Getting empty buffer from `PT_REGS_PARM2(ctx)` in the read, write sys calls about ebpf

[gouravkrosx]

Got it fixed, this issue was related to CONFIG_ARCH_HAS_SYSCALL_WRAPPER enabled on my system due to which i had to first get the context again and then call the other helper functions to get the buffer. And i also used
PT_REGS_PARM1_CORE(ctx) instead of PT_REGS_PARM1(ctx) to get the context.
These core methods are under #include <bpf/bpf_core_read.h>.

SEC("kprobe/sys_read")
int syscall__probe_entry_read(struct pt_regs *ctx)
{
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    if (pid != A_PID)
        return 0;

    struct pt_regs *__ctx = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx);
    if (!__ctx)
    {
        bpf_printk("[sys_read_entry]:failed to load original ctx");
        return 0;
    }

    bpf_printk("[sys_read_entry]:called for [PID:%lu]\n", pid);

    // Stash arguments
    struct data_args_t read_args = {};

    read_args.fd = (int)PT_REGS_PARM1_CORE(__ctx);
    char *read_buf = (char *)PT_REGS_PARM2_CORE(__ctx);

    if (!read_buf)
    {
        bpf_printk("[sys_read_entry]:read buf is null");
        return 0;
    }

    read_args.buf = read_buf;
    bpf_map_update_elem(&active_read_args_map, &id, &read_args, BPF_ANY);
    return 0;
}