Passing large arguments by value breaks argument location assumptions

[andrewstrohman]

I've been thinking about the calling conventions for argument types that are larger than 8 bytes. It's not something that is common -- usually programmers will just pass a pointer instead of a large struct by value for performance reasons. But if the function we are probing is written to pass large arguments by value, it breaks our assumptions about where to find the function's arguments.

When the argument size is 16 bytes, a pair of registers is used for single argument, effectively shifting the subsequent argument to the right in terms of which register we expect to find them. On x86_64, if the argument is even larger, then the argument is stored on the stack, and no register is used for it, effectively shifting the subsequent arguments to left in terms of which register we expect to find them.

Here is an example that demonstrates this for the 16 bytes case:

#include <stdio.h>


typedef struct bigGuy {
        long a;
        long b;
} bigGuy_t;


__attribute__((noinline)) int func(bigGuy_t first, int second) {
        printf("second:%d\n", second);
}


int main(int argc, char **argv) {
        bigGuy_t bg = {.a=1, .b=2};
        func(bg, 7);
}

policy:
metadata:
  name: "uprobe"
spec:
  uprobes:
  - path: "/host/src/test2"
    symbols:
    - "func"
    args:
    - index: 1
      type: "int32"

The resulting event has:
args":[{"int_arg":2} when the user would expect to see 7.