Blame SOURCES/rhbz1643997.0016-tapset-bpf-context.stp-add-execname-triage-other-fun.patch

e4e640
From deb88d0b1fef10177ab197b066f434c720253f8d Mon Sep 17 00:00:00 2001
e4e640
From: Serhei Makarov <smakarov@redhat.com>
e4e640
Date: Tue, 30 Oct 2018 17:29:46 -0400
e4e640
Subject: [PATCH 16/32] tapset/bpf/context.stp :: add execname(), triage other
e4e640
 functions
e4e640
e4e640
* tapset/bpf/context.stp: Notes on other functions that could be added.
e4e640
(execname): New tapset function.
e4e640
e4e640
* tapset/linux/context.stp: Move pexecname() to a more logical location.
e4e640
---
e4e640
 tapset/bpf/context.stp   | 66 ++++++++++++++++++++++++++++++++++++++++++++++++
e4e640
 tapset/linux/context.stp | 30 +++++++++++-----------
e4e640
 2 files changed, 81 insertions(+), 15 deletions(-)
e4e640
e4e640
diff --git a/tapset/bpf/context.stp b/tapset/bpf/context.stp
e4e640
index 45dcd4d71..55e0f871b 100644
e4e640
--- a/tapset/bpf/context.stp
e4e640
+++ b/tapset/bpf/context.stp
e4e640
@@ -6,6 +6,34 @@
e4e640
 // Public License (GPL); either version 2, or (at your option) any
e4e640
 // later version.
e4e640
 
e4e640
+/**
e4e640
+ * sfunction execname - Returns the execname of a target process (or group of processes)
e4e640
+ *
e4e640
+ * Description: Returns the execname of a target process (or group of processes).
e4e640
+ */
e4e640
+function execname:string ()
e4e640
+%{ /* bpf */ /* pure */ /* unprivileged */ /* stable */
e4e640
+  /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN);
e4e640
+     buf[0] = 0x0; // guarantee NUL byte
e4e640
+     rc = get_current_comm(buf, BPF_MAXSTRINGLEN); */
e4e640
+  alloc, $buf, BPF_MAXSTRINGLEN;
e4e640
+  0x62, $buf, -, -, 0x0; /* stw [$buf+0], 0x0 -- guarantee NUL byte */
e4e640
+  call, $rc, get_current_comm, $buf, BPF_MAXSTRINGLEN;
e4e640
+
e4e640
+  /* if (rc < 0) return err_msg;
e4e640
+     return buf; */
e4e640
+  0xa5, $rc, 0, _err, -; /* jlt $rc, 0, _err */
e4e640
+  0xbf, $$, $buf, -, -; /* mov $$, $buf */
e4e640
+  0x05, -, -, _done, -; /* ja _done */
e4e640
+
e4e640
+  label, _err;
e4e640
+  0xbf, $$, "<unknown>", -, -; /* mov $$, <unknown> */
e4e640
+
e4e640
+  label, _done;
e4e640
+%}
e4e640
+
e4e640
+// TODO: pexecname ()
e4e640
+
e4e640
 /**
e4e640
  * sfunction pid - Returns the ID of a thread group
e4e640
  * 
e4e640
@@ -20,6 +48,8 @@ function pid:long ()
e4e640
    0x77, $$, 0, 0, 32   /* rshk $$, 32 */
e4e640
 %}
e4e640
 
e4e640
+// TODO: ns_pid:long ()
e4e640
+
e4e640
 /**
e4e640
  * sfunction tid - Returns the thread ID of a target process
e4e640
  * 
e4e640
@@ -33,6 +63,14 @@ function tid:long ()
e4e640
    0xbc, $$, 0, 0, 0    /* movwx $$, r0 */
e4e640
 %}
e4e640
 
e4e640
+// TODO: ns_tid:long ()
e4e640
+// TODO: ppid:long ()
e4e640
+// TODO: ns_ppid:long ()
e4e640
+// TODO: pgrp:long ()
e4e640
+// TODO: ns_pgrp:long ()
e4e640
+// TODO: sid:long ()
e4e640
+// TODO: ns_sid:long ()
e4e640
+
e4e640
 /**
e4e640
  * sfunction gid - Returns the group ID of a target process
e4e640
  * 
e4e640
@@ -46,6 +84,10 @@ function gid:long ()
e4e640
    0x77, $$, 0, 0, 32	/* rshk $$, 32 */
e4e640
 %}
e4e640
 
