accessing args from return probe

[Keshavamurthy Anil S]

On Wed, Sep 21, 2005 at 03:23:52PM -0700, Kevin Stafford wrote:
> This is a problem that must be addressed as this type of behavior is 
> prevalent in system calls.
> 
> Here is a workaround using two probes and a global as a record keeper:

Keep in mind that the proposed workaround won;t work for recursive functions :-)

> 
>    global time_tloc_addr
> 
>    probe kernel.syscall.time = kernel.function("sys_time") {
>       /* save the addr of the arg while I can */
>       time_tloc_addr[pid()] = $tloc
The second call to the same function recursively will
overwrite first instance data. 
>    }
> 
>    probe kernel.syscall.time.return =
>       kernel.function("sys_time").return {
>             time = get_uint_ptr(time_tloc_addr[pid()]);
>             retval = get_eax();
>       }
> 

Cheers,
Anil S Keshavamurthy