Systap

Install

Ubnutu 16.04 with 4.4.0-36-generic:

Use the `stap-prep` command to prepare the system for use with systap.

• Kernel debug symbols can be installed using this guide: https://wiki.ubuntu.com/DebuggingProgramCrash#Non-built-in_debug_symbol_packages_.28.2A-dbgsym.29
• Then `sudo apt-get install linux-image-4.4.0-36-generic-dbgsym`

 

After install completes:

bensley@ubuntu-laptop:~/C/etherate10+$ stap -L 'kernel.function("packet_snd")'
kernel.function("packet_snd@/build/linux-a2WvEb/linux-4.4.0/net/packet/af_packet.c:2626")

 

CentOS 7 with 3.10.0-693.5.2.el7.x86_64:

Running `stat-prep` says that the package `kernel-debuginfo-3.10.0-693.5.2.el7.x86_64` is needed. Running `sudo stat-prep` installs it automatically.

After install completes:

[user@ucpe_002 emt]$ stap -L 'kernel.function("packet_snd")'
kernel.function("packet_snd@net/packet/af_packet.c:2298")

 

Examples

Capture all params passed to a Kernel function, runs one time them quits:

sudo stap -e 'probe kernel.function("packet_snd") {printf("%s\n", $$parms); exit(); }'

 

Add $ suffix to $$parms to pretty print:

bensley@ubuntu-laptop:~/C/etherate10+$ sudo stap -e 'probe kernel.function("packet_snd") {printf("%s\n", $$parms$); exit(); }'
sock={.state=?, .type=?, .flags=?, .wq=?, .file=?, .sk=?, .ops=?} sock={.state=?, .type=?, .flags=?, .wq=?, .file=?, .sk=?, .ops=?} len=? msg={.msg_name=?, .msg_namelen=?, .msg_iter={...}, .msg_control=?, .msg_controllen=?, .msg_flags=?, .msg_iocb=?}

 

Add $$ suffix to $$parms to pretty print and expand nested data structures:

bensley@ubuntu-laptop:~/C/etherate10+$ sudo stap -e 'probe kernel.function("packet_snd") {printf("%s\n", $$parms$$); exit(); }'
sock={.state=?, .type=?, .flags=?, .wq=?, .file=?, .sk=?, .ops=?} sock={.state=?, .type=?, .flags=?, .wq=?, .file=?, .sk=?, .ops=?} len=? msg={.msg_name=?, .msg_namelen=?, .msg_iter={.type=?, .iov_offset=?, .count=?, <union>={.iov=?, .kvec=?, .bvec=?}, .nr_segs=?}, .msg_control=?, .msg_controllen=?, .msg_flags=?, .msg_iocb=?}

 

Not sure why all the values above are unresolved "?". The function being traced `packet_snd()` is called by `packet_sendmsg()` and tracing that parent function works fine:

bensley@ubuntu-laptop:~/C/etherate10+$ sudo stap -e 'probe kernel.function("packet_sendmsg") {printf("%s\n", $$parms$$); exit(); }'
sock={.state=1, .type=3, .flags=0, .wq=0xffff8801c48d4f00, .file=0xffff8801c3880c00, .sk=0xffff88008e02f800, .ops=0xffffffff81acb480} msg={.msg_name=0x0, .msg_namelen=0, .msg_iter={.type=1, .iov_offset=0, .count=1514, <union>={.iov=0xffff8801c3be7d50, .kvec=0xffff8801c3be7d50, .bvec=0xffff8801c3be7d50}, .nr_segs=1}, .msg_control=0x0, .msg_controllen=0, .msg_flags=0, .msg_iocb=0x0} len=1514

 

---