BCC parameters on stack

[pkropachev]

Hi!

Just to familiar with BCC I'm tracing (kprobe) the function of Intel Wi-Fi driver. Function takes quite a lot of parameters. During attempt to run BCC program using Python I get the following error:

/virtual/main.c:4:99: error: too many arguments, bcc only supports in-register parameters

b = BPF(text="""
#include <uapi/linux/ptrace.h>

int kprobe____iwl_dbg(struct pr_regs *ctx, int a, int b, int c, int d, const char *fmt, int val0, int val1, int val2) {
    bpf_trace_printk("%d %d %d %s\\n", val0, val1, val2, fmt);
    return 0;
}
""")

With bpftrace I can use sargX to get arguments out of CPU registers.

bpftrace -e 'k:__iwl_dbg /str(arg4) == "energy In A %d B %d, and max %d\n"/ { printf("A: %d, B: %d, max: %d\n", arg5, sarg0, sarg1); }'

Could you please advice how I can get value of arguments located out of CPU registers?
Thanks!

[chenhengqi]

Use macro PT_REGS_SP to get stack pointer and then use bpf_probe_read helper to read arguments on the stack.