This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: dereferencing filenames from a vfs_write probe
- From: Eugene Teo <eugeneteo at kernel dot sg>
- To: dave-systemtap at skeptech dot org
- Cc: systemtap at sourceware dot org, Ananth N Mavinakayanahalli <ananth at in dot ibm dot com>
- Date: Thu, 20 Mar 2008 20:04:56 +0800
- Subject: Re: dereferencing filenames from a vfs_write probe
- References: <1205982759.13969.ezmlm@sourceware.org> <20080320033734.GA32122@homer> <20080320044238.GA8059@in.ibm.com>
- Reply-to: Eugene Teo <eugeneteo at kernel dot sg>
<quote sender="Ananth N Mavinakayanahalli">
> On Wed, Mar 19, 2008 at 10:37:34PM -0500, dave-systemtap@skeptech.org wrote:
>
> > Poking around the kernel headers I see the dentry struct in
> > includes/linux/dcache.h has a struct of type qstr (quick string) called
> > 'd_name'. I see that the qstr struct has within it a pointer to a const
> > unsigned char called 'name'. This seems tantalizingly close to what I'm
> > looking for but dereferencing it with the code above using
> > $file->f_dentry->d_name->name returns a type mismatch error. The
> > derefernced thingy called 'name' is appearently of type 'long', not a
> > pointer to a string.
>
> Try kernel_string($file->f_dentry->d_name->name) instead.
Thanks Ananth.
probe kernel.function("vfs_write"),
kernel.function("vfs_read") {
printf("%s(%d,%d) %s\n", execname(), pid(), uid(),
kernel_string($file->f_path->dentry->d_name->name))
}
Eugene