dereferencing filenames from a vfs_write probe

[dave-systemtap at skeptech dot org]

Greetings list.

First, I'm not anywhere near being a kernel dev, so it's entirely likely
that I'm making dumb assumptions and/or am lacking some critical piece
of a priori knowledge here.  Apologies in advance.

So, I'm looking at some of the existing code on the wiki
and the internet at large which probes vfs_(read|write) for various
things.  For my purpose, it'd be handy to get a filename back from the
probe instead of (or in addition to) an inode number.  

for example:

probe kernel.function ("vfs_write"),
      kernel.function ("vfs_read")
{
  fname = $file->f_dentry-> <something>

   printf ("%s(%d,%d) %s\n",
     execname(), pid(), uid(), fname)
}


I'm aware I could use system() to derive the filename from an inode
number dereferenced from  $file->f_dentry->d_inode->i_ino, but that
feels a tad kludgy.

Poking around the kernel headers I see the dentry struct in
includes/linux/dcache.h has a struct of type qstr (quick string) called
'd_name'.  I see that the qstr struct has within it a pointer to a const
unsigned char called 'name'.  This seems tantalizingly close to what I'm
looking for but dereferencing it with the code above using
$file->f_dentry->d_name->name returns a type mismatch error. The
derefernced thingy called 'name' is appearently of type 'long', not a
pointer to a string.

So I'm beat,  is this long I'm getting back a memory address? If so how
do I '&' it in an stap script?  I spoke to Eugene on IRC briefly and he
mentioned a d_path struct that I don't see in this header, which makes
me wonder if I'm even looking at the correct headers.  I'll grep around
for it, but wanted to post this in the meantime in case I'm just making
some obvious newbie error.

Thanks in advance for your help. 

--dave josephsen

Attachment: pgp00000.pgp
Description: PGP signature