| | | | |
| Offset 24, 53 lines modified | Offset 24, 114 lines modified |
| 24 | .nh | 24 | .nh |
| 25 | .\"·disable·justification·(adjust·text·to·left·margin·only) | 25 | .\"·disable·justification·(adjust·text·to·left·margin·only) |
| 26 | .ad·l | 26 | .ad·l |
| 27 | .\"·----------------------------------------------------------------- | 27 | .\"·----------------------------------------------------------------- |
| 28 | .\"·*·MAIN·CONTENT·STARTS·HERE·* | 28 | .\"·*·MAIN·CONTENT·STARTS·HERE·* |
| 29 | .\"·----------------------------------------------------------------- | 29 | .\"·----------------------------------------------------------------- |
| 30 | .SH·"NAME" | 30 | .SH·"NAME" |
| 31 | tep_find_function,·tep_find_function_address·\-·Find·function·name·/·start·address\&. | 31 | tep_find_function,·tep_find_function_address,·tep_set_function_resolver,·tep_reset_function_resolver,·tep_register_function,·tep_register_print_string·\-·function·related·tep·APIs |
| 32 | .SH·"SYNOPSIS" | 32 | .SH·"SYNOPSIS" |
| 33 | .sp | 33 | .sp |
| 34 | .nf | 34 | .nf |
| 35 | \fB#include·<event\-parse\&.h>\fR | 35 | \fB#include·<event\-parse\&.h>\fR |
| | |
| | 36 | typedef·char·*(\fBtep_func_resolver_t\fR)(void·*\fIpriv\fR,·unsigned·long·long·*\fIaddrp\fR,·char·**\fImodp\fR); |
| | 37 | int·\fBtep_set_function_resolver\fR(struct·tep_handle·*\fItep\fR,·tep_func_resolver_t·*\fIfunc\fR,·void·*\fIpriv\fR); |
| | 38 | void·\fBtep_reset_function_resolver\fR(struct·tep_handle·*\fItep\fR); |
| 36 | const·char·*\fBtep_find_function\fR(struct·tep_handle·*\fItep\fR,·unsigned·long·long·\fIaddr\fR); | 39 | const·char·*\fBtep_find_function\fR(struct·tep_handle·*\fItep\fR,·unsigned·long·long·\fIaddr\fR); |
| 37 | unsigned·long·long·\fBtep_find_function_address\fR(struct·tep_handle·*\fItep\fR,·unsigned·long·long·\fIaddr\fR); | 40 | unsigned·long·long·\fBtep_find_function_address\fR(struct·tep_handle·*\fItep\fR,·unsigned·long·long·\fIaddr\fR); |
| | 41 | int·\fBtep_register_function\fR(struct·tep_handle·*\fItep\fR,·char·*\fIname\fR,·unsigned·long·long·\fIaddr\fR,·char·*\fImod\fR); |
| | 42 | int·\fBtep_register_print_string\fR(struct·tep_handle·*\fItep\fR,·const·char·*\fIfmt\fR,·unsigned·long·long·\fIaddr\fR); |
| 38 | .fi | 43 | .fi |
| 39 | .SH·"DESCRIPTION" | 44 | .SH·"DESCRIPTION" |
| 40 | .sp | 45 | .sp |
| | 46 | Some·tools·may·have·already·a·way·to·resolve·the·kernel·functions\&.·These·APIs·allow·them·to·keep·using·it·instead·of·duplicating·all·the·entries·inside\&. |
| | 47 | .sp |
| | 48 | The·\fItep_func_resolver_t\fR·type·is·the·prototype·of·the·alternative·kernel·functions·resolver\&.·This·function·receives·a·pointer·to·its·custom·context·(set·with·the·\fItep_set_function_resolver()\fR·call·)·and·the·address·of·a·kernel·function,·which·has·to·be·resolved\&.·In·case·of·success,·it·should·return·the·name·of·the·function·and·its·module·(if·any)·in·\fImodp\fR\&. |
| | 49 | .sp |
| | 50 | The·\fItep_set_function_resolver()\fR·function·registers·\fIfunc\fR·as·an·alternative·kernel·functions·resolver\&.·The·\fItep\fR·argument·is·trace·event·parser·context\&.·The·\fIpriv\fR·argument·is·a·custom·context·of·the·\fIfunc\fR·function\&.·The·function·resolver·is·used·by·the·APIs·\fItep_find_function()\fR,·\fItep_find_function_address()\fR,·and·\fItep_print_func_field()\fR·to·resolve·a·function·address·to·a·function·name\&. |
| | 51 | .sp |
