Bpftrace: Why retval of exit clone syscall tracepoint is always returning the same value?

[paulofelipefeitosa]

The exit clone syscall tracepoint retval is always returning the same value _-1994375301_ that appears to be a pointer. Is there any easy way to get this value or will be necessary to use the bcc?

Code:

tracepoint:syscalls:sys_exit_clone / @start_clone[tid] /
{
  $end_clone = nsecs;
  printf("[%d, %d, %d, %lld, %lld] clone\n", retval, pid, tid, @start_clone[tid], $end_clone);
  delete(@start_clone[tid]);
}

Output:

[20487, 20487, 6950155448045, 6950155847465] execve: /sbin/tc
[-1994375301, 17990, 17990, 6950157477825, 6950157634729] clone
[-1994375301, 20488, 20488, 6950158002850, 6950158140018] clone
[20489, 20489, 6950158373255, 6950158759340] execve: /sbin/tc
[-1994375301, 3600, 20485, 6956001307380, 6956001352575] clone
[-1994375301, 14895, 15197, 6958003072259, 6958003111402] clone
[-1994375301, 3408, 20134, 6961001645335, 6961001690650] clone
[-1994375301, 14871, 20047, 6962005256370, 6962005297988] clone

[caringi]

I think this "-1994375301" value is garbage...

If I am not mistaken, what you want here is args->ret instead of retval.

AFAIK retval is for kretprobes/uretprobes.

[paulofelipefeitosa]

Hello @caringi, thank you for helping me! In fact, I am using BCC now. Should not this detail be in the reference guide or somewhere in the README?

[caringi]

@brendangregg does make sense to use the retval builtin with tracepoints or should this throw an error msg?

[brendangregg]

I think it should throw an error message that says something like "retval is invalid in tracepoints; some provide an args->ret instead"

[caringi]

I think this issue can be closed now, right?

[paulofelipefeitosa]

I agree with you @caringi !