systemtap 追踪vfs

1. systemtap 提供在脚本中嵌入C代码的功能， 下面给出一个demo， 在vfs_read函数返回的时候打印访问文件的inode，以及path信息。

%{
#include <linux/sched.h>
#include <linux/fs.h>
#include <linux/dcache.h>
#include <linux/fdtable.h>
%}

function task_file_handle_d_path:string (task:long, file:long) %{
        struct task_struct *p = (struct task_struct *)((long)STAP_ARG_task);
        struct file *f = (struct file *)((long)STAP_ARG_file);
        struct files_struct *files;
        int next_fd;
        char *page = NULL;
        char *path = NULL;

        rcu_read_lock();
        files = kread(&(p->files));
        next_fd = kread(&(files->next_fd));
        STAP_PRINTF("files %p, %d\n", files, next_fd);
        if((page = (char *)__get_free_page(GFP_ATOMIC))) {
                path= d_path(&f->f_path,  page, PAGE_SIZE);
                if (path && !IS_ERR(path))
                        snprintf(STAP_RETVALUE, MAXSTRINGLEN, "%s", path);
        }
        CATCH_DEREF_FAULT();
        if (page)
                free_page((unsigned long)page);
        rcu_read_unlock();
%}

probe kernel.function("vfs_read").return {
        if (execname() != "stapio")
                task = pid2task(pid())
                printf("%s[%ld], %ld, %s\n", execname(), pid(), $file->f_inode->i_ino, task_file_handle_d_path(task, $file))
}

probe timer.s(2) {
        exit()
}

在systemtap中嵌入C代码需要开启guru模式，关键的地方:

1. 在C里面访问参数需要加STAP_ARG_这个前缀，例如获取task， 用STAP_ARG_task

2. 在C里面访问内核的数据结构需要用kread，直接访问会导致kernel panic， 例如要获取task->files->next_fd， 需要这样：

files = kread(&(p->files));

next_fd = kread(&(files->next_fd));

另外还需要启动stap需要加--suppress-handler-errors， 否则会出现下面的错误：

stap -g -v   vfs.stp 
Pass 1: parsed user script and 116 library script(s) using 211688virt/39260res/3232shr/36532data kb, in 170usr/10sys/190real ms.
Pass 2: analyzed script: 3 probe(s), 10 function(s), 5 embed(s), 0 global(s) using 246272virt/75104res/4300shr/71116data kb, in 440usr/60sys/493real ms.
Pass 3: translated to C into "/tmp/stapTBcM0A/stap_9082c9054f8c3ce472afaf44567dace1_7235_src.c" using 246272virt/75448res/4644shr/71116data kb, in 0usr/0sys/4real ms.
Pass 4: compiled C into "stap_9082c9054f8c3ce472afaf44567dace1_7235.ko" in 990usr/240sys/1162real ms.
Pass 5: starting run.
ERROR: read fault [man error::fault] at 0x0000000000000828 (((&(p->files)))) near identifier 'task_file_handle_d_path' at vfs.stp:8:10

输出demo：

tmux[5471], 1206, /dev/ptmx
files 0xffff883fcf244600, 9
sshd[136585], 1206, /dev/ptmx
files 0xffff883fce4cc600, 16
tmux[5471], 1206, /dev/ptmx
files 0xffff883fcf244600, 9
sshd[136585], 1206, /dev/ptmx
files 0xffff883fce4cc600, 17
tmux[5471], 145785, /proc/5542/cmdline

参考链接：

https://sourceware.org/systemtap/langref/Components_SystemTap_script.html

https://zhengheng.me/2015/02/11/systemtap-analy/