dereferencing filenames from a vfs_write probe

[Eugene Teo]

<quote sender="Ananth N Mavinakayanahalli">
> On Wed, Mar 19, 2008 at 10:37:34PM -0500, dave-systemtap@skeptech.org wrote:
>  
> > Poking around the kernel headers I see the dentry struct in
> > includes/linux/dcache.h has a struct of type qstr (quick string) called
> > 'd_name'.  I see that the qstr struct has within it a pointer to a const
> > unsigned char called 'name'.  This seems tantalizingly close to what I'm
> > looking for but dereferencing it with the code above using
> > $file->f_dentry->d_name->name returns a type mismatch error. The
> > derefernced thingy called 'name' is appearently of type 'long', not a
> > pointer to a string.
> 
> Try kernel_string($file->f_dentry->d_name->name) instead.

Thanks Ananth.

probe kernel.function("vfs_write"),
      kernel.function("vfs_read") {
        printf("%s(%d,%d) %s\n", execname(), pid(), uid(),
                        kernel_string($file->f_path->dentry->d_name->name))
}

Eugene