| | 52 | The·\fItep_reset_function_resolver()\fR·function·resets·the·kernel·functions·resolver·to·the·default·function\&.·The·\fItep\fR·argument·is·trace·event·parser·context\&. |
| | 53 | .sp |
| 41 | These·functions·can·be·used·to·find·function·name·and·start·address,·by·given·address\&.·The·given·address·does·not·have·to·be·exact,·it·will·select·the·function·that·would·contain·it\&. | 54 | These·APIs·can·be·used·to·find·function·name·and·start·address,·by·given·address\&.·The·given·address·does·not·have·to·be·exact,·it·will·select·the·function·that·would·contain·it\&. |
| 42 | .sp | 55 | .sp |
| 43 | The·\fItep_find_function()\fR·function·returns·the·function·name,·which·contains·the·given·address·\fIaddr\fR\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&. | 56 | The·\fItep_find_function()\fR·function·returns·the·function·name,·which·contains·the·given·address·\fIaddr\fR\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&. |
| 44 | .sp | 57 | .sp |
| 45 | The·\fItep_find_function_address()\fR·function·returns·the·function·start·address,·by·given·address·\fIaddr\fR\&.·The·\fIaddr\fR·does·not·have·to·be·exact,·it·will·select·the·function·that·would·contain·it\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&. | 58 | The·\fItep_find_function_address()\fR·function·returns·the·function·start·address,·by·given·address·\fIaddr\fR\&.·The·\fIaddr\fR·does·not·have·to·be·exact,·it·will·select·the·function·that·would·contain·it\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&. |
| | 59 | .sp |
| | 60 | The·\fItep_register_function()\fR·function·registers·a·function·name·mapped·to·an·address·and·(optional)·module\&.·This·mapping·is·used·in·case·the·function·tracer·or·events·have·"%pS"·parameter·in·its·format·string\&.·It·is·common·to·pass·in·the·kallsyms·function·names·with·their·corresponding·addresses·with·this·function\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&.·The·\fIname\fR·is·the·name·of·the·function,·the·string·is·copied·internally\&.·The·\fIaddr\fR·is·the·start·address·of·the·function\&.·The·\fImod\fR·is·the·kernel·module·the·function·may·be·in·(NULL·for·none)\&. |
| | 61 | .sp |
| | 62 | The·\fItep_register_print_string()\fR·function·registers·a·string·by·the·address·it·was·stored·in·the·kernel\&.·Some·strings·internal·to·the·kernel·with·static·address·are·passed·to·certain·events\&.·The·"%s"·in·the·event\(cqs·format·field·which·has·an·address·needs·to·know·what·string·would·be·at·that·address\&.·The·tep_register_print_string()·supplies·the·parsing·with·the·mapping·between·kernel·addresses·and·those·strings\&.·The·\fItep\fR·argument·is·the·trace·event·parser·context\&.·The·\fIfmt\fR·is·the·string·to·register,·it·is·copied·internally\&.·The·\fIaddr\fR·is·the·address·the·string·was·located·at\&. |
| 46 | .SH·"RETURN·VALUE" | 63 | .SH·"RETURN·VALUE" |
| 47 | .sp | 64 | .sp |
| | 65 | The·\fItep_set_function_resolver()\fR·function·returns·0·in·case·of·success,·or·\-1·in·case·of·an·error\&. |
| | 66 | .sp |
| 48 | The·\fItep_find_function()\fR·function·returns·the·function·name,·or·NULL·in·case·it·cannot·be·found\&. | 67 | The·\fItep_find_function()\fR·function·returns·the·function·name,·or·NULL·in·case·it·cannot·be·found\&. |
| 49 | .sp | 68 | .sp |
| 50 | The·\fItep_find_function_address()\fR·function·returns·the·function·start·address,·or·0·in·case·it·cannot·be·found\&. | 69 | The·\fItep_find_function_address()\fR·function·returns·the·function·start·address,·or·0·in·case·it·cannot·be·found\&. |
