Can't read in struct fields even with `bpf_probe_read`: -EFAULT
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
I'm trying to trace parts of the scheduler, and am running into an issue related to #188. The solution suggested there was to have multiple iterations of `bpf_probe_read`, but that function is returning `-EFAULT` on the third iteration below. Maybe I am missing something obvious? Any help would be greatly appreciated.
```
text = """
// ...
// For tracing sleep (including io, which is also tracked separately) and blocked time.
// We can't directly trace enqueue_sleeper, so we trace enqueue_entity
int trace_enqueue_entity(struct pt_regs *ctx, struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
{
u32 pid = bpf_get_current_pid_tgid();
// enqueue_sleeper only fired if we have ENQUEUE_WAKEUP
if (!(flags & ENQUEUE_WAKEUP))
return 0;
if (se->statistics.sleep_start) {
u64 res = 0;
struct cfs_rq *cfs_rqp = 0;
struct rq *rqp = 0;
u64 rq_clock = 0;
if ((res = bpf_probe_read(&cfs_rqp, sizeof(cfs_rqp), &cfs_rq))) {
bpf_trace_printk("bpf_probe_read 1 failed: %d\\n", res);
return 0;
}
if ((res = bpf_probe_read(&rqp, sizeof(rqp), &cfs_rqp->rq))) {
bpf_trace_printk("bpf_probe_read 2 failed: %d\\n", res);
return 0;
}
if ((res = bpf_probe_read(&rq_clock, sizeof(rq_clock), &rqp->clock))) {
bpf_trace_printk("bpf_probe_read 3 failed: %d\\n", res);
return 0;
}
// ...
}
// ...
}
"""
b = BPF(text=text)
b.attach_kprobe(event="enqueue_entity", fn_name="trace_enqueue_entity")
try:
while True:
(_, _, _, _, _, msg) = b.trace_fields()
print(msg)
```
Results:
```
bpf_probe_read 3 failed: -14
bpf_probe_read 3 failed: -14
bpf_probe_read 3 failed: -14
...
```
Version information:
```
$ uname -a
Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
$ dpkg -s bcc-tools
0.1.8-291.git.5815f41
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.