_LD | BPF_W | BPF_LEN, 0),
BPF_STMT(BPF_LDX | BPF_W | BPF_LEN, 0),
BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 0x3),
BPF_STMT(BPF_ALU | BPF_SUB | BPF_X, 0),
BPF_STMT(BPF_ALU | BPF_MUL | BPF_K, 0x5),
BPF_STMT(BPF_ALU | BPF_DIV | BPF_X, 0),
BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xffffffff),
BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 0x1),
BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 0x1),
BPF_STMT(BPF_ALU | BPF_XOR | BPF_K, 0x2),
BPF_STMT(BPF_ALU | BPF_NEG, 0),
BPF_STMT(BPF_LD | BPF_IMM, 0x20),
BPF_STMT(BPF_LDX | BPF_IMM, 0x40),
BPF_STMT(BPF_MISC | BPF_TXA, 0),
BPF_STMT(BPF_MISC | BPF_TAX, 0),
BPF_STMT(BPF_STX, 0x1),
BPF_STMT(BPF_LD | BPF_MEM, 0x1),
BPF_STMT(BPF_ST, 0x2),
BPF_STMT(BPF_LDX | BPF_MEM, 0x2),
BPF_STMT(BPF_RET | BPF_A, 0),
