Skip to content

Commit 35d1766

Browse files
Tests: probe_read_kernel into a scalar, shared ctx names, map value compares
1 parent 1dfb22d commit 35d1766

4 files changed

Lines changed: 106 additions & 0 deletions

File tree

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# A comparison with a map value compares what the map holds, on either side:
2+
# `head == body.lookup(1)` with both sides map lookups used to compare the two
3+
# entries' addresses.
4+
from ctypes import c_int64, c_uint64, c_void_p
5+
from pythonbpf import bpf, map, section, bpfglobal, compile
6+
from pythonbpf.maps import HashMap
7+
8+
9+
@bpf
10+
@map
11+
def body() -> HashMap:
12+
return HashMap(key=c_uint64, value=c_uint64, max_entries=10)
13+
14+
15+
@bpf
16+
@section("tracepoint/syscalls/sys_enter_getppid")
17+
def prog(ctx: c_void_p) -> c_int64:
18+
head = body.lookup(0)
19+
if head == body.lookup(1):
20+
return c_int64(1)
21+
k = 3
22+
if body.lookup(2) == body.lookup(k):
23+
return c_int64(2)
24+
return c_int64(0)
25+
26+
27+
@bpf
28+
@bpfglobal
29+
def LICENSE() -> str:
30+
return "GPL"
31+
32+
33+
compile()
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# probe_read_kernel into a scalar reads the scalar's width, and the source may
2+
# be an address held in a register field (C: (void *)ctx->si). bpfsnake reads
3+
# one typed byte this way: `@key = *((int8*)arg1)`.
4+
from ctypes import c_int8, c_int64
5+
from pythonbpf import bpf, section, bpfglobal, compile
6+
from pythonbpf.helper import probe_read_kernel
7+
from vmlinux import struct_pt_regs
8+
9+
10+
@bpf
11+
@bpfglobal
12+
def last() -> c_int64:
13+
return c_int64(0)
14+
15+
16+
# pty_write(struct tty_struct *tty, const u8 *buf, size_t c)
17+
@bpf
18+
@section("kprobe/pty_write")
19+
def prog(ctx: struct_pt_regs) -> c_int64:
20+
global last
21+
if ctx.dx == 1:
22+
byte = c_int8(0)
23+
probe_read_kernel(byte, ctx.si)
24+
last = byte
25+
return c_int64(0)
26+
27+
28+
@bpf
29+
@bpfglobal
30+
def LICENSE() -> str:
31+
return "GPL"
32+
33+
34+
compile()
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Two programs whose context parameters share a name and a vmlinux type. Their
2+
# debug info used to share one cached DILocalVariable, scoped to both
3+
# functions, and llvmlite recursed forever hashing the resulting cycle.
4+
from ctypes import c_int64
5+
from pythonbpf import bpf, section, bpfglobal, compile
6+
from vmlinux import struct_pt_regs
7+
8+
9+
@bpf
10+
@section("kprobe/do_unlinkat")
11+
def first(ctx: struct_pt_regs) -> c_int64:
12+
return c_int64(0)
13+
14+
15+
@bpf
16+
@section("kprobe/do_rmdir")
17+
def second(ctx: struct_pt_regs) -> c_int64:
18+
return c_int64(0)
19+
20+
21+
@bpf
22+
@bpfglobal
23+
def LICENSE() -> str:
24+
return "GPL"
25+
26+
27+
compile()

‎tests/test_signedness_ir.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,18 @@
9393
[r"deref_0_not_null", r"ret i64 %"],
9494
[r"ret i64\*"],
9595
),
96+
# One byte, sized from the c_int8 destination, read from the address in
97+
# a register field.
98+
"vmlinux/probe_read_kernel_scalar.py": (
99+
[r'%"byte" = alloca i8', r"inttoptr i64 .* to i8\*", r"i32 1, i8\*"],
100+
[],
101+
),
102+
# Both sides of each comparison are loaded before the compare; the
103+
# pointers into the map are never compared themselves.
104+
"assign/map_value_compare.py": (
105+
[r"icmp eq i64 %"],
106+
[r"icmp (eq|ne) i64\* %\S+, %"],
107+
),
96108
}
97109

98110

0 commit comments

Comments
 (0)