add kaddr() call (bpftrace internals tutorial) about bpftrace

[brendangregg]

Note that the one-liner that should work may really be this:

./src/bpftrace -e 'kprobe:do_nanosleep { printf("%x\n", *kaddr("avenrun")); }'

I missed the dereference earlier.

[williangaspar]

This function reads the memory address just like # grep -w avenrun /proc/kallsyms.

My question is where or if I should print the output?

uint64_t BPFtrace::resolve_kname(const char *name)
{
  uint64_t addr = 0;
  std::string file_name = "/proc/kallsyms";

  std::ifstream file(file_name);
  if (file.fail())
  {
    std::cerr << strerror(errno) << ": " << file_name << std::endl;
    return addr;
  }

  std::string line;

  std::string search = "\\b( ";
  search += name;
  std::regex e (search + ")");
  std::smatch match;

  while (std::getline(file, line) && addr == 0)
  {
    auto found = std::regex_search (line, match, e);

    if (found)
    {
      std::string first_word = line.substr(0, line.find(" "));
      addr = std::stoull(first_word, 0, 16);
    }
  }

  return addr;
}```

[brendangregg]

I don't understand your question. I think if you drop that function into the earlier patch, it should all work, right? BPFtrace::resolve_kname() doesn't need to print anything itself, it just needs to return the address.

This should print avenrun's location (as seen in /proc):

# ./src/bpftrace -e 'kprobe:do_nanosleep { printf("%llx\n", kaddr("avenrun")); }'

And this should print the value of avenrun:

# ./src/bpftrace -e 'kprobe:do_nanosleep { printf("%x\n", *kaddr("avenrun")); }'

Shouldn't you call close on file at the end?

[williangaspar]

Ok, # ./src/bpftrace -e 'kprobe:do_nanosleep { printf("%llx\n", kaddr("avenrun")); }' prints what I was expecting.

And yes, I forgot to close the file.

[brendangregg]

I realized the tests/codegen.cpp call_kaddr test may always fail, since it would embed the avenrun location into the test output, which would change between systems. Hm. Unless there's a simple way to fix this, I'd be inclined to delete the call_kaddr test and replace it with a // TODO: test kaddr().