Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

why my "sys_ioctl" of v4l2 is incorrect #5104

Open
Shaquille-Wu opened this issue Sep 12, 2024 · 0 comments
Open

why my "sys_ioctl" of v4l2 is incorrect #5104

Shaquille-Wu opened this issue Sep 12, 2024 · 0 comments

Comments

@Shaquille-Wu
Copy link

Shaquille-Wu commented Sep 12, 2024

I write a program to probe the "sys_ioctl" of v4l2, and my program is very simple, like this:

#include <unistd.h>
#include
#include
#include

#include <bcc_version.h>
#include <BPF.h>
#include <linux/videodev2.h>

const std::string BPF_PROGRAM = R"(
#include <linux/ptrace.h>
int on_sys_ioctl(struct pt_regs *regs, uint32_t fd, uint32_t req) {
bpf_trace_printk("Hello, World! Here I did a sys_ioctl call, %u, %u!\n", fd, req);
return 0;
}
)";

int main() {
ebpf::BPF bpf;
auto init_res = bpf.init(BPF_PROGRAM);
if (!init_res.ok()) {
std::cerr << init_res.msg() << std::endl;
return 1;
}

printf("VIDIOC_DQBUF: %lu, VIDIOC_QBUF: %lu, %lu\n", VIDIOC_DQBUF, VIDIOC_QBUF, sizeof(VIDIOC_QBUF));

std::ifstream pipe("/sys/kernel/debug/tracing/trace_pipe");
std::string line;
std::string clone_fnname = bpf.get_syscall_fnname("ioctl");

printf("clone_fnname: %s\n", clone_fnname.c_str());

auto attach_res = bpf.attach_kprobe(clone_fnname, "on_sys_ioctl");
if (!attach_res.ok()) {
std::cerr << attach_res.msg() << std::endl;
return 1;
}

std::cout << "Starting HelloWorld with BCC " << LIBBCC_VERSION << std::endl;

while (true) {
if (std::getline(pipe, line)) {
if(std::string("") != line){
std::cout << "cur_line: " << line << std::endl;
}
} else {
std::cout << "Waiting for a sys_clone event" << std::endl;
}
}

return 0;
}

it run normally,

my taget is filtering the "VIDIOC_DQBUF" and "VIDIOC_QBUF"

but, I found the "fd" and "req" is incorrect, like this:
cur_line: simple_test_isp-3102 [005] d...2.. 11705.850734: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.850776: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.850872: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.850905: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.850924: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.862863: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.862910: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.862988: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.863006: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!
cur_line: simple_test_isp-3102 [005] d...2.. 11705.863019: bpf_trace_printk: Hello, World! Here I did a sys_ioctl call, 372686512, 271410580!

the "fd" and "req" cannot match the ground trueth value in my v4l2 program.
for exmpale, the "fd" should be 9, instead of 372686512 from eBPF, the req should be 3227014673(VIDIOC_DQBUF) or 3227014671(VIDIOC_QBUF), instead of 271410580.

my platform is ubuntu 20.04, and aarch64.

I don't know why I cannot grab the correct "fd" and "req" for the sys_ioctl?

Is there anyone would like to teach me the secret?

@Shaquille-Wu Shaquille-Wu changed the title about "sys_ioctl" why my "sys_ioctl" of v4l2 is incorrect Sep 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant