pull/773/head
pdliyan 2 years ago
parent f9861aa8cd
commit da29228da3

@ -1,3 +1,5 @@
#[cfg(bpf_target_arch = "arm")]
use aya_bpf_cty::c_long;
use aya_bpf_cty::c_ulonglong;
// aarch64 uses user_pt_regs instead of pt_regs
@ -149,9 +151,7 @@ impl<T> FromPtRegs for *const T {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong)
.try_into()
.unwrap();
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
bpf_probe_read(addr as *const T)
.map(|v| &v as *const _)
.ok()
@ -257,9 +257,7 @@ impl<T> FromPtRegs for *mut T {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong)
.try_into()
.unwrap();
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
bpf_probe_read(addr as *mut T)
.map(|mut v| &mut v as *mut _)
.ok()
@ -368,9 +366,8 @@ macro_rules! impl_from_pt_regs {
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe {
let addr: c_ulonglong = (ctx.uregs[13] + 8 * (n + 1) as c_ulonglong)
.try_into()
.unwrap();
let addr: c_ulonglong =
(ctx.uregs[13] + 8 * (n + 1) as c_long).try_into().unwrap();
bpf_probe_read(addr as *const $type)
.map(|v| v as $type)
.ok()
@ -422,6 +419,15 @@ macro_rules! impl_from_pt_regs {
}
}
fn from_stack_argument(ctx: &pt_regs, n: usize) -> Option<Self> {
unsafe {
let addr: c_ulonglong = ctx.sp + 8 * (n + 1) as c_ulonglong;
bpf_probe_read(addr as *const $type)
.map(|v| v as $type)
.ok()
}
}
fn from_retval(ctx: &pt_regs) -> Option<Self> {
Some(ctx.ra as *const $type as _)
}

@ -3,21 +3,22 @@ use aya::{maps::HashMap, programs::UProbe, Bpf};
#[no_mangle]
#[inline(never)]
pub extern "C" fn trigger_stack_argument(
a_0: u64,
a_1: u64,
a_2: u64,
a_3: u64,
a_4: u64,
a_5: u64,
_a_0: u64,
_a_1: u64,
_a_2: u64,
_a_3: u64,
_a_4: u64,
_a_5: u64,
// in x86_64 arch, for C language, the first 6 integer or pointer argument
// would be passed in registers. The excess arguments would be passed on the stack.
// This conculusion and further reference could be found from:
// https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI
// Notice that other languages, like Golang, or in other archs, like aarch64, may
// have different convention rules.
a_6: u64,
a_7: i64,
_a_6: u64,
_a_7: i64,
) {
core::hint::black_box(trigger_stack_argument);
}
#[tokio::test]
@ -32,8 +33,7 @@ async fn stack_argument() {
prog.load().unwrap();
prog.attach(Some("trigger_stack_argument"), 0, "/proc/self/exe", None)
.unwrap();
let mut args_map: HashMap<_, u32, u64> =
HashMap::try_from(bpf.take_map("ARGS").unwrap()).unwrap();
let args_map: HashMap<_, u32, u64> = HashMap::try_from(bpf.take_map("ARGS").unwrap()).unwrap();
trigger_stack_argument(0, 1, 2, 3, 4, 5, 6, 7);
assert_eq!(args_map.keys().count(), 8);

Loading…
Cancel
Save