iovisor / iovisor/bcc

PT_REGS_PARM macro does not seem to return function arguments in attach_uprobe

Open
#3,056 16 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Trying to instrument memcpy from standard C library using an uprobe and extract the destination and size arguments.
memcpy(dest, src, size) - I assume PT_REGS_PARM1 hods the first arg (dest) and PT_REGS_PARM3 holds the size.

char buf[256] = {};
u64 size;
bpf_probe_read(&buf, sizeof(buf), (void *)PT_REGS_PARM1(ctx));
bpf_probe_read(&size, sizeof(size), (void *)PT_REGS_PARM3(ctx));
bpf_trace_printk("buf: %lx, size: %ld\\n",buf, size);

Output of a simple memcpy program:
PID 71137: Memcopying 268435456 bytes from 0x7fbb228d9010 to 0x7fbb208d8010

Kernel trace output:
<...>-73117 [050] .... 3892834.828501: 0: buf: ffffb6c70d31fba0, size: 0

Am I using the trace flags incorrectly, since the trace output seems off.

Thanks in advance,
Harshad

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the PT_REGS_PARM macros and the attach_uprobe entry point, then reproduce the memcpy example described in the issue. Compare the arguments reported by the traced program with the values extracted in the kernel trace, including the trace output for buf and size. Done means the cause of the mismatch is identified and argument extraction is verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
observability
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.