On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
to fail with -ENOENT (unrecognized register).

This patch fixes this by implementing the necessary changes:
- add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
- add adaptive support to `__bpf_usdt_arg_type` and
  `__bpf_usdt_arg_spec` to represent SIB addressing parameters.

Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
---
 tools/lib/bpf/usdt.bpf.h | 44 +++++++++++++++++++++++--
 tools/lib/bpf/usdt.c     | 69 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 106 insertions(+), 7 deletions(-)

diff --git a/tools/lib/bpf/usdt.bpf.h b/tools/lib/bpf/usdt.bpf.h
index 2a7865c8e3fe..43deb05a5197 100644
--- a/tools/lib/bpf/usdt.bpf.h
+++ b/tools/lib/bpf/usdt.bpf.h
@@ -34,13 +34,32 @@ enum __bpf_usdt_arg_type {
 	BPF_USDT_ARG_CONST,
 	BPF_USDT_ARG_REG,
 	BPF_USDT_ARG_REG_DEREF,
+	BPF_USDT_ARG_SIB,
 };
 
+/*
+ * This struct layout is designed specifically to be backwards/forward
+ * compatible between libbpf versions for ARG_CONST, ARG_REG, and
+ * ARG_REG_DEREF modes. ARG_SIB requires libbpf v1.7+.
+ */
 struct __bpf_usdt_arg_spec {
 	/* u64 scalar interpreted depending on arg_type, see below */
 	__u64 val_off;
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
 	/* arg location case, see bpf_usdt_arg() for details */
-	enum __bpf_usdt_arg_type arg_type;
+	enum __bpf_usdt_arg_type arg_type: 8;
+	/* index register offset within struct pt_regs */
+	__u16 idx_reg_off: 12;
+	/* scale factor for index register (1, 2, 4, or 8) */
+	__u16 scale_bitshift: 4;
+	/* reserved for future use, keeps reg_off offset stable */
+	__u8 __reserved: 8;
+#else
+	__u8 __reserved: 8;
+	__u16 idx_reg_off: 12;
+	__u16 scale_bitshift: 4;
+	enum __bpf_usdt_arg_type arg_type: 8;
+#endif
 	/* offset of referenced register within struct pt_regs */
 	short reg_off;
 	/* whether arg should be interpreted as signed value */
@@ -149,7 +168,7 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
 {
 	struct __bpf_usdt_spec *spec;
 	struct __bpf_usdt_arg_spec *arg_spec;
-	unsigned long val;
+	unsigned long val, idx;
 	int err, spec_id;
 
 	*res = 0;
@@ -202,6 +221,27 @@ int bpf_usdt_arg(struct pt_regs *ctx, __u64 arg_num, long *res)
 			return err;
 #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
 		val >>= arg_spec->arg_bitshift;
+#endif
+		break;
+	case BPF_USDT_ARG_SIB:
+		/* Arg is in memory addressed by SIB (Scale-Index-Base) mode
+		 * (e.g., "-1@-96(%rbp,%rax,8)" in USDT arg spec). We first
+		 * fetch the base register contents and the index register
+		 * contents from pt_regs. Then we calculate the final address
+		 * as base + (index * scale) + offset, and do a user-space
+		 * probe read to fetch the argument value.
+		 */
+		err = bpf_probe_read_kernel(&val, sizeof(val), (void *)ctx + arg_spec->reg_off);
+		if (err)
+			return err;
+		err = bpf_probe_read_kernel(&idx, sizeof(idx), (void *)ctx + arg_spec->idx_reg_off);
+		if (err)
+			return err;
+		err = bpf_probe_read_user(&val, sizeof(val), (void *)(val + (idx << arg_spec->scale_bitshift) + arg_spec->val_off));
+		if (err)
+			return err;
+#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+		val >>= arg_spec->arg_bitshift;
 #endif
 		break;
 	default:
diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
index 3373b9d45ac4..e5eeac0b0fa4 100644
--- a/tools/lib/bpf/usdt.c
+++ b/tools/lib/bpf/usdt.c
@@ -200,12 +200,23 @@ enum usdt_arg_type {
 	USDT_ARG_CONST,
 	USDT_ARG_REG,
 	USDT_ARG_REG_DEREF,
+	USDT_ARG_SIB,
 };
 
