trace function argument

trace function argument

[Christian Kaiser]

Hi all,

is it possible to get the value of a function argument of a probed function?

With dtrace for example, you can do something like:
dtrace -n '::some_function:entry/arg0 != 0/{ printf("arg0 is not zero!"); }'

I have searched the "Beginners Guide", mailinglist, wiki, web, etc. but 
could not find anything useful.

Thanks!

   Christian

-- 
Christian Kaiser, Software Engineer, Dolphin Interconnect Solutions
http://www.dolphinics.com

Re: trace function argument

[Ananth N Mavinakayanahalli]

On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:
> Hi all,
>
> is it possible to get the value of a function argument of a probed 
> function?
>
> With dtrace for example, you can do something like:
> dtrace -n '::some_function:entry/arg0 != 0/{ printf("arg0 is not zero!"); 
> }'
>
> I have searched the "Beginners Guide", mailinglist, wiki, web, etc. but 
> could not find anything useful.

With SystemTap with debuginfo, you can refer to arguments by name.

probe kernel.function("do_fork")
{
	if ($clone_flags == 0)
		printf("clone_flags is zero!\n")
}

Further, to just list arguments, you can use $$parms:

stap -ve 'probe kernel.function("vfs_read") { printf("%s\n", $$parms) }'

With debuginfoless kernels, you can do pretty much what you cite with
DTrace above.

Ananth

Re: trace function argument

[Christian Kaiser]

Ananth N Mavinakayanahalli wrote:
> On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:
>> Hi all,
>>
>> is it possible to get the value of a function argument of a probed 
>> function?
>>
>> With dtrace for example, you can do something like:
>> dtrace -n '::some_function:entry/arg0 != 0/{ printf("arg0 is not zero!"); 
>> }'
>>
>> I have searched the "Beginners Guide", mailinglist, wiki, web, etc. but 
>> could not find anything useful.
> 
> With SystemTap with debuginfo, you can refer to arguments by name.
> 
> probe kernel.function("do_fork")
> {
> 	if ($clone_flags == 0)
> 		printf("clone_flags is zero!\n")
> }
> 
> Further, to just list arguments, you can use $$parms:
> 
> stap -ve 'probe kernel.function("vfs_read") { printf("%s\n", $$parms) }'

Right, both suggestions are working for me. Thanks!

> With debuginfoless kernels, you can do pretty much what you cite with
> DTrace above.

I am not sure if I understand you right. If I can do pretty much the 
same, how is it working then? Let's take your example from above. How 
can I print out 'clone_flags' with debuginfoless kernels?

   Christian

-- 
Christian Kaiser, Software Engineer, Dolphin Interconnect Solutions
http://www.dolphinics.com

Re: trace function argument

[Ananth N Mavinakayanahalli]

On Tue, Jun 16, 2009 at 11:47:08AM +0200, Christian Kaiser wrote:
> Ananth N Mavinakayanahalli wrote:
>> On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:

>> With debuginfoless kernels, you can do pretty much what you cite with
>> DTrace above.
>
> I am not sure if I understand you right. If I can do pretty much the same, 
> how is it working then? Let's take your example from above. How can I print 
> out 'clone_flags' with debuginfoless kernels?

With debuginfoless kernels, you can't refer to variables by name, rather
using arg1, arg2, etc. See tapset/<arch>/registers.stp for more
information. For eg:

$ stap -ve 'probe kprobe.function("do_fork") { printf("clone_flags = %x\n", ulong_arg(1)) exit() }'
Pass 1: parsed user script and 53 library script(s) in 300usr/0sys/306real ms.
Pass 2: analyzed script: 1 probe(s), 4 function(s), 1 embed(s), 0 global(s) in 0usr/0sys/4real ms.
Pass 3: translated to C into "/tmp/stapnc3ps4/stap_21b73cfa060f885eb93a27cf4013ed70_2418.c" in 0usr/0sys/0real ms.
Pass 4: compiled C into "stap_21b73cfa060f885eb93a27cf4013ed70_2418.ko" in 1490usr/230sys/1711real ms.
Pass 5: starting run.
clone_flags = 1200011
Pass 5: run completed in 10usr/30sys/2234real ms.

Ananth

Re: trace function argument

[Christian Kaiser]

Ananth N Mavinakayanahalli wrote:
> On Tue, Jun 16, 2009 at 11:47:08AM +0200, Christian Kaiser wrote:
>> Ananth N Mavinakayanahalli wrote:
>>> On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:
> 
>>> With debuginfoless kernels, you can do pretty much what you cite with
>>> DTrace above.
>> I am not sure if I understand you right. If I can do pretty much the same, 
>> how is it working then? Let's take your example from above. How can I print 
>> out 'clone_flags' with debuginfoless kernels?
> 
> With debuginfoless kernels, you can't refer to variables by name, rather
> using arg1, arg2, etc. See tapset/<arch>/registers.stp for more
> information. For eg:
> 
> $ stap -ve 'probe kprobe.function("do_fork") { printf("clone_flags = %x\n", ulong_arg(1)) exit() }'
> Pass 1: parsed user script and 53 library script(s) in 300usr/0sys/306real ms.
> Pass 2: analyzed script: 1 probe(s), 4 function(s), 1 embed(s), 0 global(s) in 0usr/0sys/4real ms.
> Pass 3: translated to C into "/tmp/stapnc3ps4/stap_21b73cfa060f885eb93a27cf4013ed70_2418.c" in 0usr/0sys/0real ms.
> Pass 4: compiled C into "stap_21b73cfa060f885eb93a27cf4013ed70_2418.ko" in 1490usr/230sys/1711real ms.
> Pass 5: starting run.
> clone_flags = 1200011
> Pass 5: run completed in 10usr/30sys/2234real ms.

