iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.36k stars 3.86k forks source link

PT_REGS_PARM1 return value is not "this" pointer when uprobing C++ class function #5058

Open ZhangJiaQiao opened 2 months ago

ZhangJiaQiao commented 2 months ago

What I want to probe is MongoDB server 'ServiceEntryPointMongod::handleRequest' function. 'this' pointer should be the first argument of the function. However, I used bcc 'PT_REGS_PARM1' macro to get the first argument of the function and found that it was not 'this' pointer. Finally, I got the 'this' pointer by the 'PT_REGS_PARM1' macro successfully as showed below.

image

image

And my question is what is the first argument I got and why 'this' pointer is the second argument.