关于target variable的解释：
The probe events that map to actual locations in the code (for example kernel.function(“function”) and kernel.statement(“statement”)) allow the use of target variables to obtain the value of variables visible at that location in the code. You can use the -L option to list the target variable available at a probe point.
其实，目前更倾向于使用context variable这个名字，而不是target variable（可以参考这封邮件）。使用target variable需要有kernel的debuginfo。参考下面例子：
# stap -L 'kernel.function("vfs_read")'
kernel.function("vfs_read@../fs/read_write.c:381") $file:struct file* $buf:char* $count:size_t $pos:loff_t*
每个target variable前面有$，:后面跟着变量类型。例如：file变量的类型就是struct file*。也可对照vfs_read的定义：
ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
此外，对于target variable不属于当前probe的local变量，可以使用@var("varname@src/file.c")来访问：
When a target variable is not local to the probe point, like a global external variable or a file local static variable defined in another file then it can be referenced through “@var(“varname@src/file.c”)”.
请看下面这个例子：
# stap -e 'probe kernel.function("vfs_read") {
printf ("current files_stat max_files: %d\n",
@var("files_stat@fs/file_table.c")->max_files);
exit(); }'
current files_stat max_files: 82002
也可以通过指针访问一些基本类型的数据：
kernel_char(address)
Obtain the character at address from kernel memory.
kernel_short(address)
Obtain the short at address from kernel memory.
kernel_int(address)
Obtain the int at address from kernel memory.
kernel_long(address)
Obtain the long at address from kernel memory
kernel_string(address)
Obtain the string at address from kernel memory.
kernel_string_n(address, n)
Obtain the string at address from the kernel memory and limits the string to n bytes.