 /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
 struct usdt_arg_spec {
 	__u64 val_off;
-	enum usdt_arg_type arg_type;
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+	enum usdt_arg_type arg_type: 8;
+	__u16	idx_reg_off: 12;
+	__u16	scale_bitshift: 4;
+	__u8 __reserved: 8;     /* keep reg_off offset stable */
+#else
+	__u8 __reserved: 8;     /* keep reg_off offset stable */
+	__u16	idx_reg_off: 12;
+	__u16	scale_bitshift: 4;
+	enum usdt_arg_type arg_type: 8;
+#endif
 	short reg_off;
 	bool arg_signed;
 	char arg_bitshift;
@@ -1283,11 +1294,58 @@ static int calc_pt_regs_off(const char *reg_name)
 
 static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
 {
-	char reg_name[16];
-	int len, reg_off;
-	long off;
+	char reg_name[16] = {0}, idx_reg_name[16] = {0};
+	int len, reg_off, idx_reg_off, scale = 1;
+	long off = 0;
+
+	if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
+			   arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
+		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
+			   arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
+		sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
+			   arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
+		sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
+			   arg_sz, reg_name, idx_reg_name, &len) == 3
+		) {
+		/*
+		 * Scale Index Base case:
+		 * 1@-96(%rbp,%rax,8)
+		 * 1@(%rbp,%rax,8)
+		 * 1@-96(%rbp,%rax)
+		 * 1@(%rbp,%rax)
+		 */
+		arg->arg_type = USDT_ARG_SIB;
+		arg->val_off = off;
+
+		reg_off = calc_pt_regs_off(reg_name);
+		if (reg_off < 0)
+			return reg_off;
+		arg->reg_off = reg_off;
 
-	if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
+		idx_reg_off = calc_pt_regs_off(idx_reg_name);
+		if (idx_reg_off < 0)
+			return idx_reg_off;
+		/* validate scale factor and set fields directly */
+		switch (scale) {
+		case 1:
+			arg->scale_bitshift = 0;
+			break;
+		case 2:
+			arg->scale_bitshift = 1;
+			break;
+		case 4:
+			arg->scale_bitshift = 2;
+			break;
+		case 8:
+			arg->scale_bitshift = 3;
+			break;
+		default:
+			pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
+			return -EINVAL;
+		}
+		arg->idx_reg_off = idx_reg_off;
+	} else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
+				arg_sz, &off, reg_name, &len) == 3) {
 		/* Memory dereference case, e.g., -4@-20(%rbp) */
 		arg->arg_type = USDT_ARG_REG_DEREF;
 		arg->val_off = off;
@@ -1306,6 +1364,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
 	} else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
 		/* Register read case, e.g., -4@%eax */
 		arg->arg_type = USDT_ARG_REG;
+		/* register read has no memory offset */
 		arg->val_off = 0;
 
 		reg_off = calc_pt_regs_off(reg_name);
-- 
2.43.0

On Tue, Aug 26, 2025 at 10:31 PM Jiawei Zhao <phoenix500526@163.com> wrote:
>
> On x86-64, USDT arguments can be specified using Scale-Index-Base (SIB)
> addressing, e.g. "1@-96(%rbp,%rax,8)". The current USDT implementation
> in libbpf cannot parse this format, causing `bpf_program__attach_usdt()`
> to fail with -ENOENT (unrecognized register).
>
> This patch fixes this by implementing the necessary changes:
> - add correct handling for SIB-addressed arguments in `bpf_usdt_arg`.
> - add adaptive support to `__bpf_usdt_arg_type` and
>   `__bpf_usdt_arg_spec` to represent SIB addressing parameters.
>
> Signed-off-by: Jiawei Zhao <phoenix500526@163.com>
> ---
>  tools/lib/bpf/usdt.bpf.h | 44 +++++++++++++++++++++++--
>  tools/lib/bpf/usdt.c     | 69 +++++++++++++++++++++++++++++++++++++---
>  2 files changed, 106 insertions(+), 7 deletions(-)
>

[...]

> diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
> index 3373b9d45ac4..e5eeac0b0fa4 100644
> --- a/tools/lib/bpf/usdt.c
> +++ b/tools/lib/bpf/usdt.c
> @@ -200,12 +200,23 @@ enum usdt_arg_type {
>         USDT_ARG_CONST,
>         USDT_ARG_REG,
>         USDT_ARG_REG_DEREF,
> +       USDT_ARG_SIB,
>  };
>
>  /* should match exactly struct __bpf_usdt_arg_spec from usdt.bpf.h */
>  struct usdt_arg_spec {
>         __u64 val_off;
> -       enum usdt_arg_type arg_type;
> +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
> +       enum usdt_arg_type arg_type: 8;
> +       __u16   idx_reg_off: 12;
> +       __u16   scale_bitshift: 4;
> +       __u8 __reserved: 8;     /* keep reg_off offset stable */
> +#else
> +       __u8 __reserved: 8;     /* keep reg_off offset stable */
> +       __u16   idx_reg_off: 12;
> +       __u16   scale_bitshift: 4;
> +       enum usdt_arg_type arg_type: 8;
> +#endif
>         short reg_off;
>         bool arg_signed;
>         char arg_bitshift;
> @@ -1283,11 +1294,58 @@ static int calc_pt_regs_off(const char *reg_name)
>
>  static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec *arg, int *arg_sz)
>  {
> -       char reg_name[16];
> -       int len, reg_off;
> -       long off;
> +       char reg_name[16] = {0}, idx_reg_name[16] = {0};
> +       int len, reg_off, idx_reg_off, scale = 1;
> +       long off = 0;
> +
> +       if (sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^,] , %d ) %n",
> +                          arg_sz, &off, reg_name, idx_reg_name, &scale, &len) == 5 ||
> +               sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^,] , %d ) %n",
> +                          arg_sz, reg_name, idx_reg_name, &scale, &len) == 4 ||
> +               sscanf(arg_str, " %d @ %ld ( %%%15[^,] , %%%15[^)] ) %n",
> +                          arg_sz, &off, reg_name, idx_reg_name, &len) == 4 ||
> +               sscanf(arg_str, " %d @ ( %%%15[^,] , %%%15[^)] ) %n",
> +                          arg_sz, reg_name, idx_reg_name, &len) == 3

formatting here was messed up, I fixed it up

> +               ) {
> +               /*
> +                * Scale Index Base case:
> +                * 1@-96(%rbp,%rax,8)
> +                * 1@(%rbp,%rax,8)
> +                * 1@-96(%rbp,%rax)
> +                * 1@(%rbp,%rax)
> +                */
> +               arg->arg_type = USDT_ARG_SIB;
> +               arg->val_off = off;
> +
> +               reg_off = calc_pt_regs_off(reg_name);
> +               if (reg_off < 0)
> +                       return reg_off;
> +               arg->reg_off = reg_off;
>
> -       if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n", arg_sz, &off, reg_name, &len) == 3) {
> +               idx_reg_off = calc_pt_regs_off(idx_reg_name);
> +               if (idx_reg_off < 0)
> +                       return idx_reg_off;
> +               /* validate scale factor and set fields directly */
> +               switch (scale) {
> +               case 1:
> +                       arg->scale_bitshift = 0;
> +                       break;
> +               case 2:
> +                       arg->scale_bitshift = 1;
> +                       break;
> +               case 4:
> +                       arg->scale_bitshift = 2;
> +                       break;
> +               case 8:
> +                       arg->scale_bitshift = 3;
> +                       break;

I made this more compact as well.

BPF selftest looks great, thanks for all the explanations ("d" and "a"
x86-specific register constraints were new to me).

Applied to bpf-next, thanks.

> +               default:
> +                       pr_warn("usdt: invalid SIB scale %d, expected 1, 2, 4, 8\n", scale);
> +                       return -EINVAL;
> +               }
> +               arg->idx_reg_off = idx_reg_off;
> +       } else if (sscanf(arg_str, " %d @ %ld ( %%%15[^)] ) %n",
> +                               arg_sz, &off, reg_name, &len) == 3) {
>                 /* Memory dereference case, e.g., -4@-20(%rbp) */
>                 arg->arg_type = USDT_ARG_REG_DEREF;
>                 arg->val_off = off;
> @@ -1306,6 +1364,7 @@ static int parse_usdt_arg(const char *arg_str, int arg_num, struct usdt_arg_spec
>         } else if (sscanf(arg_str, " %d @ %%%15s %n", arg_sz, reg_name, &len) == 2) {
>                 /* Register read case, e.g., -4@%eax */
>                 arg->arg_type = USDT_ARG_REG;
> +               /* register read has no memory offset */
>                 arg->val_off = 0;
>
>                 reg_off = calc_pt_regs_off(reg_name);
> --
> 2.43.0
>