Merge branch 'perf/core' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux-2.6 into perf/core

7 files changed, 523 insertions, 165 deletions

diff --git a/Documentation/trace/kprobetrace.txt b/Documentation/trace/kprobetrace.txt
index ec94748ae65b..5f77d94598dd 100644
--- a/Documentation/trace/kprobetrace.txt
+++ b/Documentation/trace/kprobetrace.txt
@@ -42,7 +42,7 @@ Synopsis of kprobe_events
   +|-offs(FETCHARG) : Fetch memory at FETCHARG +|- offs address.(**)
   NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
   FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
-                  (u8/u16/u32/u64/s8/s16/s32/s64) are supported.
+                  (u8/u16/u32/u64/s8/s16/s32/s64) and string are supported.
 
   (*) only for return probe.
   (**) this is useful for fetching a field of data structures.
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3b831d8e201e..1b79d1c15726 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -30,6 +30,8 @@
 #include <linux/ptrace.h>
 #include <linux/perf_event.h>
 #include <linux/stringify.h>
+#include <linux/limits.h>
+#include <linux/uaccess.h>
 #include <asm/bitsperlong.h>
 
 #include "trace.h"
@@ -38,6 +40,7 @@
 #define MAX_TRACE_ARGS 128
 #define MAX_ARGSTR_LEN 63
 #define MAX_EVENT_NAME_LEN 64
+#define MAX_STRING_SIZE PATH_MAX
 #define KPROBE_EVENT_SYSTEM "kprobes"
 
 /* Reserved field names */
@@ -58,14 +61,16 @@ const char *reserved_field_names[] = {
 };
 
 /* Printing function type */
-typedef int (*print_type_func_t)(struct trace_seq *, const char *, void *);
+typedef int (*print_type_func_t)(struct trace_seq *, const char *, void *,
+                                 void *);
 #define PRINT_TYPE_FUNC_NAME(type)      print_type_##type
 #define PRINT_TYPE_FMT_NAME(type)       print_type_format_##type
 
 /* Printing  in basic type function template */
 #define DEFINE_BASIC_PRINT_TYPE_FUNC(type, fmt, cast)                   \
 static __kprobes int PRINT_TYPE_FUNC_NAME(type)(struct trace_seq *s,    \
-                                                const char *name, void *data)\
+                                                const char *name,       \
+                                                void *data, void *ent)\
 {                                                                       \
         return trace_seq_printf(s, " %s=" fmt, name, (cast)*(type *)data);\
 }                                                                       \
@@ -80,6 +85,49 @@ DEFINE_BASIC_PRINT_TYPE_FUNC(s16, "%d", int)
 DEFINE_BASIC_PRINT_TYPE_FUNC(s32, "%ld", long)
 DEFINE_BASIC_PRINT_TYPE_FUNC(s64, "%lld", long long)
 
+/* data_rloc: data relative location, compatible with u32 */
+#define make_data_rloc(len, roffs)      \
+        (((u32)(len) << 16) | ((u32)(roffs) & 0xffff))
+#define get_rloc_len(dl)        ((u32)(dl) >> 16)
+#define get_rloc_offs(dl)       ((u32)(dl) & 0xffff)
+
+static inline void *get_rloc_data(u32 *dl)
+{
+        return (u8 *)dl + get_rloc_offs(*dl);
+}
+
+/* For data_loc conversion */
+static inline void *get_loc_data(u32 *dl, void *ent)
+{
+        return (u8 *)ent + get_rloc_offs(*dl);
+}
+
+/*
+ * Convert data_rloc to data_loc:
+ *  data_rloc stores the offset from data_rloc itself, but data_loc
+ *  stores the offset from event entry.
+ */
+#define convert_rloc_to_loc(dl, offs)   ((u32)(dl) + (offs))
+
+/* For defining macros, define string/string_size types */
+typedef u32 string;
+typedef u32 string_size;
+
+/* Print type function for string type */
+static __kprobes int PRINT_TYPE_FUNC_NAME(string)(struct trace_seq *s,
+                                                  const char *name,
+                                                  void *data, void *ent)
+{
+        int len = *(u32 *)data >> 16;
+
+        if (!len)
+                return trace_seq_printf(s, " %s=(fault)", name);
+        else
+                return trace_seq_printf(s, " %s=\"%s\"", name,
+                                        (const char *)get_loc_data(data, ent));
+}
+static const char PRINT_TYPE_FMT_NAME(string)[] = "\\\"%s\\\"";
+
 /* Data fetch function type */
 typedef void (*fetch_func_t)(struct pt_regs *, void *, void *);
 
@@ -94,32 +142,38 @@ static __kprobes void call_fetch(struct fetch_param *fprm,
         return fprm->fn(regs, fprm->data, dest);
 }
 
-#define FETCH_FUNC_NAME(kind, type)     fetch_##kind##_##type
+#define FETCH_FUNC_NAME(method, type)   fetch_##method##_##type
 /*
  * Define macro for basic types - we don't need to define s* types, because
  * we have to care only about bitwidth at recording time.
  */
-#define DEFINE_BASIC_FETCH_FUNCS(kind)  \
-DEFINE_FETCH_##kind(u8)                 \
-DEFINE_FETCH_##kind(u16)                \
-DEFINE_FETCH_##kind(u32)                \
-DEFINE_FETCH_##kind(u64)
-
-#define CHECK_BASIC_FETCH_FUNCS(kind, fn)       \
-        ((FETCH_FUNC_NAME(kind, u8) == fn) ||   \
-         (FETCH_FUNC_NAME(kind, u16) == fn) ||  \
-         (FETCH_FUNC_NAME(kind, u32) == fn) ||  \
-         (FETCH_FUNC_NAME(kind, u64) == fn))
+#define DEFINE_BASIC_FETCH_FUNCS(method) \
+DEFINE_FETCH_##method(u8)               \
+DEFINE_FETCH_##method(u16)              \
+DEFINE_FETCH_##method(u32)              \
+DEFINE_FETCH_##method(u64)
+
+#define CHECK_FETCH_FUNCS(method, fn)                   \
+        (((FETCH_FUNC_NAME(method, u8) == fn) ||        \
+          (FETCH_FUNC_NAME(method, u16) == fn) ||       \
+          (FETCH_FUNC_NAME(method, u32) == fn) ||       \
+          (FETCH_FUNC_NAME(method, u64) == fn) ||       \
+          (FETCH_FUNC_NAME(method, string) == fn) ||    \
+          (FETCH_FUNC_NAME(method, string_size) == fn)) \
+         && (fn != NULL))
 
