How to get the value of go arguments interface{} in bpf?

[minimAluminiumalism]

I'm trying to a new instrument probe for a package, the target function attached the probe is:

func (c cmdable) Set(ctx context.Context, key string, value interface{}, expiration time.Duration) *StatusCmd

I successfully obtained the arg key with following code:

u64 key_ptr_pos = 4;
u64 key_len_ptr_pos = 5;
void *set_key_ptr = get_argument(ctx, key_ptr_pos);
u64 key_str_len = (u64)get_argument(ctx, key_len_ptr_pos);
u64 query_size = MAX_QUERY_SIZE < key_str_len ? MAX_QUERY_SIZE : key_str_len;
bpf_probe_read(key_str, query_size, set_key_ptr);

But I I encountered difficulties in obtaining another arg value which is interface{} type. I searched through all the code in your project but not found any related functions like the above function. Could you provide some guidance?

[damemi]

Does #1176 help?

[minimAluminiumalism]

@damemi The difficulty is how can I get the type of the interface param?

[minimAluminiumalism]

@MrAlias Can you give some guidance about obtaining the interface{} type args?
Here is the function I want to add a probe to.
I can get the forth arg value when I ensure the data type is string, but the actual type is interface{}.
So I need the get the arg type first and then get the data? I have tried but failed to obtain the type.

Or do I need to first obtain the address of the data in kernel mode, then send it(bpf_perf_event_output) to user mode for parsing?

[MrAlias]

@minimAluminiumalism I am not sure how to achieve this.

You will need to parse the itab._type and dynamically reconstruct the type pointed to by the interface's data field. Essentially, you will need to recreate the Go runtime implementation in C.

This is something that has blocked prior tasks and caused us to search alternate solutions.

For what its worth, https://cmc.gitbook.io/go-internals/chapter-ii-interfaces provides a good overview of how the runtime package produces assembly code that will do the thing you need to do. Hopefully it is a decent jumping off point. Good luck.