Skip to content

Commit 03891f9

Browse files
derekparkerclaude
andcommitted
proc/internal/ebpf: clarify pointer/slice deref_val limitations
Explain why we display raw addresses instead of dereferenced values: element type info isn't propagated through the eBPF pipeline, and deref_val is limited to 48 bytes which is insufficient for nested or variable-length types. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent a61c5fa commit 03891f9

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

pkg/proc/internal/ebpf/helpers.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -230,18 +230,19 @@ func parseFunctionParameterList(rawParamBytes []byte) RawUProbeParams {
230230
}
231231
case reflect.Ptr, reflect.UnsafePointer:
232232
// Display the raw pointer address as a uintptr value.
233-
// The eBPF probe captures the dereferenced data into deref_val,
234-
// but loadValue runs Go-side after the probe returns and tries
235-
// to follow pointer chains through fake memory, which fails.
236-
// Displaying the address is the safe fallback.
233+
// The eBPF probe captures dereferenced data into deref_val
234+
// (up to 0x30 bytes), but we can't use it here because:
235+
// 1) loadPtr needs the element type, which isn't propagated
236+
// through the eBPF pipeline (only Kind and Size are sent)
237+
// 2) deref_val is limited to 48 bytes, insufficient for
238+
// nested or variable-length pointed-to types
237239
iparam.Kind = reflect.Uintptr
238240
iparam.RealType = &godwarf.UintType{BasicType: godwarf.BasicType{CommonType: godwarf.CommonType{ByteSize: int64(ret.size), ReflectKind: reflect.Uintptr}}}
239241
case reflect.Slice:
240242
// Display the slice data pointer address as a uintptr value.
241-
// The eBPF probe captures element data into deref_val, but
242-
// loadValue runs Go-side after the probe and tries to load
243-
// slice elements through fake memory, which fails.
244-
// Displaying the data pointer address is the safe fallback.
243+
// Same limitations as pointers above: element type info is
244+
// not available, and deref_val (48 bytes) can only hold a
245+
// few elements.
245246
iparam.Kind = reflect.Uintptr
246247
iparam.RealType = &godwarf.UintType{BasicType: godwarf.BasicType{CommonType: godwarf.CommonType{ByteSize: 8, ReflectKind: reflect.Uintptr}}}
247248
case reflect.String:

0 commit comments

Comments
 (0)