tapset/bpf/conversions.stp

   1 // conversions tapset -- eBPF version
   2 // Copyright (C) 2018 Red Hat Inc.
   3 //
   4 // This file is part of systemtap, and is free software.  You can
   5 // redistribute it and/or modify it under the terms of the GNU General
   6 // Public License (GPL); either version 2, or (at your option) any
   7 // later version.
   8
   9 /**
  10  * sfunction kernel_string - Retrieves string from kernel memory
  11  * @addr: The kernel address to retrieve the string from
  12  *
  13  * Description: This function returns the null terminated C string
  14  * from a given kernel memory address. Reports an error on string
  15  * copy fault.
  16  */
  17 function kernel_string:string (addr:long) {
  18   return kernel_string_n(addr, 64 /*TODO: define BPF_MAXSTRINGLEN*/)
  19 }
  20
  21 // TODO kernel_string:string(addr:long, err_msg:string)
  22 // TODO kernel_string2:string(addr:long, err_msg:string)
  23
  24 /**
  25  * sfunction kernel_string - Retrieves string from kernel memory with alternative error string
  26  * @addr: The kernel address to retrieve the string from
  27  * @err_msg: The error message to return when data isn't available
  28  *
  29  * Description: This function returns the null terminated C string
  30  * from a given kernel memory address. Reports the given error message
  31  * on string copy fault.
  32  */
  33 function kernel_string:string (addr:long, err_msg:string)
  34 %{ /* bpf */ /* pure */
  35   /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN);
  36      buf[0] = 0x0; // guarantee NUL byte
  37      rc = bpf_probe_read_str(buf, BPF_MAXSTRINGLEN, addr); */
  38   alloc, $buf, BPF_MAXSTRINGLEN;
  39   0x62, $buf, -, -, 0x0; /* stw [$buf+0], 0x0 -- guarantee NUL byte */
  40   call, $rc, probe_read_str, $buf, BPF_MAXSTRINGLEN, $addr;
  41
  42   /* if (rc < 0) return err_msg;
  43      return buf; */
  44   0xa5, $rc, 0, _err, -; /* jlt $rc, 0, _err */
  45   0xbf, $$, $buf, -, -; /* mov $$, $buf */
  46   0x05, -, -, _done, -; /* ja _done; */
  47
  48   label, _err;
  49   0xbf, $$, $err_msg, -, -; /* mov $$, $err_msg */
  50
  51   label, _done;
  52 %}
  53 function kernel_string2:string (addr:long, err_msg:string) {
  54   return kernel_string(addr, err_msg);
  55 }
  56
  57 // TODO kernel_string_quoted:string(addr:long) -- requires pseudo-loop to quote unprintable chars
  58
  59 /**
  60  * sfunction kernel_string_n - Retrieves string of given length from kernel memory
  61  * @addr: The kernel address to retrieve the string from
  62  * @n: The maximum length of the string (if not null terminated)
  63  *
  64  * Description: Returns the C string of a maximum given length from a
  65  * given kernel memory address. Reports an error on string copy fault.
  66  */
  67 function kernel_string_n:string (addr:long, n:long)
  68 %{ /* bpf */ /* pure */
  69   /* if (n > BPF_MAXSTRINGLEN) n = BPF_MAXSTRINGLEN; */
  70   0xb5, $n, -, _skip, BPF_MAXSTRINGLEN; /* jle n, BPF_MAXSTRINGLEN, _skip */
  71   0xb7, $n, -, -, BPF_MAXSTRINGLEN; /* mov $n, BPF_MAXSTRINGLEN */
  72
  73   label, _skip;
  74   /* buf = bpf_stk_alloc(BPF_MAXSTRINGLEN);
  75      buf[0] = 0x0; // guarantee NUL byte
  76      rc = bpf_probe_read_str(buf, n, addr); */
  77   alloc, $buf, BPF_MAXSTRINGLEN;
  78   0x62, $buf, -, -, 0x0; /* stw [buf+0], 0 -- guarantee NUL byte */
  79   call, $rc, probe_read_str, $buf, $n, $addr; /* TODO: should work if the helper is named bpf_probe_read_str() too */
  80
  81   /* if (rc < 0) error("...", addr); */
  82   0x35, $rc, 0, _done, -; /* jge rc, 0, _done */
  83   call, -, printf, "ERROR: kernel string copy fault at 0x%p [man error::fault]", $addr; /* TODO document stapbpf version of error::fault */
  84   call, -, exit;
  85
  86   label, _done;
  87   /* return buf; */
  88   0xbf, $$, $buf, -, -; /* mov $$, buf */
  89 %}
  90
  91 // TODO kernel_string_utf32:string(addr:long)
  92 // TODO kernel_string_utf32:string(addr:long,err_msg:string)
  93 // TODO kernel_string2_utf32:string(addr:long,err_msg:string)
  94 // TODO kernel_string_quoted_utf32:string(addr:long)
  95
  96 // TODO kernel_string_utf16:string(addr:long)
  97 // TODO kernel_string_utf16:string(addr:long,err_msg:string)
  98 // TODO kernel_string2_utf16:string(addr:long,err_msg:string)
  99 // TODO kernel_string_quoted_utf16:string(addr:long)
 100
 101 // TODO kernel_long:long(addr:long)
 102 // TODO kernel_int:long(addr:long)
 103 // TODO kernel_short:long(addr:long)
 104 // TODO kernel_char:long(addr:long)
 105
 106 // TODO kernel_pointer:long(addr:long)
 107
 108 // TODO kernel_buffer_quoted:string(addr:long,inlen:long)
 109 // TODO kernel_buffer_quoted:string(addr:long,inlen:long,outlen:long)
 110 // TODO kernel_buffer_quoted_error:string(addr:long,inlen:long,outlen:long)