 /* Data fetch function templates */
 #define DEFINE_FETCH_reg(type)                                          \
 static __kprobes void FETCH_FUNC_NAME(reg, type)(struct pt_regs *regs,  \
-                                          void *offset, void *dest)     \
+                                        void *offset, void *dest)       \
 {                                                                       \
         *(type *)dest = (type)regs_get_register(regs,                   \
                                 (unsigned int)((unsigned long)offset)); \
 }
 DEFINE_BASIC_FETCH_FUNCS(reg)
+/* No string on the register */
+#define fetch_reg_string NULL
+#define fetch_reg_string_size NULL
 
 #define DEFINE_FETCH_stack(type)                                        \
 static __kprobes void FETCH_FUNC_NAME(stack, type)(struct pt_regs *regs,\
@@ -129,6 +183,9 @@ static __kprobes void FETCH_FUNC_NAME(stack, type)(struct pt_regs *regs,\
                                 (unsigned int)((unsigned long)offset)); \
 }
 DEFINE_BASIC_FETCH_FUNCS(stack)
+/* No string on the stack entry */
+#define fetch_stack_string NULL
+#define fetch_stack_string_size NULL
 
 #define DEFINE_FETCH_retval(type)                                       \
 static __kprobes void FETCH_FUNC_NAME(retval, type)(struct pt_regs *regs,\
@@ -137,6 +194,9 @@ static __kprobes void FETCH_FUNC_NAME(retval, type)(struct pt_regs *regs,\
         *(type *)dest = (type)regs_return_value(regs);                  \
 }
 DEFINE_BASIC_FETCH_FUNCS(retval)
+/* No string on the retval */
+#define fetch_retval_string NULL
+#define fetch_retval_string_size NULL
 
 #define DEFINE_FETCH_memory(type)                                       \
 static __kprobes void FETCH_FUNC_NAME(memory, type)(struct pt_regs *regs,\
@@ -149,6 +209,62 @@ static __kprobes void FETCH_FUNC_NAME(memory, type)(struct pt_regs *regs,\
                 *(type *)dest = retval;                                 \
 }
 DEFINE_BASIC_FETCH_FUNCS(memory)
+/*
+ * Fetch a null-terminated string. Caller MUST set *(u32 *)dest with max
+ * length and relative data location.
+ */
+static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
+                                                      void *addr, void *dest)
+{
+        long ret;
+        int maxlen = get_rloc_len(*(u32 *)dest);
+        u8 *dst = get_rloc_data(dest);
+        u8 *src = addr;
+        mm_segment_t old_fs = get_fs();
+        if (!maxlen)
+                return;
+        /*
+         * Try to get string again, since the string can be changed while
+         * probing.
+         */
+        set_fs(KERNEL_DS);
+        pagefault_disable();
+        do
+                ret = __copy_from_user_inatomic(dst++, src++, 1);
+        while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
+        dst[-1] = '\0';
+        pagefault_enable();
+        set_fs(old_fs);
+
+        if (ret < 0) {  /* Failed to fetch string */
+                ((u8 *)get_rloc_data(dest))[0] = '\0';
+                *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
+        } else
+                *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
+                                              get_rloc_offs(*(u32 *)dest));
+}
+/* Return the length of string -- including null terminal byte */
+static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs,
+                                                        void *addr, void *dest)
+{
+        int ret, len = 0;
+        u8 c;
+        mm_segment_t old_fs = get_fs();
+
+        set_fs(KERNEL_DS);
+        pagefault_disable();
+        do {
+                ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
+                len++;
+        } while (c && ret == 0 && len < MAX_STRING_SIZE);
+        pagefault_enable();
+        set_fs(old_fs);
+
+        if (ret < 0)    /* Failed to check the length */
+                *(u32 *)dest = 0;
+        else
+                *(u32 *)dest = len;
+}
 
 /* Memory fetching by symbol */
 struct symbol_cache {
@@ -203,6 +319,8 @@ static __kprobes void FETCH_FUNC_NAME(symbol, type)(struct pt_regs *regs,\
                 *(type *)dest = 0;                                      \
 }
 DEFINE_BASIC_FETCH_FUNCS(symbol)
+DEFINE_FETCH_symbol(string)
+DEFINE_FETCH_symbol(string_size)
 
 /* Dereference memory access function */
 struct deref_fetch_param {
@@ -224,12 +342,14 @@ static __kprobes void FETCH_FUNC_NAME(deref, type)(struct pt_regs *regs,\
                 *(type *)dest = 0;                                      \
 }
 DEFINE_BASIC_FETCH_FUNCS(deref)
+DEFINE_FETCH_deref(string)
+DEFINE_FETCH_deref(string_size)
 
 static __kprobes void free_deref_fetch_param(struct deref_fetch_param *data)
 {
-        if (CHECK_BASIC_FETCH_FUNCS(deref, data->orig.fn))
+        if (CHECK_FETCH_FUNCS(deref, data->orig.fn))
                 free_deref_fetch_param(data->orig.data);
-        else if (CHECK_BASIC_FETCH_FUNCS(symbol, data->orig.fn))
+        else if (CHECK_FETCH_FUNCS(symbol, data->orig.fn))
                 free_symbol_cache(data->orig.data);
         kfree(data);
 }
@@ -240,23 +360,43 @@ static __kprobes void free_deref_fetch_param(struct deref_fetch_param *data)
 #define DEFAULT_FETCH_TYPE _DEFAULT_FETCH_TYPE(BITS_PER_LONG)
 #define DEFAULT_FETCH_TYPE_STR __stringify(DEFAULT_FETCH_TYPE)
 