e4e640
+// TODO: ns_gid:long ()
e4e640
+// TODO: egid:long ()
e4e640
+// TODO: ns_egid:long ()
e4e640
+
e4e640
 /**
e4e640
  * sfunction uid - Returns the user ID of a target process
e4e640
  *
e4e640
@@ -58,6 +100,12 @@ function uid:long ()
e4e640
    0xbc, $$, 0, 0, 0	/* movwx $$, r0 */
e4e640
 %}
e4e640
 
e4e640
+// TODO: ns_uid:long ()
e4e640
+// TODO: euid:long ()
e4e640
+// TODO: ns_euid:long ()
e4e640
+// XXX: is_myproc () is only relevant for unprivileged use of eBPF (still theoretical).
e4e640
+
e4e640
+// TODO: Old systemtap-compat scripts should not be running on eBPF backend in the first place?
e4e640
 /**
e4e640
  * sfunction cpuid - Returns the current cpu number
e4e640
  * 
e4e640
@@ -82,3 +130,21 @@ function cpu:long ()
e4e640
    0x85, 0, 0, 0, 8;	/* call BPF_FUNC_get_smp_processor_id */
e4e640
    0xbf, $$, 0, 0, 0	/* movx $$, r0 */
e4e640
 %}
e4e640
+
e4e640
+// TODO: registers_valid:long ()
e4e640
+// TODO: user_mode:long ()
e4e640
+// TODO: is_return:long ()
e4e640
+// TODO: target:long ()
e4e640
+// TODO: module_name:string ()
e4e640
+// XXX: module_size:string () -- not clear if this should refer to the entire .bo or to just the current eBPF routine.
e4e640
+// TODO: stp_pid:long ()
e4e640
+// XXX: remote_id:long (), remote_uri:string() -- pending an evaluation of remote eBPF execution.
e4e640
+// XXX: stack_size() -- not clear if this should be the eBPF stack size or the kernel stack size.
e4e640
+// XXX: stack_used(),stack_unused() probably a fairly ill-defined idea with the eBPF stack.
e4e640
+// TODO: Other context functions for info about things like eBPF maps.
e4e640
+
e4e640
+// TODO: addr:long ()
e4e640
+// TODO: uaddr:long ()
e4e640
+// XXX: cmdline_args:string(n:long, m:long, delim:string) -- requires string concatenation & loops.
e4e640
+// TODO: cmdline_arg:string(n:long)
e4e640
+// XXX: cmdline_string:string() -- requires string concatenation & loops.
e4e640
diff --git a/tapset/linux/context.stp b/tapset/linux/context.stp
e4e640
index 2bd405186..46b1f6b32 100644
e4e640
--- a/tapset/linux/context.stp
e4e640
+++ b/tapset/linux/context.stp
e4e640
@@ -19,6 +19,21 @@ function execname:string ()
e4e640
 	strlcpy (STAP_RETVALUE, current->comm, MAXSTRINGLEN);
e4e640
 %}
e4e640
 
e4e640
+/**
e4e640
+ * sfunction pexecname - Returns the execname of a target process's parent process
e4e640
+ *
e4e640
+ * Description: This function returns the execname of a target
e4e640
+ * process's parent procces.
e4e640
+ */
e4e640
+function pexecname:string ()
e4e640
+%{ /* pure */ /* unprivileged */ /* stable */
e4e640
+#if defined(STAPCONF_REAL_PARENT)
e4e640
+	strlcpy (STAP_RETVALUE, current->real_parent->comm, MAXSTRINGLEN);
e4e640
+#else
e4e640
+	strlcpy (STAP_RETVALUE, current->parent->comm, MAXSTRINGLEN);
e4e640
+#endif
e4e640
+%}
e4e640
+
e4e640
 /**
e4e640
  * sfunction pid - Returns the ID of a target process
e4e640
  *
e4e640
@@ -153,21 +168,6 @@ function ns_sid:long ()
e4e640
   else STAP_RETURN (rc);
e4e640
 %}
e4e640
 
e4e640
-/**
e4e640
- * sfunction pexecname - Returns the execname of a target process's parent process
e4e640
- *
e4e640
- * Description: This function returns the execname of a target
e4e640
- * process's parent procces.
e4e640
- */
e4e640
-function pexecname:string ()
e4e640
-%{ /* pure */ /* unprivileged */ /* stable */
e4e640
-#if defined(STAPCONF_REAL_PARENT)
e4e640
-	strlcpy (STAP_RETVALUE, current->real_parent->comm, MAXSTRINGLEN);
e4e640
-#else
e4e640
-	strlcpy (STAP_RETVALUE, current->parent->comm, MAXSTRINGLEN);
e4e640
-#endif
e4e640
-%}
e4e640
-
e4e640
 /**
e4e640
  * sfunction gid - Returns the group ID of a target process
e4e640
  *
e4e640
-- 
e4e640
2.14.5
e4e640