| | 70 | .sp |
| | 71 | The·\fItep_register_function()\fR·function·returns·0·in·case·of·success\&.·In·case·of·an·error·\-1·is·returned,·and·errno·is·set·to·the·appropriate·error·number\&. |
| | 72 | .sp |
| | 73 | The·\fItep_register_print_string()\fR·function·returns·0·in·case·of·success\&.·In·case·of·an·error·\-1·is·returned,·and·errno·is·set·to·the·appropriate·error·number\&. |
| 51 | .SH·"EXAMPLE" | 74 | .SH·"EXAMPLE" |
| 52 | .sp | 75 | .sp |
| 53 | .if·n·\{\ | 76 | .if·n·\{\ |
| 54 | .RS·4 | 77 | .RS·4 |
| 55 | .\} | 78 | .\} |
| 56 | .nf | 79 | .nf |
| 57 | #include·<event\-parse\&.h> | 80 | #include·<event\-parse\&.h> |
| 58 | \&.\&.\&. | 81 | \&.\&.\&. |
| 59 | struct·tep_handle·*tep·=·tep_alloc(); | 82 | struct·tep_handle·*tep·=·tep_alloc(); |
| 60 | \&.\&.\&. | 83 | \&.\&.\&. |
| | 84 | char·*my_resolve_kernel_addr(void·*context, |
| | 85 | ·····························unsigned·long·long·*addrp,·char·**modp) |
| | 86 | { |
| | 87 | ········struct·db·*function_database·=·context; |
| | 88 | ········struct·symbol·*sym·=·sql_lookup(function_database,·*addrp); |
| | |
| | 89 | ········if·(!sym) |
| | 90 | ················return·NULL; |
| | |
| | 91 | ········*modp·=·sym\->module_name; |
| | 92 | ········return·sym\->name; |
| | 93 | } |
| | |
| 61 | void·show_function(·unsigned·long·long·addr) | 94 | void·show_function(·unsigned·long·long·addr) |
| 62 | { | 95 | { |
| | 96 | ········unsigned·long·long·fstart; |
| | 97 | ········const·char·*fname; |
| | |
| | 98 | ········if·(tep_set_function_resolver(tep,·my_resolve_kernel_addr, |
| | 99 | ······································function_database)·!=·0)·{ |
| | 100 | ················/*·failed·to·register·my_resolve_kernel_addr·*/ |
| | 101 | ········} |
| | |
| | 102 | ········/*·These·APIs·use·my_resolve_kernel_addr()·to·resolve·the·addr·*/ |
| 63 | ········const·char·*fname·=·tep_find_function(tep,·addr); | 103 | ········fname·=·tep_find_function(tep,·addr); |
| 64 | ········unsigned·long·long·fstart·=·tep_find_function_address(tep,·addr); | 104 | ········fstart·=·tep_find_function_address(tep,·addr); |
| | |
| | 105 | ········/* |
| | 106 | ···········addr·is·in·function·named·fname,·starting·at·fstart·address, |
| | 107 | ···········at·offset·(addr·\-·fstart) |
| | 108 | ········*/ |
| | |
| | 109 | ········tep_reset_function_resolver(tep); |
| | |
| 65 | ········/*·addr·is·in·function·named·fname,·starting·at·fstart·address,·at·offset·(addr·\-·fstart)·*/ | |
| 66 | } | 110 | } |
| 67 | \&.\&.\&. | 111 | \&.\&.\&. |
| | 112 | ········if·(tep_register_function(tep,·"kvm_exit", |
| | 113 | ································(unsigned·long·long)·0x12345678,·"kvm")·!=·0)·{ |
| | 114 | ················/*·Failed·to·register·kvm_exit·address·mapping·*/ |
| | 115 | ········} |
| | 116 | \&.\&.\&. |
| | 117 | ········if·(tep_register_print_string(tep,·"print·string", |
| | 118 | ································(unsigned·long·long)·0x87654321,·NULL)·!=·0)·{ |
| | 119 | ················/*·Failed·to·register·"print·string"·address·mapping·*/ |
| | 120 | ········} |
| | 121 | \&.\&.\&. |
| 68 | .fi | 122 | .fi |
| 69 | .if·n·\{\ | 123 | .if·n·\{\ |
| 70 | .RE | 124 | .RE |
| 71 | .\} | 125 | .\} |
| 72 | .SH·"FILES" | 126 | .SH·"FILES" |
| 73 | .sp | 127 | .sp |
| 74 | .if·n·\{\ | 128 | .if·n·\{\ |