-#define ASSIGN_FETCH_FUNC(kind, type)   \
-        .kind = FETCH_FUNC_NAME(kind, type)
-
-#define ASSIGN_FETCH_TYPE(ptype, ftype, sign)   \
-        {.name = #ptype,                        \
-         .size = sizeof(ftype),                 \
-         .is_signed = sign,                     \
-         .print = PRINT_TYPE_FUNC_NAME(ptype),  \
-         .fmt = PRINT_TYPE_FMT_NAME(ptype),     \
-ASSIGN_FETCH_FUNC(reg, ftype),                  \
-ASSIGN_FETCH_FUNC(stack, ftype),                \
-ASSIGN_FETCH_FUNC(retval, ftype),               \
-ASSIGN_FETCH_FUNC(memory, ftype),               \
-ASSIGN_FETCH_FUNC(symbol, ftype),               \
-ASSIGN_FETCH_FUNC(deref, ftype),                \
+/* Fetch types */
+enum {
+        FETCH_MTD_reg = 0,
+        FETCH_MTD_stack,
+        FETCH_MTD_retval,
+        FETCH_MTD_memory,
+        FETCH_MTD_symbol,
+        FETCH_MTD_deref,
+        FETCH_MTD_END,
+};
+
+#define ASSIGN_FETCH_FUNC(method, type) \
+        [FETCH_MTD_##method] = FETCH_FUNC_NAME(method, type)
+
+#define __ASSIGN_FETCH_TYPE(_name, ptype, ftype, _size, sign, _fmttype) \
+        {.name = _name,                         \
+         .size = _size,                                 \
+         .is_signed = sign,                             \
+         .print = PRINT_TYPE_FUNC_NAME(ptype),          \
+         .fmt = PRINT_TYPE_FMT_NAME(ptype),             \
+         .fmttype = _fmttype,                           \
+         .fetch = {                                     \
+ASSIGN_FETCH_FUNC(reg, ftype),                          \
+ASSIGN_FETCH_FUNC(stack, ftype),                        \
+ASSIGN_FETCH_FUNC(retval, ftype),                       \
+ASSIGN_FETCH_FUNC(memory, ftype),                       \
+ASSIGN_FETCH_FUNC(symbol, ftype),                       \
+ASSIGN_FETCH_FUNC(deref, ftype),                        \
+          }                                             \
         }
 
+#define ASSIGN_FETCH_TYPE(ptype, ftype, sign)                   \
+        __ASSIGN_FETCH_TYPE(#ptype, ptype, ftype, sizeof(ftype), sign, #ptype)
+
+#define FETCH_TYPE_STRING 0
+#define FETCH_TYPE_STRSIZE 1
+
 /* Fetch type information table */
 static const struct fetch_type {
         const char      *name;          /* Name of type */
@@ -264,14 +404,16 @@ static const struct fetch_type {
         int             is_signed;      /* Signed flag */
         print_type_func_t       print;  /* Print functions */
         const char      *fmt;           /* Fromat string */
+        const char      *fmttype;       /* Name in format file */
         /* Fetch functions */
-        fetch_func_t    reg;
-        fetch_func_t    stack;
-        fetch_func_t    retval;
-        fetch_func_t    memory;
-        fetch_func_t    symbol;
-        fetch_func_t    deref;
+        fetch_func_t    fetch[FETCH_MTD_END];
 } fetch_type_table[] = {
+        /* Special types */
+        [FETCH_TYPE_STRING] = __ASSIGN_FETCH_TYPE("string", string, string,
+                                        sizeof(u32), 1, "__data_loc char[]"),
+        [FETCH_TYPE_STRSIZE] = __ASSIGN_FETCH_TYPE("string_size", u32,
+                                        string_size, sizeof(u32), 0, "u32"),
+        /* Basic types */
         ASSIGN_FETCH_TYPE(u8,  u8,  0),
         ASSIGN_FETCH_TYPE(u16, u16, 0),
         ASSIGN_FETCH_TYPE(u32, u32, 0),
@@ -302,12 +444,28 @@ static __kprobes void fetch_stack_address(struct pt_regs *regs,
         *(unsigned long *)dest = kernel_stack_pointer(regs);
 }
 
+static fetch_func_t get_fetch_size_function(const struct fetch_type *type,
+                                            fetch_func_t orig_fn)
+{
+        int i;
+
+        if (type != &fetch_type_table[FETCH_TYPE_STRING])
+                return NULL;    /* Only string type needs size function */
+        for (i = 0; i < FETCH_MTD_END; i++)
+                if (type->fetch[i] == orig_fn)
+                        return fetch_type_table[FETCH_TYPE_STRSIZE].fetch[i];
+
+        WARN_ON(1);     /* This should not happen */
+        return NULL;
+}
+
 /**
  * Kprobe event core functions
  */
 
 struct probe_arg {
         struct fetch_param      fetch;
+        struct fetch_param      fetch_size;
         unsigned int            offset; /* Offset from argument entry */
         const char              *name;  /* Name of this argument */
         const char              *comm;  /* Command of this argument */
@@ -429,9 +587,9 @@ error:
 
 static void free_probe_arg(struct probe_arg *arg)
 {
-        if (CHECK_BASIC_FETCH_FUNCS(deref, arg->fetch.fn))
+        if (CHECK_FETCH_FUNCS(deref, arg->fetch.fn))
                 free_deref_fetch_param(arg->fetch.data);
-        else if (CHECK_BASIC_FETCH_FUNCS(symbol, arg->fetch.fn))
+        else if (CHECK_FETCH_FUNCS(symbol, arg->fetch.fn))
                 free_symbol_cache(arg->fetch.data);
         kfree(arg->name);
         kfree(arg->comm);
@@ -548,7 +706,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
 
         if (strcmp(arg, "retval") == 0) {
                 if (is_return)
-                        f->fn = t->retval;
+                        f->fn = t->fetch[FETCH_MTD_retval];
                 else
                         ret = -EINVAL;
         } else if (strncmp(arg, "stack", 5) == 0) {
@@ -562,7 +720,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
                         if (ret || param > PARAM_MAX_STACK)
                                 ret = -EINVAL;
                         else {
-                                f->fn = t->stack;
+                                f->fn = t->fetch[FETCH_MTD_stack];
                                 f->data = (void *)param;
                         }
                 } else
@@ -588,7 +746,7 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
         case '%':       /* named register */
                 ret = regs_query_register_offset(arg + 1);
                 if (ret >= 0) {
-                        f->fn = t->reg;
+                        f->fn = t->fetch[FETCH_MTD_reg];
                         f->data = (void *)(unsigned long)ret;
                         ret = 0;
                 }
@@ -598,7 +756,7 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
                         ret = strict_strtoul(arg + 1, 0, &param);
                         if (ret)
                                 break;
-                        f->fn = t->memory;
+                        f->fn = t->fetch[FETCH_MTD_memory];
                         f->data = (void *)param;
                 } else {
                         ret = split_symbol_offset(arg + 1, &offset);
@@ -606,7 +764,7 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
                                 break;
                         f->data = alloc_symbol_cache(arg + 1, offset);
                         if (f->data)
-                                f->fn = t->symbol;
+                                f->fn = t->fetch[FETCH_MTD_symbol];
                 }
                 break;
         case '+':       /* deref memory */
@@ -636,14 +794,17 @@ static int __parse_probe_arg(char *arg, const struct fetch_type *t,
                         if (ret)
                                 kfree(dprm);
                         else {
-                                f->fn = t->deref;
+                                f->fn = t->fetch[FETCH_MTD_deref];
                                 f->data = (void *)dprm;
                         }
                 }
                 break;
         }
-        if (!ret && !f->fn)
+        if (!ret && !f->fn) {   /* Parsed, but do not find fetch method */
+                pr_info("%s type has no corresponding fetch method.\n",
+                        t->name);
                 ret = -EINVAL;
+        }
         return ret;
 }
 
