pull/773/head
pdliyan 2 years ago
parent f9861aa8cd
commit da29228da3

@ -1,3 +1,5 @@
#[cfg(bpf_target_arch = "arm")]
use aya_bpf_cty::c_long;
use aya_bpf_cty::c_ulonglong; use aya_bpf_cty::c_ulonglong;
// aarch64 uses user_pt_regs instead of pt_regs // aarch64 uses user_pt_regs instead of pt_regs
@ -149,9 +151,7 @@ impl<T> FromPtRegs for *const T {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> { fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe { unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong) let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
.try_into()
.unwrap();
bpf_probe_read(addr as *const T) bpf_probe_read(addr as *const T)
.map(|v| &v as *const _) .map(|v| &v as *const _)
.ok() .ok()
@ -257,9 +257,7 @@ impl<T> FromPtRegs for *mut T {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> { fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe { unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong) let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
.try_into()
.unwrap();
bpf_probe_read(addr as *mut T) bpf_probe_read(addr as *mut T)
.map(|mut v| &mut v as *mut _) .map(|mut v| &mut v as *mut _)
.ok() .ok()
@ -368,9 +366,8 @@ macro_rules! impl_from_pt_regs {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> { fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe { unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong) let addr: c_ulonglong =
.try_into() (ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
.unwrap();
bpf_probe_read(addr as *const $type) bpf_probe_read(addr as *const $type)
.map(|v| v as $type) .map(|v| v as $type)
.ok() .ok()
@ -422,6 +419,15 @@ macro_rules! impl_from_pt_regs {
} }
} }
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe {
let addr: c_ulonglong = ctx.sp + 8 * (n + 1) as c_ulonglong;
bpf_probe_read(addr as *const $type)
.map(|v| v as $type)
.ok()
}
}
fn from_retval(ctx: &pt_regs) -> Option<Self> { fn from_retval(ctx: &pt_regs) -> Option<Self> {
Some(ctx.ra as *const $type as _) Some(ctx.ra as *const $type as _)
} }

@ -3,21 +3,22 @@ use aya::{maps::HashMap, programs::UProbe, Bpf};
#[no_mangle] #[no_mangle]
#[inline(never)] #[inline(never)]
pub extern "C" fn trigger_stack_argument( pub extern "C" fn trigger_stack_argument(
a_0: u64, _a_0: u64,
a_1: u64, _a_1: u64,
a_2: u64, _a_2: u64,
a_3: u64, _a_3: u64,
a_4: u64, _a_4: u64,
a_5: u64, _a_5: u64,
// in x86_64 arch, for C language, the first 6 integer or pointer argument // in x86_64 arch, for C language, the first 6 integer or pointer argument
// would be passed in registers. The excess arguments would be passed on the stack. // would be passed in registers. The excess arguments would be passed on the stack.
// This conculusion and further reference could be found from: // This conculusion and further reference could be found from:
// https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI // https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI
// Notice that other languages, like Golang, or in other archs, like aarch64, may // Notice that other languages, like Golang, or in other archs, like aarch64, may
// have different convention rules. // have different convention rules.
a_6: u64, _a_6: u64,
a_7: i64, _a_7: i64,
) { ) {
core::hint::black_box(trigger_stack_argument);
} }
#[tokio::test] #[tokio::test]
@ -32,8 +33,7 @@ async fn stack_argument() {
prog.load().unwrap(); prog.load().unwrap();
prog.attach(Some("trigger_stack_argument"), 0, "/proc/self/exe", None) prog.attach(Some("trigger_stack_argument"), 0, "/proc/self/exe", None)
.unwrap(); .unwrap();
let mut args_map: HashMap<_, u32, u64> = let args_map: HashMap<_, u32, u64> = HashMap::try_from(bpf.take_map("ARGS").unwrap()).unwrap();
HashMap::try_from(bpf.take_map("ARGS").unwrap()).unwrap();
trigger_stack_argument(0, 1, 2, 3, 4, 5, 6, 7); trigger_stack_argument(0, 1, 2, 3, 4, 5, 6, 7);
assert_eq!(args_map.keys().count(), 8); assert_eq!(args_map.keys().count(), 8);

Loading…
Cancel
Save