Re: Calling systemtap function from pure code

[David Smith <dsmith at redhat dot com>]

On Thu, Sep 14, 2017 at 2:20 AM, Daniel Doron <danielmeirdoron@gmail.com> wrote:
> I will explain....
> i wanted to get as much info on kernel module insertion/removal but
> the init_module/delete_module probe points do not provide enough
> information. So , I thought about load_module() which does provide
> adequate info via struct module (local var),  but this gets filled
> along the way and I can;t really have access to it via systemtap. So I
> thought the simplest way to access that struct is though notification
> chain, i.e. use register_module_notifier() and extract the info from
> the struct there and then print it via systemtap.

I'd use the "module" set of tracepoints. The following is from a
RHEL6-era kernel:

====
# stap -L 'kernel.trace("module:*")'kernel.trace("module:module_free")
$mod:struct module*
kernel.trace("module:module_get") $mod:struct module* $ip:long
unsigned int $refcnt:int
kernel.trace("module:module_load") $mod:struct module*
kernel.trace("module:module_put") $mod:struct module* $ip:long
unsigned int $refcnt:int
kernel.trace("module:module_request") $name:char* $wait:bool $ip:long
unsigned int
====

As you can see, the "module_load" tracepoint that has the struct
module as an argument. So, you could do something like this:

====
probe kernel.trace("module:module_load")
{
    print($mod$)
}
====

> So I guess the right question would be how to access the STAP print
> function/mechanism/buffer...from standard kernel code.

Assuming you are in a stap kernel module, you can call _stp_printf(),
which has arguments like you'd expect. When you are finished printing,
you should call _stp_print_flush(). Now this interface isn't
guaranteed either, but I don't imagine we'll be changing it anytime
soon.

-- 
David Smith
Principal Software Engineer
Red Hat