@@ -652,6 +813,7 @@ static int parse_probe_arg(char *arg, struct trace_probe *tp,
                            struct probe_arg *parg, int is_return)
 {
         const char *t;
+        int ret;
 
         if (strlen(arg) > MAX_ARGSTR_LEN) {
                 pr_info("Argument is too long.: %s\n",  arg);
@@ -674,7 +836,13 @@ static int parse_probe_arg(char *arg, struct trace_probe *tp,
         }
         parg->offset = tp->size;
         tp->size += parg->type->size;
-        return __parse_probe_arg(arg, parg->type, &parg->fetch, is_return);
+        ret = __parse_probe_arg(arg, parg->type, &parg->fetch, is_return);
+        if (ret >= 0) {
+                parg->fetch_size.fn = get_fetch_size_function(parg->type,
+                                                              parg->fetch.fn);
+                parg->fetch_size.data = parg->fetch.data;
+        }
+        return ret;
 }
 
 /* Return 1 if name is reserved or already used by another argument */
@@ -1043,6 +1211,54 @@ static const struct file_operations kprobe_profile_ops = {
         .release        = seq_release,
 };
 
+/* Sum up total data length for dynamic arraies (strings) */
+static __kprobes int __get_data_size(struct trace_probe *tp,
+                                     struct pt_regs *regs)
+{
+        int i, ret = 0;
+        u32 len;
+
+        for (i = 0; i < tp->nr_args; i++)
+                if (unlikely(tp->args[i].fetch_size.fn)) {
+                        call_fetch(&tp->args[i].fetch_size, regs, &len);
+                        ret += len;
+                }
+
+        return ret;
+}
+
+/* Store the value of each argument */
+static __kprobes void store_trace_args(int ent_size, struct trace_probe *tp,
+                                       struct pt_regs *regs,
+                                       u8 *data, int maxlen)
+{
+        int i;
+        u32 end = tp->size;
+        u32 *dl;        /* Data (relative) location */
+
+        for (i = 0; i < tp->nr_args; i++) {
+                if (unlikely(tp->args[i].fetch_size.fn)) {
+                        /*
+                         * First, we set the relative location and
+                         * maximum data length to *dl
+                         */
+                        dl = (u32 *)(data + tp->args[i].offset);
+                        *dl = make_data_rloc(maxlen, end - tp->args[i].offset);
+                        /* Then try to fetch string or dynamic array data */
+                        call_fetch(&tp->args[i].fetch, regs, dl);
+                        /* Reduce maximum length */
+                        end += get_rloc_len(*dl);
+                        maxlen -= get_rloc_len(*dl);
+                        /* Trick here, convert data_rloc to data_loc */
+                        *dl = convert_rloc_to_loc(*dl,
+                                 ent_size + tp->args[i].offset);
+                } else
+                        /* Just fetching data normally */
+                        call_fetch(&tp->args[i].fetch, regs,
+                                   data + tp->args[i].offset);
+        }
+}
+
 /* Kprobe handler */
 static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
 {
@@ -1050,8 +1266,7 @@ static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
         struct kprobe_trace_entry_head *entry;
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
-        u8 *data;
-        int size, i, pc;
+        int size, dsize, pc;
         unsigned long irq_flags;
         struct ftrace_event_call *call = &tp->call;
 
@@ -1060,7 +1275,8 @@ static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
         local_save_flags(irq_flags);
         pc = preempt_count();
 
-        size = sizeof(*entry) + tp->size;
+        dsize = __get_data_size(tp, regs);
+        size = sizeof(*entry) + tp->size + dsize;
 
         event = trace_current_buffer_lock_reserve(&buffer, call->event.type,
                                                   size, irq_flags, pc);
@@ -1069,9 +1285,7 @@ static __kprobes void kprobe_trace_func(struct kprobe *kp, struct pt_regs *regs)
 
         entry = ring_buffer_event_data(event);
         entry->ip = (unsigned long)kp->addr;
-        data = (u8 *)&entry[1];
-        for (i = 0; i < tp->nr_args; i++)
-                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
+        store_trace_args(sizeof(*entry), tp, regs, (u8 *)&entry[1], dsize);
 
         if (!filter_current_check_discard(buffer, call, entry, event))
                 trace_nowake_buffer_unlock_commit(buffer, event, irq_flags, pc);
@@ -1085,15 +1299,15 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
         struct kretprobe_trace_entry_head *entry;
         struct ring_buffer_event *event;
         struct ring_buffer *buffer;
-        u8 *data;
-        int size, i, pc;
+        int size, pc, dsize;
         unsigned long irq_flags;
         struct ftrace_event_call *call = &tp->call;
 
         local_save_flags(irq_flags);
         pc = preempt_count();
 
-        size = sizeof(*entry) + tp->size;
+        dsize = __get_data_size(tp, regs);
+        size = sizeof(*entry) + tp->size + dsize;
 
         event = trace_current_buffer_lock_reserve(&buffer, call->event.type,
                                                   size, irq_flags, pc);
@@ -1103,9 +1317,7 @@ static __kprobes void kretprobe_trace_func(struct kretprobe_instance *ri,
         entry = ring_buffer_event_data(event);
         entry->func = (unsigned long)tp->rp.kp.addr;
         entry->ret_ip = (unsigned long)ri->ret_addr;
-        data = (u8 *)&entry[1];
-        for (i = 0; i < tp->nr_args; i++)
-                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
+        store_trace_args(sizeof(*entry), tp, regs, (u8 *)&entry[1], dsize);
 
