CODEWITHSUNDEEP
linux-kernelsystem-callstraceftracetracepoint
m-bat
m-bat

Reputation: 619

Why `events/syscalls/sys_enter` does not support string format as output?

I have a question about events/syscalls/sys_enter* trace point. Why does not events/syscalls/sys_enter* support string format? For example, in case of sys_enter_openat outputs the filename as hex, not string.

$ cd /sys/kernel/debug/tracing
$ cat events/syscalls/sys_enter_openat/format
name: sys_enter_openat
ID: 623
format:
        field:unsigned short common_type;       offset:0;       size:2; signed:0;
        field:unsigned char common_flags;       offset:2;       size:1; signed:0;
        field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
        field:int common_pid;   offset:4;       size:4; signed:1;

        field:int __syscall_nr; offset:8;       size:4; signed:1;
        field:int dfd;  offset:16;      size:8; signed:0;
        field:const char * filename;    offset:24;      size:8; signed:0;
        field:int flags;        offset:32;      size:8; signed:0;
        field:umode_t mode;     offset:40;      size:8; signed:0;

print fmt: "dfd: 0x%08lx, filename: 0x%08lx, flags: 0x%08lx, mode: 0x%08lx", ((unsigned long)(REC->dfd)), ((unsigned long)(REC->filename)), ((unsigned long)(REC->flags)), ((unsigned long)(REC->mode))

I know I can get the filename as string using kprobe, but I'd not know why sys_enter_openat does not use %s for the output format by default as follows.

print fmt: "dfd: 0x%08lx, filename: %s, ...

Is there any restriction the tracer cannot dereference the pointer? (In case of cat events/sched/sched_switch/format, the format uses %s to output the string.)

Related question: Change format of syscall event trace output to ftrace

Upvotes: 1

Views: 499

Answers (0)

Related Questions