Conversation

bpftrace fun question of the week I’ve been beating my head against for a while now.

Given the following bpftrace program:

tracepoint:syscalls:sys_enter_open,
tracepoint:syscalls:sys_enter_openat
{
        $g = "magic_command_to_exit_trace";
        $s = str(args->filename);
        printf("%s\n", $s);
        if ($s == $g) {
                exit();
        }
}

I get the lovely warning:

WARNING: Addrspace mismatch
    if ($s == $g) {

which I can understand. But what I can’t figure out is how to resolve this (hint, the program works just fine, when opening the “magic” file, the trace exits), as how to turn a literal string into the proper address space that args->filename is?

I’ve dug into too many bpftrace git commits to try to figure it out, to no luck. Anyone have a hint?

Oh, and if you want to see where this is used, it’s in this “fun” script: https://github.com/gregkh/gregkh-linux/blob/master/scripts/trace_kernel_build.sh

Warning, realpath takes a long time when processing millions of files, be patient when running the script.

1
7
5