Re: Kprobes support for accessing args upon return

[Jim Keniston <jkenisto at us dot ibm dot com>]

On Sat, 2006-12-16 at 02:07, Jun Koi wrote:
> Hi Jim,
> 
> On 06 Dec 2006 14:32:40 -0800, Jim Keniston <jkenisto@us.ibm.com> wrote:
> > As promised, here (once again) is a pointer to the kretprobes patch
> > (against 2.6.13) that adds an optional "data pouch" to a
> > kretprobe_instance. This makes it easy for data such as arg values to be
> > saved upon function entry and recalled upon return.  This was written by
> > Kevin Stafford and smoke-tested by me.
> 
> This patch would be very useful. However, there is a doubt: You access
> function args by ESP. That would not work if the kernel compiled
> without "frame pointer" option.

It's correct that rp.entry_handler (or the jprobe handler, or whoever
puts the args in the pouch) would have to know where to find the args...
and that depends on whether frame pointers are enabled, whether it's a
fastcall or asmlinkage function, etc.  Both jprobes and SystemTap are
pretty good at sorting that out, but both would need to use
current_kretprobe_instance() to get at the pouch.

> 
> But this patch is worthy to be merged IMO.

Thanks.

> 
> regards,
> J

Jim