kprobe_events fetch-args works for x86 but not arm64

Question

I wanted to get do_sys_open filename argument as string. For this i added kprobe following kprobetrace.txt. A simple probe which gives filename as hex works for both x86/arm64.

x86: echo 'p:myprobe do_sys_open filename_string=%si' > kprobe_events
arm64: echo 'p:myprobe do_sys_open filename_string=%x1' > kprobe_events

However changing probe to get string for file name works on x86 but not arm64(ie cannot get string representation filename_string=(fault))

x86:

echo 'p:myprobe do_sys_open filename_string=+0(%si):string' > kprobe_events
output: 
adb-30551 [001] d... 4570187.407426: myprobe: (do_sys_open+0x0/0x270) filename_string="/dev/bus/usb/001/001"

arm64:

echo 'p:myprobe do_sys_open filename_string=+0(%x1):string' > kprobe_events
output: 
netd-4621  [001] d...  8491.094187: myprobe: (do_sys_open+0x0/0x24c) filename_string=(fault)

To check if i was using arm ABI correctly i tried setting probe using perf. The probe created by perf as seen from /sys/kernel/debug/tracing/kprobe_events was similar

./perf4.14 probe 'do_sys_open filename:string'
/d/tracing # cat kprobe_events
p:kprobes/myprobe do_sys_open filename_string=+0(%x1):string

But perf probe was also failing (ie filename_string="") in this case.

./perf4.14 record -e probe:do_sys_open -aR sleep 3
/data/local/tmp # ./perf4.14 script
perf4.14  4587 [007]  7490.809036: probe:do_sys_open: (ffffff8337060148) filename_string=""

   sleep  4588 [003]  7490.817937: probe:do_sys_open: (ffffff8337060148) filename_string=""

What would be the correct way to set kprobe_events for arm to fetch args as string? Am i using the ABI incorrectly?

Though the original issue on arm64 remains, i used below as workaround. ie add trace-event somewhere inside function where function args is converted to local var. `+296` offset was taken from perf-probe -v echo "p:myprobe do_sys_open+296 filename=+0(+0(%x19)):string" > /sys/kernel/debug/tracing/kprobe_events — Madhur Rawat, May 02 '19 at 05:54

score 0 · Answer 1 · answered Apr 27 '21 at 20:27

On kernel version >= 4.20, you can use $argN to fetch the N^th function argument. From kernel 4.20 kprobetrace.rst:

 FETCHARGS  : Arguments. Each probe can have up to 128 args.
 .....
 .....
  $argN     : Fetch the Nth function argument. (N >= 1) (\*1)

Since the filename is second argument of do_sys_open(), you should give $arg2 in the kprobe event, like this:

echo 'p:myprobe do_sys_open filename_string=+0($arg2):string' > kprobe_events

This should work on both x86 and arm64.

kprobe_events fetch-args works for x86 but not arm64

1 Answers1