         if (!filter_current_check_discard(buffer, call, entry, event))
                 trace_nowake_buffer_unlock_commit(buffer, event, irq_flags, pc);
@@ -1137,7 +1349,7 @@ print_kprobe_event(struct trace_iterator *iter, int flags,
         data = (u8 *)&field[1];
         for (i = 0; i < tp->nr_args; i++)
                 if (!tp->args[i].type->print(s, tp->args[i].name,
-                                             data + tp->args[i].offset))
+                                             data + tp->args[i].offset, field))
                         goto partial;
 
         if (!trace_seq_puts(s, "\n"))
@@ -1179,7 +1391,7 @@ print_kretprobe_event(struct trace_iterator *iter, int flags,
         data = (u8 *)&field[1];
         for (i = 0; i < tp->nr_args; i++)
                 if (!tp->args[i].type->print(s, tp->args[i].name,
-                                             data + tp->args[i].offset))
+                                             data + tp->args[i].offset, field))
                         goto partial;
 
         if (!trace_seq_puts(s, "\n"))
@@ -1234,7 +1446,7 @@ static int kprobe_event_define_fields(struct ftrace_event_call *event_call)
         DEFINE_FIELD(unsigned long, ip, FIELD_STRING_IP, 0);
         /* Set argument names as fields */
         for (i = 0; i < tp->nr_args; i++) {
-                ret = trace_define_field(event_call, tp->args[i].type->name,
+                ret = trace_define_field(event_call, tp->args[i].type->fmttype,
                                          tp->args[i].name,
                                          sizeof(field) + tp->args[i].offset,
                                          tp->args[i].type->size,
@@ -1256,7 +1468,7 @@ static int kretprobe_event_define_fields(struct ftrace_event_call *event_call)
         DEFINE_FIELD(unsigned long, ret_ip, FIELD_STRING_RETIP, 0);
         /* Set argument names as fields */
         for (i = 0; i < tp->nr_args; i++) {
-                ret = trace_define_field(event_call, tp->args[i].type->name,
+                ret = trace_define_field(event_call, tp->args[i].type->fmttype,
                                          tp->args[i].name,
                                          sizeof(field) + tp->args[i].offset,
                                          tp->args[i].type->size,
@@ -1296,8 +1508,13 @@ static int __set_print_fmt(struct trace_probe *tp, char *buf, int len)
         pos += snprintf(buf + pos, LEN_OR_ZERO, "\", %s", arg);
 
         for (i = 0; i < tp->nr_args; i++) {
-                pos += snprintf(buf + pos, LEN_OR_ZERO, ", REC->%s",
-                                tp->args[i].name);
+                if (strcmp(tp->args[i].type->name, "string") == 0)
+                        pos += snprintf(buf + pos, LEN_OR_ZERO,
+                                        ", __get_str(%s)",
+                                        tp->args[i].name);
+                else
+                        pos += snprintf(buf + pos, LEN_OR_ZERO, ", REC->%s",
+                                        tp->args[i].name);
         }
 
 #undef LEN_OR_ZERO
@@ -1334,11 +1551,11 @@ static __kprobes void kprobe_perf_func(struct kprobe *kp,
         struct ftrace_event_call *call = &tp->call;
         struct kprobe_trace_entry_head *entry;
         struct hlist_head *head;
-        u8 *data;
-        int size, __size, i;
+        int size, __size, dsize;
         int rctx;
 
-        __size = sizeof(*entry) + tp->size;
+        dsize = __get_data_size(tp, regs);
+        __size = sizeof(*entry) + tp->size + dsize;
         size = ALIGN(__size + sizeof(u32), sizeof(u64));
         size -= sizeof(u32);
         if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
@@ -1350,9 +1567,8 @@ static __kprobes void kprobe_perf_func(struct kprobe *kp,
                 return;
 
         entry->ip = (unsigned long)kp->addr;
-        data = (u8 *)&entry[1];
-        for (i = 0; i < tp->nr_args; i++)
-                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
+        memset(&entry[1], 0, dsize);
+        store_trace_args(sizeof(*entry), tp, regs, (u8 *)&entry[1], dsize);
 
         head = this_cpu_ptr(call->perf_events);
         perf_trace_buf_submit(entry, size, rctx, entry->ip, 1, regs, head);
@@ -1366,11 +1582,11 @@ static __kprobes void kretprobe_perf_func(struct kretprobe_instance *ri,
         struct ftrace_event_call *call = &tp->call;
         struct kretprobe_trace_entry_head *entry;
         struct hlist_head *head;
-        u8 *data;
-        int size, __size, i;
+        int size, __size, dsize;
         int rctx;
 
-        __size = sizeof(*entry) + tp->size;
+        dsize = __get_data_size(tp, regs);
+        __size = sizeof(*entry) + tp->size + dsize;
         size = ALIGN(__size + sizeof(u32), sizeof(u64));
         size -= sizeof(u32);
         if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
@@ -1383,9 +1599,7 @@ static __kprobes void kretprobe_perf_func(struct kretprobe_instance *ri,
 
         entry->func = (unsigned long)tp->rp.kp.addr;
         entry->ret_ip = (unsigned long)ri->ret_addr;
-        data = (u8 *)&entry[1];
-        for (i = 0; i < tp->nr_args; i++)
-                call_fetch(&tp->args[i].fetch, regs, data + tp->args[i].offset);
+        store_trace_args(sizeof(*entry), tp, regs, (u8 *)&entry[1], dsize);
 
         head = this_cpu_ptr(call->perf_events);
         perf_trace_buf_submit(entry, size, rctx, entry->ret_ip, 1, regs, head);
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index ea531d9d975c..27d52dae5a43 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -94,8 +94,8 @@ Each probe argument follows below syntax.
 
  [NAME=]LOCALVAR|$retval|%REG|@SYMBOL[:TYPE]
 
-'NAME' specifies the name of this argument (optional). You can use the name of local variable, local data structure member (e.g. var->field, var.field2), or kprobe-tracer argument format (e.g. $retval, %ax, etc). Note that the name of this argument will be set as the last member name if you specify a local data structure member (e.g. field2 for 'var->field1.field2'.)
-'TYPE' casts the type of this argument (optional). If omitted, perf probe automatically set the type based on debuginfo.
+'NAME' specifies the name of this argument (optional). You can use the name of local variable, local data structure member (e.g. var->field, var.field2), local array with fixed index (e.g. array[1], var->array[0], var->pointer[2]), or kprobe-tracer argument format (e.g. $retval, %ax, etc). Note that the name of this argument will be set as the last member name if you specify a local data structure member (e.g. field2 for 'var->field1.field2'.)
+'TYPE' casts the type of this argument (optional). If omitted, perf probe automatically set the type based on debuginfo. You can specify 'string' type only for the local variable or structure member which is an array of or a pointer to 'char' or 'unsigned char' type.
 
