Unable to probe filp_open and target variables therein

Unable to probe filp_open and target variables therein

[Gaurav Poothia]

Hi!

I am new to system tap and am trying out some simple stuff like a script
to print all files opened using flip_open in the kernel. The reason I
chose flip_open over the open system call was because some chaps call this
api when accessing files from INSIDE the kernel.


So I wrote this script which uses 2 target variables: $flags and $filename

---------------------------------------------------------------------------
probe kernel.function("filp_open")
{
        if($flags & 1)  // O_WRONLY passed
        {
        readOrWrite = "write"
        }
        else    //O_RDONLY flag maybe passed
        {
        readOrWrite = "read"
        }
        if($flags & 2)  //O_RDWR flag
        {
        readOrWrite = "read and write"
        }

        printf("%s app with pid %d: opening file %s for %s\n", execname(), pid(), $filename, readOrWrite)
}

probe timer.ms(100000) #after 100 sec
{
        exit()
}
--------------------------------------------------------------------------
which refused to run with the following errors:
--------------------------------------------------------------------------
Pass 1: parsed user script and 11 library script(s) in 90usr/0sys/93real ms.
semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:3:5
semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:11:12
semantic error: unresolved target-symbol expression: identifier '$filename' at ./test.stp:16:76
semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:3:5
semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:11:12
semantic error: unresolved target-symbol expression: identifier '$filename' at ./test.stp:16:76
Pass 2: analyzed script: 2 probe(s), 3 function(s), 0 global(s) in 190usr/90sys/302real ms.
Pass 2: analysis failed.
--------------------------------------------------------------------------

Then I tried a less ambitious script:
-------------------------------------------------------------------------
probe kernel.function("filp_open")
{

        printf("%s app with pid %d: opening\n", execname(), pid())
}

probe timer.ms(100000) #after 100 sec
{
        exit()
}
------------------------------------------------------------------------

Now this one produces no output whatsoever (but no errors either)


How can I get this stuff to work? Any ideas?

Thanks
-Gaurav

Re: Unable to probe filp_open and target variables therein

[Jim Keniston]

On Fri, 2006-05-26 at 15:55, Gaurav Poothia wrote:
> Hi!
> 
> I am new to system tap and am trying out some simple stuff like a script
> to print all files opened using flip_open in the kernel. The reason I
> chose flip_open over the open system call was because some chaps call this
> api when accessing files from INSIDE the kernel.
> 
> 
> So I wrote this script which uses 2 target variables: $flags and $filename
> 
> ---------------------------------------------------------------------------
> probe kernel.function("filp_open")
> {
[code snipped]
> 
>         printf("%s app with pid %d: opening file %s for %s\n", execname(), pid(), $filename, readOrWrite)
> }

> probe timer.ms(100000) #after 100 sec
> {
>         exit()
> }

FWIW, after I changed "$filename" to "kernel_string($filename)" in the
printf, SystemTap version 0.5.4 built 2006-03-08 on ppc64 liked this
just fine, and produced copious output.  The kernel version was Red
Hat's 2.6.9-36.1.EL.

Until recent versions, gcc didn't produce adequate debug info to
properly locate the args for some functions.  The version I used was
gcc (GCC) 3.4.5 20051201 (Red Hat 3.4.5-2).

> --------------------------------------------------------------------------
> which refused to run with the following errors:
> --------------------------------------------------------------------------
> Pass 1: parsed user script and 11 library script(s) in 90usr/0sys/93real ms.
> semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:3:5
> semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:11:12
> semantic error: unresolved target-symbol expression: identifier '$filename' at ./test.stp:16:76
> semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:3:5
> semantic error: unresolved target-symbol expression: identifier '$flags' at ./test.stp:11:12
> semantic error: unresolved target-symbol expression: identifier '$filename' at ./test.stp:16:76
> Pass 2: analyzed script: 2 probe(s), 3 function(s), 0 global(s) in 190usr/90sys/302real ms.
> Pass 2: analysis failed.
> --------------------------------------------------------------------------
> 
> Then I tried a less ambitious script:
> -------------------------------------------------------------------------
> probe kernel.function("filp_open")
> {
> 
>         printf("%s app with pid %d: opening\n", execname(), pid())
> }
> 
> probe timer.ms(100000) #after 100 sec
> {
>         exit()
> }
> ------------------------------------------------------------------------
> 
> Now this one produces no output whatsoever (but no errors either)

It appears that in recent versions of Linux, sys_open() no longer calls
filp_open().  This may be why you're seeing no output.
> 
> 
> How can I get this stuff to work? Any ideas?
> 
> Thanks
> -Gaurav

Jim Keniston