linuxdebugginglinux-kernelsystemtap

Difference between .function() and .function().call in systemtap


I am learning system tap utility to debug Linux Kernel.

Here is the sample code:

probe module("e1000").function("e1000_get*") {
printf("%s\n", ppfunc())
}

probe module("e1000").function("e1000_get*").return {
printf("%s \n", ppfunc())
}

What is the difference between

probe module("e1000").function("e1000_get*") and probe module("e1000").function("e1000_get*").call

I know that call is for function entry, is the above for both entry and exit


Solution

  • From docs:

    The .function variant places a probe near the beginning of the named function, so that parameters are available as context variables.

    The .return variant places a probe at the moment of return from the named function, so the return value is available as the $return context variable. The entry parameters are also available, though the function may have changed their values.

    ...

    The .inline modifier for .function filters the results to include only instances of inlined functions. The .call modifier selects the opposite subset.

    So the .call modifier is to obtain just only "calls" (as such) from results.