Android bpf_probe_read_kernel Failed

[Youlor]

Env:
Android10, arm64, kernel4.9.210, bcc 0.16.0

cmd:
python3 trace 'compat_sys_execve "%s", arg1' -v`

output:
arg1 is empty string, and I found bpf_probe_read_kernel return -14

How to solved it? Thank you!

[nagmat1]

It seems to be you are encountering page fault. It returns -14 because of page fault while reading the content. Bpf_probe_read() helper disables page_fault during reading. Try to use kretprobe, since in kprobe get the necessary info and in kretprobe, you do actual reading.

[Youlor]

I solved it, by reference those links:
#2253, https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md, https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=6ae08ae3dea2cfa03dd3665a3c8475c2d429ef47, https://stackoverflow.com/questions/20836536/why-do-i-get-a-zero-android-kernel-address

We should copy bpf_probe_read_user related source code in the linux kernel source code tree https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=6ae08ae3dea2cfa03dd3665a3c8475c2d429ef47 to Android kernel source code