Bpftrace: Changes in kprobe names and arguments in latest kernels (4.17 or newer)

Created on 5 Feb 2019 · 4Comments · Source: iovisor/bpftrace

The following line from the reference guide (https://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#2-printf-printing) doesn't work in my system (Fedora 29, kernel 4.20):

# bpftrace -e 'kprobe:sys_execve { printf("%s called %s\n", comm, str(arg0)); }'
Attaching 1 probe...
cannot attach kprobe, probe entry may not exist
Error attaching probe: 'kprobe:sys_execve'

There are 2 problems: The first one is very easy to fix, the probe name has changed...

# bpftrace -e 'kprobe:__x64_sys_execve { printf("%s called %s\n", comm, str(arg0)); }'
gio-launch-desk called �e4(�
gio-launch-desk called �e4(�
gio-launch-desk called �e4(�
gio-launch-desk called �e4(�
gio-launch-desk called �e4(�
mate-terminal called ����

The Second problem is related to changes in the arguments, that's the reason of the strange characters above.

docs good first issue

Source

caringi

Most helpful comment

Unless you disagree, I'll change this ticket to: change in syscall function names.

Yes, the syscall function names changed, and we need to update the examples. I wrote those before we had tracepoint arguments, so that particular example now can be:

bpftrace -e 't:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'

As much as possible we should switch these to tracepoints, since then they'll stop breaking.

brendangregg on 5 Feb 2019

👍3

All 4 comments

Unless you disagree, I'll change this ticket to: change in syscall function names.

Yes, the syscall function names changed, and we need to update the examples. I wrote those before we had tracepoint arguments, so that particular example now can be:

bpftrace -e 't:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'

As much as possible we should switch these to tracepoints, since then they'll stop breaking.

brendangregg on 5 Feb 2019

👍3

sudo bpftrace -e 't:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'

doesn't seem to work in kernel v5.2.7 (it does work in 4.19.39). [running this on a debian platform with sid to obtain a recent kernel for additional ebpf ability]

Is this a known issue? Separate ticket for this?

rburkholder on 13 Aug 2019

sudo bpftrace -e 't:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'

doesn't seem to work in kernel v5.2.7 (it does work in 4.19.39). [running this on a debian platform with sid to obtain a recent kernel for additional ebpf ability]

Works on ArchLinux on kernel 5.2.9:

# uname -r
5.2.9-arch1-1-ARCH
# bpftrace -e 't:syscalls:sys_enter_execve { printf("%s called %s\n", comm, str(args->filename)); }'
Attaching 1 probe...
...