 LINE SYNTAX
 -----------
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 17a3692397c5..26f626d45a9e 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -605,33 +605,35 @@ endif
 
 ifdef NO_DEMANGLE
         BASIC_CFLAGS += -DNO_DEMANGLE
-else ifdef HAVE_CPLUS_DEMANGLE
-        EXTLIBS += -liberty
-        BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
 else
-        FLAGS_BFD=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd
-        has_bfd := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD))
-        ifeq ($(has_bfd),y)
-                EXTLIBS += -lbfd
-        else
-                FLAGS_BFD_IBERTY=$(FLAGS_BFD) -liberty
-                has_bfd_iberty := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD_IBERTY))
-                ifeq ($(has_bfd_iberty),y)
-                        EXTLIBS += -lbfd -liberty
+        ifdef HAVE_CPLUS_DEMANGLE
+                EXTLIBS += -liberty
+                BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+        else
+                FLAGS_BFD=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd
+                has_bfd := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD))
+                ifeq ($(has_bfd),y)
+                        EXTLIBS += -lbfd
                 else
-                        FLAGS_BFD_IBERTY_Z=$(FLAGS_BFD_IBERTY) -lz
-                        has_bfd_iberty_z := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD_IBERTY_Z))
-                        ifeq ($(has_bfd_iberty_z),y)
-                                EXTLIBS += -lbfd -liberty -lz
+                        FLAGS_BFD_IBERTY=$(FLAGS_BFD) -liberty
+                        has_bfd_iberty := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD_IBERTY))
+                        ifeq ($(has_bfd_iberty),y)
+                                EXTLIBS += -lbfd -liberty
                         else
-                                FLAGS_CPLUS_DEMANGLE=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) -liberty
-                                has_cplus_demangle := $(call try-cc,$(SOURCE_CPLUS_DEMANGLE),$(FLAGS_CPLUS_DEMANGLE))
-                                ifeq ($(has_cplus_demangle),y)
-                                        EXTLIBS += -liberty
-                                        BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+                                FLAGS_BFD_IBERTY_Z=$(FLAGS_BFD_IBERTY) -lz
+                                has_bfd_iberty_z := $(call try-cc,$(SOURCE_BFD),$(FLAGS_BFD_IBERTY_Z))
+                                ifeq ($(has_bfd_iberty_z),y)
+                                        EXTLIBS += -lbfd -liberty -lz
                                 else
-                                        msg := $(warning No bfd.h/libbfd found, install binutils-dev[el]/zlib-static to gain symbol demangling)
-                                        BASIC_CFLAGS += -DNO_DEMANGLE
+                                        FLAGS_CPLUS_DEMANGLE=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) -liberty
+                                        has_cplus_demangle := $(call try-cc,$(SOURCE_CPLUS_DEMANGLE),$(FLAGS_CPLUS_DEMANGLE))
+                                        ifeq ($(has_cplus_demangle),y)
+                                                EXTLIBS += -liberty
+                                                BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+                                        else
+                                                msg := $(warning No bfd.h/libbfd found, install binutils-dev[el]/zlib-static to gain symbol demangling)
+                                                BASIC_CFLAGS += -DNO_DEMANGLE
+                                        endif
                                 endif
                         endif
                 endif
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 914c67095d96..09cf5465e10a 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -557,7 +557,7 @@ static int parse_perf_probe_point(char *arg, struct perf_probe_event *pev)
 /* Parse perf-probe event argument */
 static int parse_perf_probe_arg(char *str, struct perf_probe_arg *arg)
 {
-        char *tmp;
+        char *tmp, *goodname;
         struct perf_probe_arg_field **fieldp;
 
         pr_debug("parsing arg: %s into ", str);
@@ -580,7 +580,7 @@ static int parse_perf_probe_arg(char *str, struct perf_probe_arg *arg)
                 pr_debug("type:%s ", arg->type);
         }
 
-        tmp = strpbrk(str, "-.");
+        tmp = strpbrk(str, "-.[");
         if (!is_c_varname(str) || !tmp) {
                 /* A variable, register, symbol or special value */
                 arg->var = strdup(str);
@@ -590,10 +590,11 @@ static int parse_perf_probe_arg(char *str, struct perf_probe_arg *arg)
                 return 0;
         }
 
-        /* Structure fields */
+        /* Structure fields or array element */
         arg->var = strndup(str, tmp - str);
         if (arg->var == NULL)
                 return -ENOMEM;
+        goodname = arg->var;
         pr_debug("%s, ", arg->var);
         fieldp = &arg->field;
 
@@ -601,22 +602,38 @@ static int parse_perf_probe_arg(char *str, struct perf_probe_arg *arg)
                 *fieldp = zalloc(sizeof(struct perf_probe_arg_field));
                 if (*fieldp == NULL)
                         return -ENOMEM;
-                if (*tmp == '.') {
-                        str = tmp + 1;
-                        (*fieldp)->ref = false;
-                } else if (tmp[1] == '>') {
-                        str = tmp + 2;
+                if (*tmp == '[') {      /* Array */
+                        str = tmp;
+                        (*fieldp)->index = strtol(str + 1, &tmp, 0);
                         (*fieldp)->ref = true;
-                } else {
-                        semantic_error("Argument parse error: %s\n", str);
-                        return -EINVAL;
+                        if (*tmp != ']' || tmp == str + 1) {
+                                semantic_error("Array index must be a"
+                                                " number.\n");
+                                return -EINVAL;
+                        }
+                        tmp++;
+                        if (*tmp == '\0')
+                                tmp = NULL;
+                } else {                /* Structure */
+                        if (*tmp == '.') {
+                                str = tmp + 1;
+                                (*fieldp)->ref = false;
+                        } else if (tmp[1] == '>') {
+                                str = tmp + 2;
+                                (*fieldp)->ref = true;
+                        } else {
+                                semantic_error("Argument parse error: %s\n",
+                                               str);
+                                return -EINVAL;
+                        }
+                        tmp = strpbrk(str, "-.[");
                 }
-
-                tmp = strpbrk(str, "-.");
                 if (tmp) {
                         (*fieldp)->name = strndup(str, tmp - str);
                         if ((*fieldp)->name == NULL)
                                 return -ENOMEM;
+                        if (*str != '[')
+                                goodname = (*fieldp)->name;
                         pr_debug("%s(%d), ", (*fieldp)->name, (*fieldp)->ref);
                         fieldp = &(*fieldp)->next;
                 }
@@ -624,11 +641,13 @@ static int parse_perf_probe_arg(char *str, struct perf_probe_arg *arg)
         (*fieldp)->name = strdup(str);
         if ((*fieldp)->name == NULL)
                 return -ENOMEM;
+        if (*str != '[')
+                goodname = (*fieldp)->name;
         pr_debug("%s(%d)\n", (*fieldp)->name, (*fieldp)->ref);
 
