Re: new syscall tapset checked in, but needs work

[Martin Hunt <hunt at redhat dot com>]

One reason you wouldn't want to only print the results of a syscall at
the return probe is because you might be mixing syscall probes with
other probes and you want to see what's happening between the time the
syscall is entered and the time it exits.  

As Frank mentioned, you can layer this stuff.  Using Josh's example and
mixing with some stuff I was playing with:

function user_strcpy_ascii:string (addr:long, n:long) %{
  long rc;
  long num = THIS->n;
  if (num > MAXSTRINGLEN)
        num = MAXSTRINGLEN;
  rc = _stp_copy_from_user (THIS->__retvalue,
                                    (const char __user*) (uintptr_t)
THIS->addr,
                                    num);
  {
	char *ptr = THIS->__retvalue;
	num -= rc; rc = num;
	while (num--) {
		if (*ptr & 128)
			*ptr = *ptr & 127;
		if (!isalnum(*ptr))
			*ptr = '.';
		ptr++;
	}
	ptr[rc] = 0;
   }
%}

global __syscall_read_buf
global __syscall_read_fd
global __syscall_read_count

probe strace.read.enter = syscall.read {
	__tid = tid()
      __syscall_read_fd[__tid] = fd
      __syscall_read_buf[__tid] = buf_uaddr
      __syscall_read_count[__tid] = count
      argstr = ""
}

probe strace.read.return = syscall.read.return {
      __tid = tid()
      fd = __syscall_read_fd[__tid]
      buf_uaddr = __syscall_read_buf[__tid]
      count = __syscall_read_count[__tid]
	if (count > 30)
		count = 30
     argstr = sprintf("%d, [%s], %d", fd, user_strcpy_ascii(buf_uaddr,
count), count)
      __syscall_read_fd[__tid] = 0
      __syscall_read_buf[__tid] = 0
      __syscall_read_count[__tid] = 0

}

probe strace.read = strace.read.enter, strace.read.return {}
probe strace.open = syscall.open, syscall.open.return {}

probe strace.* {
        if (pid() == target()) {
                if (returnp) {
			if (argstr != "")
				printf("%s(%s) = %d\n", name, argstr, returnval())
			else
				printf("%d\n", returnval())
                } else {
			if (argstr != "")
				printf("%s(%s) = ", name, argstr)
		}
        }
}
-------------------
That last part could be better.  Output looks like this:

> stap -c ps -g strace.stp
open("/etc/ld.so.cache", O_RDONLY) = 4
open("/lib/libtermcap.so.2", O_RDONLY) = 4
read(4, [.ELF....................`K#.4.], 30) = 512
open("/lib/libdl.so.2", O_RDONLY) = 4
read(4, [.ELF.....................L4.4.], 30) = 512
open("/lib/libc.so.6", O_RDONLY) = 4
read(4, [.ELF....................jU .4.], 30) = 512
open("/dev/tty", O_RDWR|O_NONBLOCK) = 4
open("/etc/mtab", O_RDONLY) = 4
read(4, [/dev/hdc1 / ext3 rw 0 0./dev/p], 30) = 372
open("/proc/meminfo", O_RDONLY) = 4
read(4, [MemTotal:      2067708 kB.MemF], 30) = 670
open("/etc/ld.so.cache", O_RDONLY) = 4
open("/lib/libproc-3.2.5.so", O_RDONLY) = 4
read(4, [.ELF....................PU".4.], 30) = 512
open("/lib/libc.so.6", O_RDONLY) = 4
read(4, [.ELF....................jU .4.], 30) = 512
open("/etc/mtab", O_RDONLY) = 4
read(4, [/dev/hdc1 / ext3 rw 0 0./dev/p], 30) = 372
open("/proc/stat", O_RDONLY) = 4
read(4, [cpu  138097 2320 33706 5096327], 30) = 745
read(4, [cpu  138097 2320 33706 5096327], 30) = 0