日期：2015年11月9日

SystemTap 笔记 （5）—— target variable （1）

关于target variable的解释：

The probe events that map to actual locations in the code (for example kernel.function(“function”) and kernel.statement(“statement”)) allow the use of target variables to obtain the value of variables visible at that location in the code. You can use the -L option to list the target variable available at a probe point.

其实，目前更倾向于使用context variable这个名字，而不是target variable（可以参考这封邮件）。使用target variable需要有kernel的debuginfo。参考下面例子：

# stap -L 'kernel.function("vfs_read")'
kernel.function("vfs_read@../fs/read_write.c:381") $file:struct file* $buf:char* $count:size_t $pos:loff_t*

每个target variable前面有$，:后面跟着变量类型。例如：file变量的类型就是struct file*。也可对照vfs_read的定义：

ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)

此外，对于target variable不属于当前probe的local变量，可以使用@var("varname@src/file.c")来访问：

When a target variable is not local to the probe point, like a global external variable or a file local static variable defined in another file then it can be referenced through “@var(“varname@src/file.c”)”.

请看下面这个例子：

# stap -e 'probe kernel.function("vfs_read") {
           printf ("current files_stat max_files: %d\n",
                   @var("files_stat@fs/file_table.c")->max_files);
           exit(); }'
current files_stat max_files: 82002

也可以通过指针访问一些基本类型的数据：

kernel_char(address)
Obtain the character at address from kernel memory.
kernel_short(address)
Obtain the short at address from kernel memory.
kernel_int(address)
Obtain the int at address from kernel memory.
kernel_long(address)
Obtain the long at address from kernel memory
kernel_string(address)
Obtain the string at address from kernel memory.
kernel_string_n(address, n)
Obtain the string at address from the kernel memory and limits the string to n bytes.

 

Linux kernel 笔记 （41）——“inode”结构体中的“i_rdev”成员

inode结构体中有一个i_rdev成员（定义在<linux/fs.h>中）：

struct inode {
    ......
    dev_t           i_rdev;
    ......
}

如果inode代表一个设备，则i_rdev的值为设备号。为了代码更好地可移植性，获取inode的major和minor号应该使用imajor和iminor函数：

static inline unsigned iminor(const struct inode *inode)
{
    return MINOR(inode->i_rdev);
}

static inline unsigned imajor(const struct inode *inode)
{
    return MAJOR(inode->i_rdev);
}

 

Linux kernel 笔记 （40）——”file”和“inode”结构体的比较

LDD中对file结构体的描述：

struct file, defined in <linux/fs.h>, is the second most important data structure used in device drivers. Note that a file has nothing to do with the FILE pointers of user-space programs. A FILE is defined in the C library and never appears in kernel code. A struct file, on the other hand, is a kernel structure that never appears in user programs.

The file structure represents an open file . (It is not specific to device drivers; every open file in the system has an associated struct file in kernel space.) It is created by the kernel on open and is passed to any function that operates on the file, until the last close. After all instances of the file are closed, the kernel releases the data structure.

In the kernel sources, a pointer to struct file is usually called either file or filp (“file pointer”). We’ll consistently call the pointer filp to prevent ambiguities with the structure itself. Thus, file refers to the structure and filp to a pointer to the structure.

对inode结构体的描述：

The inode structure is used by the kernel internally to represent files. Therefore, it is different from the file structure that represents an open file descriptor. There can be numerous file structures representing multiple open descriptors on a single file, but they all point to a single inode structure.

总结如下：在kernel中，每一个文件都有一个inode结构体来表示，而file结构体是和打开的文件描述符关联的。如果一个文件被打开多次，有多个文件描述符，也就相应地有多个file结构体与这个文件关联。而inode却永远只有一个。