Failed to get server stream arg in return probe of gRPC

[minimAluminiumalism]

Describe the bug

Let's see the grpc bpf code snippet:

SEC("uprobe/server_handleStream2")
int uprobe_server_handleStream2_Returns(struct pt_regs *ctx) {
    u64 server_stream_pos = 4;
    void *server_stream_ptr = get_argument(ctx, server_stream_pos);
    if (server_stream_ptr == NULL) {
        bpf_printk("grpc:server:uprobe/server_handleStream2Return: failed to get ServerStream arg");
        return -1;
    }
}

The original probe func is:

func (s *Server) handleStream(t transport.ServerTransport, stream *transport.ServerStream)

Obviously this func is a return probe which will be triggered when handleStream() returns. I think we cannot obtain the server_stream_pos(using get_arugment()) through BPF instrumentation when the function returns, which is different from retrieving this param at the very beginning of the function execution.

Suppose there is a simple function like this:

func f(a, b int) (c int) {}

In return probe, we try to retrieve a param: get_argument(ctx, 1), actually the param we get is the return param c rather than a.

WDYT? @MrAlias

To Reproduce

I tested gRPC demo and found the rpc instrument always failed, and the trace log is server-995136 [000] d...1 763711.253233: bpf_trace_printk: grpc:server:uprobe/server_handleStream2Return: failed to get ServerStream arg.

To further verify this, I tried to change u64 server_stream_pos = 4; to u64 server_stream_pos = 1;, and still get NULL. I suppose this is because the function handleStream() does not return any value.

I think the correct approach is to save the address of the ServerStream in a BPF map at the beginning of the func execution. When the function returns, look up the map and ensure the addr of ServerStream.