-        /* If no name is specified, set the last field name */
+        /* If no name is specified, set the last field name (not array index)*/
         if (!arg->name) {
-                arg->name = strdup((*fieldp)->name);
+                arg->name = strdup(goodname);
                 if (arg->name == NULL)
                         return -ENOMEM;
         }
@@ -776,8 +795,11 @@ int synthesize_perf_probe_arg(struct perf_probe_arg *pa, char *buf, size_t len)
         len -= ret;
 
         while (field) {
-                ret = e_snprintf(tmp, len, "%s%s", field->ref ? "->" : ".",
-                                 field->name);
+                if (field->name[0] == '[')
+                        ret = e_snprintf(tmp, len, "%s", field->name);
+                else
+                        ret = e_snprintf(tmp, len, "%s%s",
+                                         field->ref ? "->" : ".", field->name);
                 if (ret <= 0)
                         goto error;
                 tmp += ret;
@@ -904,6 +926,7 @@ out:
 static int synthesize_kprobe_trace_arg(struct kprobe_trace_arg *arg,
                                        char *buf, size_t buflen)
 {
+        struct kprobe_trace_arg_ref *ref = arg->ref;
         int ret, depth = 0;
         char *tmp = buf;
 
@@ -917,16 +940,24 @@ static int synthesize_kprobe_trace_arg(struct kprobe_trace_arg *arg,
         buf += ret;
         buflen -= ret;
 
+        /* Special case: @XXX */
+        if (arg->value[0] == '@' && arg->ref)
+                        ref = ref->next;
+
         /* Dereferencing arguments */
-        if (arg->ref) {
-                depth = __synthesize_kprobe_trace_arg_ref(arg->ref, &buf,
+        if (ref) {
+                depth = __synthesize_kprobe_trace_arg_ref(ref, &buf,
                                                           &buflen, 1);
                 if (depth < 0)
                         return depth;
         }
 
         /* Print argument value */
-        ret = e_snprintf(buf, buflen, "%s", arg->value);
+        if (arg->value[0] == '@' && arg->ref)
+                ret = e_snprintf(buf, buflen, "%s%+ld", arg->value,
+                                 arg->ref->offset);
+        else
+                ret = e_snprintf(buf, buflen, "%s", arg->value);
         if (ret < 0)
                 return ret;
         buf += ret;
diff --git a/tools/perf/util/probe-event.h b/tools/perf/util/probe-event.h
index e9db1a214ca4..bc06d3e8bafa 100644
--- a/tools/perf/util/probe-event.h
+++ b/tools/perf/util/probe-event.h
@@ -50,6 +50,7 @@ struct perf_probe_point {
 struct perf_probe_arg_field {
         struct perf_probe_arg_field     *next;  /* Next field */
         char                            *name;  /* Name of the field */
+        long                            index;  /* Array index number */
         bool                            ref;    /* Referencing flag */
 };
 
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index baf665383498..3e64e1fa1051 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -406,14 +406,50 @@ static Dwarf_Die *die_find_member(Dwarf_Die *st_die, const char *name,
  * Probe finder related functions
  */
 
+static struct kprobe_trace_arg_ref *alloc_trace_arg_ref(long offs)
+{
+        struct kprobe_trace_arg_ref *ref;
+        ref = zalloc(sizeof(struct kprobe_trace_arg_ref));
+        if (ref != NULL)
+                ref->offset = offs;
+        return ref;
+}
+
 /* Show a location */
-static int convert_location(Dwarf_Op *op, struct probe_finder *pf)
+static int convert_variable_location(Dwarf_Die *vr_die, struct probe_finder *pf)
 {
+        Dwarf_Attribute attr;
+        Dwarf_Op *op;
+        size_t nops;
         unsigned int regn;
         Dwarf_Word offs = 0;
         bool ref = false;
         const char *regs;
         struct kprobe_trace_arg *tvar = pf->tvar;
+        int ret;
+
+        /* TODO: handle more than 1 exprs */
+        if (dwarf_attr(vr_die, DW_AT_location, &attr) == NULL ||
+            dwarf_getlocation_addr(&attr, pf->addr, &op, &nops, 1) <= 0 ||
+            nops == 0) {
+                /* TODO: Support const_value */
+                pr_err("Failed to find the location of %s at this address.\n"
+                       " Perhaps, it has been optimized out.\n", pf->pvar->var);
+                return -ENOENT;
+        }
+
+        if (op->atom == DW_OP_addr) {
+                /* Static variables on memory (not stack), make @varname */
+                ret = strlen(dwarf_diename(vr_die));
+                tvar->value = zalloc(ret + 2);
+                if (tvar->value == NULL)
+                        return -ENOMEM;
+                snprintf(tvar->value, ret + 2, "@%s", dwarf_diename(vr_die));
+                tvar->ref = alloc_trace_arg_ref((long)offs);
+                if (tvar->ref == NULL)
+                        return -ENOMEM;
+                return 0;
+        }
 
         /* If this is based on frame buffer, set the offset */
         if (op->atom == DW_OP_fbreg) {
@@ -455,27 +491,72 @@ static int convert_location(Dwarf_Op *op, struct probe_finder *pf)
                 return -ENOMEM;
 
         if (ref) {
-                tvar->ref = zalloc(sizeof(struct kprobe_trace_arg_ref));
+                tvar->ref = alloc_trace_arg_ref((long)offs);
                 if (tvar->ref == NULL)
                         return -ENOMEM;
-                tvar->ref->offset = (long)offs;
         }
         return 0;
 }
 
 static int convert_variable_type(Dwarf_Die *vr_die,
-                                 struct kprobe_trace_arg *targ)
+                                 struct kprobe_trace_arg *tvar,
+                                 const char *cast)
 {
+        struct kprobe_trace_arg_ref **ref_ptr = &tvar->ref;
         Dwarf_Die type;
         char buf[16];
         int ret;
 
