Bpftrace: Arm64: function arguments/register definitions broken

[Brother-Lal]

Hello!

I am currently using bpftrace/bcc on arm64(Yocto, Kernel version 4.14.35), for a small paper to correlate some latency measurements.
It's holding up very nice, and I'm getting some nice data from it, but I encountered some weirdness on my test machine and wanted to report that.

It seems to me that the function argument handling for kprobes/the register definitions for arm64 are not correct/non-existent:

root@arm64qemu:~# bpftrace -e 'kprobe:do_sys_open { printf("%s: %s\n", comm, str(arg1)) }'
Attaching 1 probe...
touch: 
touch: 
touch: 
<-snip>

It might have something to do with bpftrace not recognizing the architecture(Which could be a compile error on my side?):

root@arm64-qemu:~# bpftrace -e 'kprobe:do_sys_open { printf("%s: %s\n", comm, str(reg("r16"))) }'
'r16' is not a valid register on this architecture (x86_64)

For now, one workaround i found is to use the x86_64 register definitions, and just correlate register positions somehow to the armv8 registers containing the function arguments: (arg0->r15,arg1->r14,...)

root@arm64-qemu:~# bpftrace -e 'kprobe:do_sys_open { printf("%s: %s\n", comm, str(reg("r14"))) }'
Attaching 1 probe...
touch: /usr/local/lib/tls/aarch64/cpuid/libc.so.6
touch: /usr/local/lib/tls/aarch64/libc.so.6
<...>
touch: /lib/libc.so.6
touch: /tmp/foo

As I found no aarch64 register definitions in "src/arch/", I assume this for now is a missing feature and wanted to post the workaround - if my compile is broken, please correct me!

Greetings,

Brother Lal

[brendangregg]

Thanks for the workaround. I'm not sure any of us have access to an arm system yet to debug further and work on a fix, so if you or someone else reading this would like to help, please do.

[zlim]

@brendangregg would it help if we enabled access to arm64 system for bpftrace developers?

[vielmetti]

@brendangregg @Brother-Lal I am happy to get access to arm64 gear through @worksonarm - https://worksonarm.com/cluster and https://github.com/worksonarm/cluster have resources.

[AGSaidi]

This seems pretty straightforward. I'll work on a patch

[AGSaidi]

393 successfully builds in the docker container on an Arm host and the command above works correctly:

$ uname -m
aarch64

$ sudo ./bpftrace -e 'kprobe:do_sys_open { printf("%s: %s\n", comm, str(arg1)) }'

Attaching 1 probe...
irqbalance: /proc/interrupts
irqbalance: /proc/stat
irqbalance: /proc/irq/2/smp_affinity
irqbalance: /proc/irq/9/smp_affinity
irqbalance: /proc/irq/10/smp_affinity

[brendangregg]

fixed by #393