PT_REGS_PARM macro does not seem to return function arguments in attach_uprobe
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Trying to instrument memcpy from standard C library using an uprobe and extract the destination and size arguments.
memcpy(dest, src, size) - I assume PT_REGS_PARM1 hods the first arg (dest) and PT_REGS_PARM3 holds the size.
char buf[256] = {};
u64 size;
bpf_probe_read(&buf, sizeof(buf), (void *)PT_REGS_PARM1(ctx));
bpf_probe_read(&size, sizeof(size), (void *)PT_REGS_PARM3(ctx));
bpf_trace_printk("buf: %lx, size: %ld\\n",buf, size);
Output of a simple memcpy program:
PID 71137: Memcopying 268435456 bytes from 0x7fbb228d9010 to 0x7fbb208d8010
Kernel trace output:
<...>-73117 [050] .... 3892834.828501: 0: buf: ffffb6c70d31fba0, size: 0
Am I using the trace flags incorrectly, since the trace output seems off.
Thanks in advance,
Harshad
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the PT_REGS_PARM macros and the attach_uprobe entry point, then reproduce the memcpy example described in the issue. Compare the arguments reported by the traced program with the values extracted in the kernel trace, including the trace output for buf and size. Done means the cause of the mismatch is identified and argument extraction is verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100