Debugging Linux Kernel using SystemTap Part-2 - Writing Probes for Kernel Functions

What is Probe in SystemTap?

Probe means to aggregate or print debug information at specific points in the executable code.

Syntax of probing a function in the kernel:

probe kernel.function("function_name") {
.....
}

E.g. Let's probe open function and print the name of the file opened

probe kernel.function("do_sys_open") {
    printf("File Name:%s\n", user_string($filename));
}

To find out the list of all commands, run the following command:

$ stap -l 'kernel.function("*")' | sort

To find out the arguments of a kernel function

$ stap -L 'kernel.function("*")' | grep do_sys_open

You can see in the figure, it lists all the local variables of the do_sys_function

dfd -> int, $filename-> char const*, $flags->int, $mode-> umode_t, $op -> struct open_flags.

You can print each of these values in the probe function