Re: Newbie: Access stack avriables in a kernel module

[Josh Stone <jistone at redhat dot com>]

Hi-

On 08/25/2010 07:40 AM, Wolfram Gettert wrote:
> probe module("mplex").function("mplex_fop_ioctl").return
> {
>   printf("Call %s arg=%u, res=%i, return=%i\n", probefunc(),$arg, $res,
> $return)
> }

First, I hope you're aware that accessing variables in a .return probe
means you get the value from the *entry* time of the function.  That
might be interesting for $arg, but I think $res won't be helpful.

> The code of the function in the kernel is:
> 
> static int mplex_fop_ioctl(struct inode *inode, struct file *filp,
>                            unsigned int cmd, unsigned long arg)
> {
>   int res=0;
[...]
> The values of arg and return are Ok. But as you see in the code of the
> function above, res is initialized with 0. But the probe prints another
> value. Why?

res=0 is the first thing the function does, but the probe is placed
before the function has done anything at all.  So the value you're
reading is probably whatever happened to be in that location already,
whether it's a register or on the stack.


Josh