Ok, so 'arg0' for dtrace is 'ulong_arg(1)' for systemtap. That was 
unclear to me!

Thank you!

   Christian

-- 
Christian Kaiser, Software Engineer, Dolphin Interconnect Solutions
http://www.dolphinics.com

Re: trace function argument

[Ananth N Mavinakayanahalli]

On Tue, Jun 16, 2009 at 12:31:26PM +0200, Christian Kaiser wrote:
> Ananth N Mavinakayanahalli wrote:
>> On Tue, Jun 16, 2009 at 11:47:08AM +0200, Christian Kaiser wrote:
>>> Ananth N Mavinakayanahalli wrote:
>>>> On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:
>>>> With debuginfoless kernels, you can do pretty much what you cite with
>>>> DTrace above.
>>> I am not sure if I understand you right. If I can do pretty much the 
>>> same, how is it working then? Let's take your example from above. How can 
>>> I print out 'clone_flags' with debuginfoless kernels?
>> With debuginfoless kernels, you can't refer to variables by name, rather
>> using arg1, arg2, etc. See tapset/<arch>/registers.stp for more
>> information. For eg:
>> $ stap -ve 'probe kprobe.function("do_fork") { printf("clone_flags = 
>> %x\n", ulong_arg(1)) exit() }'
>> Pass 1: parsed user script and 53 library script(s) in 300usr/0sys/306real 
>> ms.
>> Pass 2: analyzed script: 1 probe(s), 4 function(s), 1 embed(s), 0 
>> global(s) in 0usr/0sys/4real ms.
>> Pass 3: translated to C into 
>> "/tmp/stapnc3ps4/stap_21b73cfa060f885eb93a27cf4013ed70_2418.c" in 
>> 0usr/0sys/0real ms.
>> Pass 4: compiled C into "stap_21b73cfa060f885eb93a27cf4013ed70_2418.ko" in 
>> 1490usr/230sys/1711real ms.
>> Pass 5: starting run.
>> clone_flags = 1200011
>> Pass 5: run completed in 10usr/30sys/2234real ms.
>
> Ok, so 'arg0' for dtrace is 'ulong_arg(1)' for systemtap. That was unclear 
> to me!

To be clearer, its <type>_arg(<argnum>) as Mark pointed out in his
email. So, int_arg(x), long_arg(x), s32_arg(x), pointer_arg(x), etc.,
are all available for use.

Happy hacking!

Ananth

Re: trace function argument

[Mark Wielaard]

Hi Christian,

On Tue, 2009-06-16 at 11:47 +0200, Christian Kaiser wrote:
> Ananth N Mavinakayanahalli wrote:
> > On Tue, Jun 16, 2009 at 11:08:35AM +0200, Christian Kaiser wrote:
> >> Hi all,
> >>
> >> is it possible to get the value of a function argument of a probed 
> >> function?
> >>
> >> With dtrace for example, you can do something like:
> >> dtrace -n '::some_function:entry/arg0 != 0/{ printf("arg0 is not zero!"); 
> >> }'
> >>
> >> I have searched the "Beginners Guide", mailinglist, wiki, web, etc. but 
> >> could not find anything useful.
> > 
> > With SystemTap with debuginfo, you can refer to arguments by name.
> > 
> > probe kernel.function("do_fork")
> > {
> > 	if ($clone_flags == 0)
> > 		printf("clone_flags is zero!\n")
> > }
> > 
> > Further, to just list arguments, you can use $$parms:
> > 
> > stap -ve 'probe kernel.function("vfs_read") { printf("%s\n", $$parms) }'
> 
> Right, both suggestions are working for me. Thanks!
> 
> > With debuginfoless kernels, you can do pretty much what you cite with
> > DTrace above.
> 
> I am not sure if I understand you right. If I can do pretty much the 
> same, how is it working then? Let's take your example from above. How 
> can I print out 'clone_flags' with debuginfoless kernels?

Obviously without the information about the arguments and types
available through debuginfo it isn't as nice. But you can do 'debuginfo
less probes' with kprobe.function and then fetch the arguments by hand
with the various <TYPE>_arg(<argnr>) functions. You need to specify the
type yourself. e.g. for your example:

stap -e 'probe kprobe.function("do_fork") { printf("do_fork flags: %x\n", ulong_arg(1)) }'

There is an (internal) utility function, __fork_flags, you can use to
decode these for a bit nicer:

stap -e 'probe kprobe.function("do_fork") { printf("do_fork flags: %s\n", __fork_flags(ulong_arg(1))) }'

(Although I don't believe we support using the internal __functions, so don't depend on it.)

Cheers,

Mark