Re: systemtap and is it possible to figure out what is in kernel cache.

[Josh Stone <jistone at redhat dot com>]

Hi,

On 07/12/2010 04:54 PM, Ranjith Ruban wrote:
> I was able to find that we can probe kernel function add_to_page_cache 
> and see which process adds to kernel cache. Is there any way we can find 
> out what exactly is in the cache by using systemtap like finding out the 
> page address and then using crash tool . Is this possible ? Any pointers 
> on this will be greatly appreciated.

I don't know the particulars of mapping a page to a memory address, but
using systemtap you can access any of the parameters of the probed
function, including struct members from pointer parameters.  You can do
things like:

  probe kernel.function("add_to_page_cache")
  {
    println($page->flags)
    for (i=0; i<$mapping->nrpages; ++i) { ... }
  }


If you know how you would get the information using C, then we can help
you translate that to stap's language.  OR, you can always write C
directly yourself, something like:

  probe kernel.function("add_to_page_cache")
  {
    printf("%p\n", get_address($page, $mapping, $offset, $gfp_mask))
  }

  function get_address(page, mapping, offset, gfp_mask)
  %{
    struct page *page =
      (struct page *) (long) THIS->page;
    struct address_space *mapping =
      (struct address_space *) (long) THIS->mapping;
    pgoff_t offset = THIS->offset;
    gfp_t gfp_mask = THIS->gfp_mask;

    unsigned long address = 0;
    /* compute the desired address here */

    THIS->__retvalue = address;
  %}

Using embedded-C requires guru mode (-g), and then systemtap's safeties
can't protect you from kernel mistakes, so be careful...


Once you've figured out the address, either take that to the crash tool,
or stap can do a minimal dump with %M, e.g.

  for (offset = 0; offset < 256; offset += 32)
    printf("%.32M\n", address + offset)


Hope that helps...

Josh