Re: Trace syscalls

[fche at redhat dot com (Frank Ch. Eigler)]

"Rus-Rebreanu Alin-Florin" <netblock@gmail.com> writes:

> i want to trace for example sys_write in such a way that it would
> print the internal path of the sys_write syscall. such as: entering
> fget_light()->exit fget_light()->entering file_pos_read()->exit
> file_pos_read() or even follow the path into those functions. [...]

In other words, you'd like to get a dynamic call graph, starting
at a function such as sys_write.

> i tried , and it's almost what i want :
> probe kernel.function("*@fs/read_write.c"){
>    printf("%s->%s\n",thread
> _indent(1),probefunc())
> }
> probe kernel.function("*@fs/read_write.c").return{
>    printf("%s->%s\n",thread_indent(1),probefunc())
> }
>
> but this adds probes to all the functions in the read_write file, and
> i'm only interested in read or write syscalls, but entering every
> function of the syscall
>
> Some "pointers"?

One way would be to add some conditions to activate tracing only while
one of your desired functions is active in the call stack.  Here's one
possibility:


# cat para-callgraph.stp
global trace
probe kernel.function(@1).call {
   trace[tid()] = 1
}
probe kernel.function(@1).return {
   delete trace[tid()]
}

probe kernel.function(@2).call{
   if(! (tid() in trace)) next
   printf("%s->%s\n",thread_indent(1),probefunc())
}
probe kernel.function(@2).return{
   if(! (tid() in trace)) next
   printf("%s<-%s\n",thread_indent(-1),probefunc())
}

# stap para-callgraph.stp sys_read '*@fs/*.c'
[...]
^C
#

It is tempting to use an overbroad wildcard for that @2 parameter, but
just try with specific files (or function name patterns, or
directories) first.  Our kernel probing blacklist is not sufficiently
broad yet, and a plain '*' can still bring down a machine.


- FChE