usdt: unrecognized arg #0

[fleitz]

Trying to get a USDT program to attach, but when it's attached it fails with the error.

libbpf: usdt: unrecognized arg #0 spec '8@(%rsp) 8@8(%rsp) 8@16(%rsp) -4@24(%rsp)'
libbpf: prog 'ruby_method_usdt_helper': failed to auto-attach: -22

I've tried removing all the arguments, as well as not using the helper and only using pt_regs, but it all fails with the same error.

Trying to attach to this USDT: https://github.com/ruby/ruby/blob/d92f09a5eea009fa28cd046e9d0eb698e3d94c5c/probes.d#L15

SEC("usdt//lib/x86_64-linux-gnu/libruby-3.0.so.3.0:ruby:method__entry")
int BPF_USDT(ruby_method_usdt_helper, int clazz, int method, int filename, int fileno){
    return 0;
}

SEC("usdt//lib/x86_64-linux-gnu/libruby-3.0.so.3.0:ruby:method__entry")
int ruby_method_pt_regs(struct pt_regs *ctx) {
    return 0;
}

Running on Ubuntu 22.04, libbpf v1.0.0, and Kernel 5.18.10-76051810-generic

[fleitz]

If it helps, attaching USDTs to python works fine...

SEC("usdt//usr/bin/python3.10:python:function__entry")
int BPF_USDT(python_method, char* filename, char* method, int lineno){
    return 0;
}

[anakryiko]

It's probably "8@(%rsp)" is not parsed because libbpf expects "8@0(%rsp)". Will you be able to submit the fix or we should find someone else to work on a fix?

[fleitz]

I can work on a fix, especially now that I know what the issue is. If I can fix it I'll submit a patch / PR.

Question, does the PR go here or should it go into the Linux Kernel? My understanding is libbpf is extracted out of the kernel, correct?

[fleitz]

Read the docs, know where to submit the patches :)

[fleitz]

Does this look right to you? After I added this the program can now auto-attach but never gets called when I run ruby.

The items I'm unsure about are whether USDT_ARG_REG_DEREF is the right arg type, and whether val_off should be set to 0, I'm pretty sure about val_off but definitely have no idea if USDT_ARG_REG_DEREF is right.

} else if (sscanf(arg_str, " %d @ ( %%%m[^)] ) %n", &arg_sz, &reg_name, &len) == 2) {
        /* Memory dereference case, e.g., 8@(%rsp) */
        arg->arg_type = USDT_ARG_REG_DEREF;
		arg->val_off = 0;
		reg_off = calc_pt_regs_off(reg_name);
		free(reg_name);
		if (reg_off < 0)
			return reg_off;
		arg->reg_off = reg_off;
    }

[anakryiko]

It's probably best to combine this with the first usecase (where offset is explicit), and just make sure that offset is zero if it's this new form. And yes, please send patch to bpf@vger.kernel.org

[0xB10C]

Running into the same problem with 8@(%rsp). @fleitz let me know if your still working on this and need help testing. Otherwise I might pick this up.

[fleitz]

Our code is here: https://github.com/containiq/libbpf These patches fixed the parsing issue but it would also sometimes crash the ruby VM so it probably has bugs. Also, the probes never fired so there's something I'm missing in how this code operates.