[DTrace-devel] sdt provider and access to the trace_event_raw_* struct

[Kris Van Hees]

On Fri, Oct 04, 2024 at 12:29:35PM +0100, Alan Maguire wrote:
> hi folks
> 
> I've come across a case where I need to trace a kernel tracepoint with a
> lot of associated trace info.  It seems that the current approach for
> sdt probes looks at the "struct trace_event_raw_<tracepoint_name>"
> structure and maps its fields into args[] values, translating each
> member into a separate argument.  That works great for tracepoints with
> a limited number of fields. However in the case of a tracepoint with a
> lot of such fields (i.e. more than the number of args[] supported), it
> would be useful to also have a convenient way to access the raw "struct
> trace_event_raw_*" data, especially since we have access to it directly
> via CTF. It's possible to do this via a hack, e.g. the following works:

You should be able to use the raw tracepoint provider, rawtp,
e.g. rawtp:sched::sched_switch

> #!/usr/sbin/dtrace -s
> 
> sdt:sched::sched_switch
> {
>         s = (struct trace_event_raw_sched_switch *)(arg0-8);
>         print(s);
> }
> 
> 
> ...but presumably that only works because the first arg value isn't
> scalar. It would be good to have a helper or builtin variable to access
> this pointer directly. Maybe there's a better way to do this, or maybe
> we could add a helper/builtin to make this pointer accessible? What do
> folks think?
> 
> Thanks!
> 
> Alan