Re: Userspace syscall.return probes do not support $arg variables

[David Smith <dsmith at redhat dot com>]

On 07/20/2013 12:21 PM, Tomas Martinec wrote:
> Hello,
> 
> I am trying to use stap to monitor what a java application sends and
> receives through sockets. The monitoring should be done in userspace
> for some reasons. Here is the stap script that I figured out:
> 
> probe process("java").syscall {
>     if ($syscall != 45) {
>     next;
>     }
> 
>     printf("%d %s %d %d %d %d %d %d\n", $syscall, probefunc(), $arg1,
> $arg2, $arg3, $arg4, $arg5, $arg6);
> }
> 
> It works fine for send, but for recv I need to hook "syscall.return"
> and that probe does not seem to support $argN variables. Therefore, I
> am not able to access the contents of the read buffer easily.
> 
> The stap compilation gives:
> sudo stap stap.userspace --ldd
> semantic error: only "process(PATH_OR_PID).syscall" support $argN or
> $$parms.: identifier '$arg1' at stap.userspace:10:64
> 
> Perhaps, this may be a bug.

I wouldn't quite call it a bug, I'd call it an enhancement or a missing
feature. Feel free to file an bug, and mark its priority as an
"enhancement". This is a reasonable idea - no one has ever asked or
thought about it before as far as I can recall.

In the meantime, here's an (untested) workaround. Note that we're helped
by the fact that syscalls don't nest.

====
global _syscall_entry

probe process("java").syscall {
	// save $arg[1-6] values
	tid = tid()
	_syscall_entry[tid, 1] = $arg1
	_syscall_entry[tid, 2] = $arg2
	_syscall_entry[tid, 3] = $arg3
	_syscall_entry[tid, 4] = $arg4
	_syscall_entry[tid, 5] = $arg5
	_syscall_entry[tid, 6] = $arg6
}

probe process("java").syscall.return {
	// get $arg[1-6] values
	tid = tid()
	arg1 = _syscall_entry[tid, 1]
	delete _syscall_entry[tid, 1]
	arg2 = _syscall_entry[tid, 2]
	delete _syscall_entry[tid, 2]
	arg3 = _syscall_entry[tid, 3]
	delete _syscall_entry[tid, 3]
	arg4 = _syscall_entry[tid, 4]
	delete _syscall_entry[tid, 4]
	arg5 = _syscall_entry[tid, 5]
	delete _syscall_entry[tid, 5]
	arg6 = _syscall_entry[tid, 6]
	delete _syscall_entry[tid, 6]

	// use arg[1-6]...
}
====

-- 
David Smith
dsmith@redhat.com
Red Hat
http://www.redhat.com
256.217.0141 (direct)
256.837.0057 (fax)