iovisor / iovisor/bcc

Can't read in struct fields even with `bpf_probe_read`: -EFAULT

Open
#622 12 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I'm trying to trace parts of the scheduler, and am running into an issue related to #188. The solution suggested there was to have multiple iterations of `bpf_probe_read`, but that function is returning `-EFAULT` on the third iteration below. Maybe I am missing something obvious? Any help would be greatly appreciated.

```
text = """
// ...

// For tracing sleep (including io, which is also tracked separately) and blocked time.
// We can't directly trace enqueue_sleeper, so we trace enqueue_entity
int trace_enqueue_entity(struct pt_regs *ctx, struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
{
u32 pid = bpf_get_current_pid_tgid();

// enqueue_sleeper only fired if we have ENQUEUE_WAKEUP
if (!(flags & ENQUEUE_WAKEUP))
return 0;

if (se->statistics.sleep_start) {
u64 res = 0;
struct cfs_rq *cfs_rqp = 0;
struct rq *rqp = 0;
u64 rq_clock = 0;
if ((res = bpf_probe_read(&cfs_rqp, sizeof(cfs_rqp), &cfs_rq))) {
bpf_trace_printk("bpf_probe_read 1 failed: %d\\n", res);
return 0;
}

if ((res = bpf_probe_read(&rqp, sizeof(rqp), &cfs_rqp->rq))) {
bpf_trace_printk("bpf_probe_read 2 failed: %d\\n", res);
return 0;
}

if ((res = bpf_probe_read(&rq_clock, sizeof(rq_clock), &rqp->clock))) {
bpf_trace_printk("bpf_probe_read 3 failed: %d\\n", res);
return 0;
}
// ...

}
// ...
}
"""

b = BPF(text=text)
b.attach_kprobe(event="enqueue_entity", fn_name="trace_enqueue_entity")

try:
while True:
(_, _, _, _, _, msg) = b.trace_fields()
print(msg)
```

Results:

```
bpf_probe_read 3 failed: -14
bpf_probe_read 3 failed: -14
bpf_probe_read 3 failed: -14
...
```

Version information:

```
$ uname -a
Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
$ dpkg -s bcc-tools
0.1.8-291.git.5815f41
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.