On Thu, 29 Feb 2024 15:38:55 +0900 Masami Hiramatsu (Google) mhiramat@kernel.org wrote:
Hmm, this seems arch_rethook_trampoline caused the issue.
And curiously, it depends on the number of stored data.
OK: /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3' >> dynamic_events /sys/kernel/tracing # echo 1 > events/fprobes/enable
NG: /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3 $arg4' >> dynamic_events /sys/kernel/tracing # echo 1 > events/fprobes/enable
I also confirmed that on 'vfs_write' caused the same result. 3 arguments(24 bytes) is OK, but 4 arguments (32bytes) is NG.
And this may be the fprobe bug. kretprobe events doesn't show this issue.
OK: /sys/kernel/tracing # echo 'r vfs_read $arg*' >> kprobe_events /sys/kernel/tracing # echo 1 > events/kprobes/enable
But this is strange because both uses same rethook...
Thank you,