[SOLVED] kprobe_events fetch arguments doesn't work on ARM

kprobe_events fetch arguments doesn't work on ARM

The following kprobe_based event example works well:

$ echo 'p:myprobe do_sys_open' > /sys/kernel/debug/tracing/kprobe_events

But, adding fetching arguments doesn't work:

$ echo 'p:myprobe do_sys_open dfd=%ax filename=%dx flags=%cx mode=+4($stack)' > /sys/kernel/debug/tracing/kprobe_events 
Invalid argument

I think that the problem is %ax, %dx... What is their meaning? And how can I make this code work?

Solution

%ax, %dx, etc. refer to the registers of your system. As hinted in the documentation, you'll need to change these if your architecture is not x86:

Note, which register/stack entry is assigned to each function argument depends on arch-specific ABI.

Since it looks like you're on arm (raspberry-pi tag), you can use the following:

$ echo 'p:myprobe do_sys_open dfd=%r0 filename=%r1 flags=%r2 mode=%r3' > /sys/kernel/debug/tracing/kprobe_events