nordisk/heimdall

scripts/gen-syscall-tables.sh

#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# Regenerates crates/heimdall-seccomp/src/tables/{x86_64,aarch64}.rs, the
# syscall name <-> number tables, from the Linux uapi headers (linux-libc-dev).
# Heimdall is a defensive sandbox; the tables only name the calls its own
# profiles allow. Usage: scripts/gen-syscall-tables.sh [include dir]
set -eu
cd "$(dirname "$0")/.."
inc=${1:-/usr/include}
out=crates/heimdall-seccomp/src/tables
ver=$(dpkg-query -W -f '${Version}' linux-libc-dev 2>/dev/null || echo unknown)

emit() { # $1 arch, $2 const prefix; stdin: "name nr" lines
  {
    echo "// SPDX-License-Identifier: AGPL-3.0-only"
    echo "// GENERATED by scripts/gen-syscall-tables.sh from the Linux uapi headers"
    echo "// (linux-libc-dev $ver). Do not edit by hand."
    echo "//! $1 syscall numbers, sorted by number."
    echo
    echo "/// (name, number) for every $1 syscall, sorted by number."
    echo "pub const SYSCALLS: &[(&str, u32)] = &["
    sort -k2,2n -k1,1 | awk '{ printf "    (\"%s\", %s),\n", $1, $2 }'
    echo "];"
  } > "$out/$1.rs"
}

grep -E '^#define __NR_[a-z0-9_]+ [0-9]+$' "$inc/x86_64-linux-gnu/asm/unistd_64.h" \
  | sed 's/^#define __NR_//' | emit x86_64

stub=$(mktemp -d); mkdir -p "$stub/asm"
echo '#define __BITS_PER_LONG 64' > "$stub/asm/bitsperlong.h"
# aarch64 = asm-generic with the arm64 uapi wants (arch/arm64/include/uapi/asm/unistd.h).
printf '#include <asm-generic/unistd.h>\n' \
  | cpp -nostdinc -I"$stub" -I"$inc" -dM -D__ARCH_WANT_RENAMEAT \
      -D__ARCH_WANT_NEW_STAT -D__ARCH_WANT_SET_GET_RLIMIT -D__ARCH_WANT_SYS_CLONE3 \
      -D__ARCH_WANT_MEMFD_SECRET - \
  | grep -E '^#define __NR_[a-z0-9_]+ ' | grep -v '__NR_syscalls' \
  | sed 's/^#define __NR_//' > /tmp/heim-aarch64.$$
# Resolve aliases (__NR_fcntl -> __NR3264_fcntl -> 25) through cpp itself.
{
  printf '#include <asm-generic/unistd.h>\n'
  awk '{ print "SYSCALL " $1 " __NR_" $1 }' /tmp/heim-aarch64.$$
} | cpp -nostdinc -I"$stub" -I"$inc" -P -D__ARCH_WANT_RENAMEAT \
      -D__ARCH_WANT_NEW_STAT -D__ARCH_WANT_SET_GET_RLIMIT -D__ARCH_WANT_SYS_CLONE3 \
      -D__ARCH_WANT_MEMFD_SECRET - \
  | awk '$1 == "SYSCALL" { $1 = ""; gsub(/[()]/, ""); n = split($0, a, " "); v = a[2]; if (n > 2) { v = 0; for (i = 2; i <= n; i++) if (a[i] != "+") v += a[i] } if (v ~ /^[0-9]+$/) print a[1], v }' \
  | emit aarch64
rm -rf /tmp/heim-aarch64.$$ "$stub"
echo "wrote $out/x86_64.rs ($(grep -c '^    (' "$out/x86_64.rs")) and $out/aarch64.rs ($(grep -c '^    (' "$out/aarch64.rs"))"