From f614583a605f4c23d2f6e1a2ad31e089d10f8d8e Mon Sep 17 00:00:00 2001
From: Serhei Makarov <smakarov@redhat.com>
Date: Tue, 16 Oct 2018 18:17:25 -0400
Subject: [PATCH 06/32] stapbpf assembler WIP #5 :: basic kernel_string()
implementation
---
tapset/bpf/conversions.stp | 108 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 108 insertions(+)
create mode 100644 tapset/bpf/conversions.stp
diff --git a/tapset/bpf/conversions.stp b/tapset/bpf/conversions.stp
new file mode 100644
index 000000000..d741ec584
--- /dev/null
+++ b/tapset/bpf/conversions.stp
@@ -0,0 +1,108 @@
+// conversions tapset -- eBPF version
+// Copyright (C) 2018 Red Hat Inc.
+//
+// This file is part of systemtap, and is free software. You can
+// redistribute it and/or modify it under the terms of the GNU General
+// Public License (GPL); either version 2, or (at your option) any
+// later version.
+
+/**
+ * sfunction kernel_string - Retrieves string from kernel memory
+ * @addr: The kernel address to retrieve the string from
+ *
+ * Description: This function returns the null terminated C string
+ * from a given kernel memory address. Reports an error on string
+ * copy fault.
+ */
+function kernel_string:string (addr:long) {
+ return kernel_string_n(addr, 64 /*TODO: define BPF_MAXSTRINGLEN*/)
+}
+
+// TODO kernel_string:string(addr:long, err_msg:string)
+// TODO kernel_string2:string(addr:long, err_msg:string)
+
+/**
+ * sfunction kernel_string - Retrieves string from kernel memory with alternative error string
+ * @addr: The kernel address to retrieve the string from
+ * @err_msg: The error message to return when data isn't available
+ *
+ * Description: This function returns the null terminated C string
+ * from a given kernel memory address. Reports the given error message
+ * on string copy fault.
+ */
+function kernel_string:string (addr:long, err_msg:string)
+%{ /* bpf */ /* pure */
+ /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN);
+ buf[0] = 0x0; // guarantee NUL byte
+ rc = bpf_probe_read_str(buf, n, addr); */
+ alloc, $buf, BPF_MAXSTRINGLEN;
+ 0x62, $buf, -, -, 0x0; /* stw [$buf+0], 0x0 -- guarantee NUL byte */
+ call, $rc, bpf_probe_read_str, $buf, BPF_MAXSTRINGLEN, $addr;
+
+ /* if (rc < 0) return err_msg;
+ return buf; */
+ 0xa5, rc, 0, _err, -; /* jlt $rc, 0, _err */
+ 0xbf, $$, $buf, -, -; /* mov $$, $buf */
+ 0x05, -, -, _done, -; /* ja _done; */
+ label, _err;
+ 0xbf, $$, $err_msg, -, -; /* mov $$, $err_msg */
+ label, _done;
+%}
+function kernel_string2:string (addr:long, err_msg:string) {
+ return kernel_string(addr, err_msg);
+}
+
+// TODO kernel_string_quoted:string(addr:long) -- requires pseudo-loop to quote unprintable chars
+
+/**
+ * sfunction kernel_string_n - Retrieves string of given length from kernel memory
+ * @addr: The kernel address to retrieve the string from
+ * @n: The maximum length of the string (if not null terminated)
+ *
+ * Description: Returns the C string of a maximum given length from a
+ * given kernel memory address. Reports an error on string copy fault.
+ */
+function kernel_string_n:string (addr:long, n:long)
+%{ /* bpf */ /* pure */
+ /* if (n > BPF_MAXSTRINGLEN) n = BPF_MAXSTRINGLEN; */
+ 0xb5, $n, -, _skip, BPF_MAXSTRINGLEN; /* jle n, BPF_MAXSTRINGLEN, _skip */
+ 0xb7, $n, -, -, BPF_MAXSTRINGLEN; /* mov $n, BPF_MAXSTRINGLEN */
+ label, _skip;
+
+ /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN);
+ buf[0] = 0x0; // guarantee NUL byte
+ rc = bpf_probe_read_str(buf, n, addr); */
+ alloc, $buf, BPF_MAXSTRINGLEN;
+ 0x62, $buf, -, -, 0x0; /* stw [buf+0], 0 -- guarantee NUL byte */
+ call, $rc, probe_read_str, $buf, $n, $addr; /* TODO: should work with bpf_probe_read_str too */
+
+ /* TODO pending implementation of error */
+ /* if (rc < 0) error("...", addr); */
+ /*0x35, $rc, 0, _done, -; /* jge rc, 0, _done */
+ /*error, "kernel string copy fault at 0x%p [man error::fault]", $addr; /* TODO document bpf version of error::fault */
+ /*label, _done;*/
+
+ /* return buf; */
+ 0xbf, $$, $buf, -, -; /* mov $$, buf */
+%}
+
+// TODO kernel_string_utf32:string(addr:long)
+// TODO kernel_string_utf32:string(addr:long,err_msg:string)
+// TODO kernel_string2_utf32:string(addr:long,err_msg:string)
+// TODO kernel_string_quoted_utf32:string(addr:long)
+
+// TODO kernel_string_utf16:string(addr:long)
+// TODO kernel_string_utf16:string(addr:long,err_msg:string)
+// TODO kernel_string2_utf16:string(addr:long,err_msg:string)
+// TODO kernel_string_quoted_utf16:string(addr:long)
+
+// TODO kernel_long:long(addr:long)
+// TODO kernel_int:long(addr:long)
+// TODO kernel_short:long(addr:long)
+// TODO kernel_char:long(addr:long)
+
+// TODO kernel_pointer:long(addr:long)
+
+// TODO kernel_buffer_quoted:string(addr:long,inlen:long)
+// TODO kernel_buffer_quoted:string(addr:long,inlen:long,outlen:long)
+// TODO kernel_buffer_quoted_error:string(addr:long,inlen:long,outlen:long)
--
2.14.5