From f614583a605f4c23d2f6e1a2ad31e089d10f8d8e Mon Sep 17 00:00:00 2001 From: Serhei Makarov Date: Tue, 16 Oct 2018 18:17:25 -0400 Subject: [PATCH 06/32] stapbpf assembler WIP #5 :: basic kernel_string() implementation --- tapset/bpf/conversions.stp | 108 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 tapset/bpf/conversions.stp diff --git a/tapset/bpf/conversions.stp b/tapset/bpf/conversions.stp new file mode 100644 index 000000000..d741ec584 --- /dev/null +++ b/tapset/bpf/conversions.stp @@ -0,0 +1,108 @@ +// conversions tapset -- eBPF version +// Copyright (C) 2018 Red Hat Inc. +// +// This file is part of systemtap, and is free software. You can +// redistribute it and/or modify it under the terms of the GNU General +// Public License (GPL); either version 2, or (at your option) any +// later version. + +/** + * sfunction kernel_string - Retrieves string from kernel memory + * @addr: The kernel address to retrieve the string from + * + * Description: This function returns the null terminated C string + * from a given kernel memory address. Reports an error on string + * copy fault. + */ +function kernel_string:string (addr:long) { + return kernel_string_n(addr, 64 /*TODO: define BPF_MAXSTRINGLEN*/) +} + +// TODO kernel_string:string(addr:long, err_msg:string) +// TODO kernel_string2:string(addr:long, err_msg:string) + +/** + * sfunction kernel_string - Retrieves string from kernel memory with alternative error string + * @addr: The kernel address to retrieve the string from + * @err_msg: The error message to return when data isn't available + * + * Description: This function returns the null terminated C string + * from a given kernel memory address. Reports the given error message + * on string copy fault. + */ +function kernel_string:string (addr:long, err_msg:string) +%{ /* bpf */ /* pure */ + /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN); + buf[0] = 0x0; // guarantee NUL byte + rc = bpf_probe_read_str(buf, n, addr); */ + alloc, $buf, BPF_MAXSTRINGLEN; + 0x62, $buf, -, -, 0x0; /* stw [$buf+0], 0x0 -- guarantee NUL byte */ + call, $rc, bpf_probe_read_str, $buf, BPF_MAXSTRINGLEN, $addr; + + /* if (rc < 0) return err_msg; + return buf; */ + 0xa5, rc, 0, _err, -; /* jlt $rc, 0, _err */ + 0xbf, $$, $buf, -, -; /* mov $$, $buf */ + 0x05, -, -, _done, -; /* ja _done; */ + label, _err; + 0xbf, $$, $err_msg, -, -; /* mov $$, $err_msg */ + label, _done; +%} +function kernel_string2:string (addr:long, err_msg:string) { + return kernel_string(addr, err_msg); +} + +// TODO kernel_string_quoted:string(addr:long) -- requires pseudo-loop to quote unprintable chars + +/** + * sfunction kernel_string_n - Retrieves string of given length from kernel memory + * @addr: The kernel address to retrieve the string from + * @n: The maximum length of the string (if not null terminated) + * + * Description: Returns the C string of a maximum given length from a + * given kernel memory address. Reports an error on string copy fault. + */ +function kernel_string_n:string (addr:long, n:long) +%{ /* bpf */ /* pure */ + /* if (n > BPF_MAXSTRINGLEN) n = BPF_MAXSTRINGLEN; */ + 0xb5, $n, -, _skip, BPF_MAXSTRINGLEN; /* jle n, BPF_MAXSTRINGLEN, _skip */ + 0xb7, $n, -, -, BPF_MAXSTRINGLEN; /* mov $n, BPF_MAXSTRINGLEN */ + label, _skip; + + /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN); + buf[0] = 0x0; // guarantee NUL byte + rc = bpf_probe_read_str(buf, n, addr); */ + alloc, $buf, BPF_MAXSTRINGLEN; + 0x62, $buf, -, -, 0x0; /* stw [buf+0], 0 -- guarantee NUL byte */ + call, $rc, probe_read_str, $buf, $n, $addr; /* TODO: should work with bpf_probe_read_str too */ + + /* TODO pending implementation of error */ + /* if (rc < 0) error("...", addr); */ + /*0x35, $rc, 0, _done, -; /* jge rc, 0, _done */ + /*error, "kernel string copy fault at 0x%p [man error::fault]", $addr; /* TODO document bpf version of error::fault */ + /*label, _done;*/ + + /* return buf; */ + 0xbf, $$, $buf, -, -; /* mov $$, buf */ +%} + +// TODO kernel_string_utf32:string(addr:long) +// TODO kernel_string_utf32:string(addr:long,err_msg:string) +// TODO kernel_string2_utf32:string(addr:long,err_msg:string) +// TODO kernel_string_quoted_utf32:string(addr:long) + +// TODO kernel_string_utf16:string(addr:long) +// TODO kernel_string_utf16:string(addr:long,err_msg:string) +// TODO kernel_string2_utf16:string(addr:long,err_msg:string) +// TODO kernel_string_quoted_utf16:string(addr:long) + +// TODO kernel_long:long(addr:long) +// TODO kernel_int:long(addr:long) +// TODO kernel_short:long(addr:long) +// TODO kernel_char:long(addr:long) + +// TODO kernel_pointer:long(addr:long) + +// TODO kernel_buffer_quoted:string(addr:long,inlen:long) +// TODO kernel_buffer_quoted:string(addr:long,inlen:long,outlen:long) +// TODO kernel_buffer_quoted_error:string(addr:long,inlen:long,outlen:long) -- 2.14.5