How to change a string type argument of a system call?

[Neo Liu]

I'm sorry for making a mistake when sending this email. This one contains
attachements.

On Sun, Apr 4, 2010 at 9:54 AM, Neo Liu <diabloneo@gmail.com> wrote:
> I write a script to monitor the open syscall of a target process. In the probe
> handler, I want to replace the $filename argument of the sys_open, so I can
> make the sys_open open another file. In order to achieve this purpose, I use
> __get_free_page() to allocate a new memory page (the page is in kernel spaces,
> the address is higher than 0xC0000000), put a new filename in this
> memory page, and let $filename parameter points to this new page. So, the
> $filename contains a new filename string. However, the open syscall returns
> failure. Is this because the open syscall can't access an address in the kernel
> spaces?
>
> The three attachments are my example codes and stap output.
> I use the following command line:
> $gcc -o fopen fopen.c
> $sudo stap -g open.stp -c ./fopen
>
> On Thu, Apr 1, 2010 at 9:26 PM, Frank Ch. Eigler <fche@redhat.com> wrote:
>> Neo Liu <diabloneo@gmail.com> writes:
>>
>>> How can I use systemtap to change a string type parameter in a
>>> syscall probe? For example, I use "probe syscall.open", I want to
>>> change the "filename" parameter to make the "open" syscall open a
>>> different file. How can I do that?
>>
>> We don't currently have helper functions for this: kernel_string() and
>> user_string() just read.  Someone could write embedded-c routines to
>> do kernel_set_string() etc., but if we put them into the standard
>> tapset we need to make such functions only available in guru mode.
>> (That would probably need the invention of a /* guru */ marker.)
>>
>> - FChE
>>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fopen.c
Type: text/x-csrc
Size: 329 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/systemtap/attachments/20100404/98c3d2e8/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: open.stp
Type: application/octet-stream
Size: 1237 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/systemtap/attachments/20100404/98c3d2e8/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: open.stp.out
Type: application/octet-stream
Size: 547 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/systemtap/attachments/20100404/98c3d2e8/attachment-0001.obj>