Matching function parameters and corresponding return value

Matching function parameters and corresponding return value

[Sylvain Fourmanoit]

Hi all,

I would like to watch calls to a preemptible function such as sys_open():
ideally, I would like to know both the tentatively accessed files and the 
success (or not) of the various calls.

But I don't see how to do this: of course, I can without problem 
register a jprobe and a kretprobe on sys_open(), both how do I correlate 
pairs of probe calls reliably? Or is it just the wrong approach?

Any insight on how to do this, either with SystemTap or directly 
with Kprobes would be really appreciated!

-- 
Sylvain <syfou@users.sourceforge.net>

"Don't fear the pen. When in doubt, draw a pretty picture."
    --Baker's Third Law of Design.

Re: Matching function parameters and corresponding return value

[Li Guanglei]

Sylvain Fourmanoit ??:
> Hi all,
> 
> I would like to watch calls to a preemptible function such as sys_open():
> ideally, I would like to know both the tentatively accessed files and 
> the success (or not) of the various calls.
> 
> But I don't see how to do this: of course, I can without problem 
> register a jprobe and a kretprobe on sys_open(), both how do I correlate 
> pairs of probe calls reliably? Or is it just the wrong approach?
> 
> Any insight on how to do this, either with SystemTap or directly with 
> Kprobes would be really appreciated!
> 
Although some syscalls are preemptible, but you can still correlate 
the pairs of entry/return of a syscall by tid(task->pid). e.g:
                  TID(task->pid)          Syscall
                       1122           sys_open.entry
  (preempted by foo())  223             foo.entry
                          ...
                        223             foo.return
                       1122           sys_open.return
So what you can do is just to search the sys_open.return with the same 
tid and skip all the calls met during the search.

- Guanglei

Re: Matching function parameters and corresponding return value

[Frank Ch. Eigler]

Sylvain Fourmanoit <syfou@users.sourceforge.net> writes:

> I would like to watch calls to a preemptible function such as sys_open():
> ideally, I would like to know both the tentatively accessed files and
> the success (or not) of the various calls.

This is to be addressed in systemtap bug #1382.  When this feature is
implemented, it will allow one to write probes of the form:

       probe kernel.function("foo").return {
          print ("saved arg1=") print ($foo)
          print (" arg2=") print ($bar)
          print (" return value=") print ($return)
       }

In particular, a copy of incoming parameters will be saved by an
implicit kprobe and will be accessable to the .return probe.

In the mean time, one can do the same work by hand - write an ordinary
function-entry probe, save the arguments in some auxiliary array
indexed by tid() (and other state such as nesting level if necessary),
then look up the values in the .return probe.

- FChE

Re: Matching function parameters and corresponding return value

[Martin Hunt]

On Wed, 2006-06-14 at 07:16 +0800, Li Guanglei wrote:
> Sylvain Fourmanoit ??:
> > Hi all,
> > 
> > I would like to watch calls to a preemptible function such as sys_open():
> > ideally, I would like to know both the tentatively accessed files and 
> > the success (or not) of the various calls.
> > 
> > But I don't see how to do this: of course, I can without problem 
> > register a jprobe and a kretprobe on sys_open(), both how do I correlate 
> > pairs of probe calls reliably? Or is it just the wrong approach?
> > 
> > Any insight on how to do this, either with SystemTap or directly with 
> > Kprobes would be really appreciated!
> > 
> Although some syscalls are preemptible, but you can still correlate 
> the pairs of entry/return of a syscall by tid(task->pid). e.g:
>                   TID(task->pid)          Syscall
>                        1122           sys_open.entry
>   (preempted by foo())  223             foo.entry
>                           ...
>                         223             foo.return
>                        1122           sys_open.return
> So what you can do is just to search the sys_open.return with the same 
> tid and skip all the calls met during the search.

It sounds harder than it is. For the case of just sys_open, it is just
this:

---
global args

probe syscall.open {
  args[tid()] = argstr
}

probe syscall.open.return {
  printf("%s: %s(%s) = %s\n", execname(), name, args[tid()], retstr)
}
---

To extend that to multiple system calls, use "name" as a key:
args[name, tid()] = argstr


Martin