+        /* TODO: check all types */
+        if (cast && strcmp(cast, "string") != 0) {
+                /* Non string type is OK */
+                tvar->type = strdup(cast);
+                return (tvar->type == NULL) ? -ENOMEM : 0;
+        }
+
         if (die_get_real_type(vr_die, &type) == NULL) {
                 pr_warning("Failed to get a type information of %s.\n",
                            dwarf_diename(vr_die));
                 return -ENOENT;
         }
 
+        pr_debug("%s type is %s.\n",
+                 dwarf_diename(vr_die), dwarf_diename(&type));
+
+        if (cast && strcmp(cast, "string") == 0) {      /* String type */
+                ret = dwarf_tag(&type);
+                if (ret != DW_TAG_pointer_type &&
+                    ret != DW_TAG_array_type) {
+                        pr_warning("Failed to cast into string: "
+                                   "%s(%s) is not a pointer nor array.",
+                                   dwarf_diename(vr_die), dwarf_diename(&type));
+                        return -EINVAL;
+                }
+                if (ret == DW_TAG_pointer_type) {
+                        if (die_get_real_type(&type, &type) == NULL) {
+                                pr_warning("Failed to get a type information.");
+                                return -ENOENT;
+                        }
+                        while (*ref_ptr)
+                                ref_ptr = &(*ref_ptr)->next;
+                        /* Add new reference with offset +0 */
+                        *ref_ptr = zalloc(sizeof(struct kprobe_trace_arg_ref));
+                        if (*ref_ptr == NULL) {
+                                pr_warning("Out of memory error\n");
+                                return -ENOMEM;
+                        }
+                }
+                if (die_compare_name(&type, "char") != 0 &&
+                    die_compare_name(&type, "unsigned char") != 0) {
+                        pr_warning("Failed to cast into string: "
+                                   "%s is not (unsigned) char *.",
+                                   dwarf_diename(vr_die));
+                        return -EINVAL;
+                }
+                tvar->type = strdup(cast);
+                return (tvar->type == NULL) ? -ENOMEM : 0;
+        }
+
         ret = die_get_byte_size(&type) * 8;
         if (ret) {
                 /* Check the bitwidth */
@@ -495,8 +576,8 @@ static int convert_variable_type(Dwarf_Die *vr_die,
                                    strerror(-ret));
                         return ret;
                 }
-                targ->type = strdup(buf);
-                if (targ->type == NULL)
+                tvar->type = strdup(buf);
+                if (tvar->type == NULL)
                         return -ENOMEM;
         }
         return 0;
@@ -510,16 +591,44 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
         struct kprobe_trace_arg_ref *ref = *ref_ptr;
         Dwarf_Die type;
         Dwarf_Word offs;
-        int ret;
+        int ret, tag;
 
         pr_debug("converting %s in %s\n", field->name, varname);
         if (die_get_real_type(vr_die, &type) == NULL) {
                 pr_warning("Failed to get the type of %s.\n", varname);
                 return -ENOENT;
         }
-
-        /* Check the pointer and dereference */
-        if (dwarf_tag(&type) == DW_TAG_pointer_type) {
+        pr_debug2("Var real type: (%x)\n", (unsigned)dwarf_dieoffset(&type));
+        tag = dwarf_tag(&type);
+
+        if (field->name[0] == '[' &&
+            (tag == DW_TAG_array_type || tag == DW_TAG_pointer_type)) {
+                if (field->next)
+                        /* Save original type for next field */
+                        memcpy(die_mem, &type, sizeof(*die_mem));
+                /* Get the type of this array */
+                if (die_get_real_type(&type, &type) == NULL) {
+                        pr_warning("Failed to get the type of %s.\n", varname);
+                        return -ENOENT;
+                }
+                pr_debug2("Array real type: (%x)\n",
+                         (unsigned)dwarf_dieoffset(&type));
+                if (tag == DW_TAG_pointer_type) {
+                        ref = zalloc(sizeof(struct kprobe_trace_arg_ref));
+                        if (ref == NULL)
+                                return -ENOMEM;
+                        if (*ref_ptr)
+                                (*ref_ptr)->next = ref;
+                        else
+                                *ref_ptr = ref;
+                }
+                ref->offset += die_get_byte_size(&type) * field->index;
+                if (!field->next)
+                        /* Save vr_die for converting types */
+                        memcpy(die_mem, vr_die, sizeof(*die_mem));
+                goto next;
+        } else if (tag == DW_TAG_pointer_type) {
+                /* Check the pointer and dereference */
                 if (!field->ref) {
                         pr_err("Semantic error: %s must be referred by '->'\n",
                                field->name);
@@ -545,10 +654,15 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
                         *ref_ptr = ref;
         } else {
                 /* Verify it is a data structure  */
-                if (dwarf_tag(&type) != DW_TAG_structure_type) {
+                if (tag != DW_TAG_structure_type) {
                         pr_warning("%s is not a data structure.\n", varname);
                         return -EINVAL;
                 }
+                if (field->name[0] == '[') {
+                        pr_err("Semantic error: %s is not a pointor nor array.",
+                               varname);
+                        return -EINVAL;
+                }
                 if (field->ref) {
                         pr_err("Semantic error: %s must be referred by '.'\n",
                                field->name);
@@ -575,6 +689,7 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
         }
         ref->offset += (long)offs;
 
+next:
         /* Converting next field */
         if (field->next)
                 return convert_variable_fields(die_mem, field->name,
@@ -586,51 +701,32 @@ static int convert_variable_fields(Dwarf_Die *vr_die, const char *varname,
 /* Show a variables in kprobe event format */
 static int convert_variable(Dwarf_Die *vr_die, struct probe_finder *pf)
 {
-        Dwarf_Attribute attr;
         Dwarf_Die die_mem;
-        Dwarf_Op *expr;
-        size_t nexpr;
         int ret;
 
-        if (dwarf_attr(vr_die, DW_AT_location, &attr) == NULL)
-                goto error;
-        /* TODO: handle more than 1 exprs */
-        ret = dwarf_getlocation_addr(&attr, pf->addr, &expr, &nexpr, 1);
-        if (ret <= 0 || nexpr == 0)
-                goto error;
+        pr_debug("Converting variable %s into trace event.\n",
+                 dwarf_diename(vr_die));
 
-        ret = convert_location(expr, pf);
+        ret = convert_variable_location(vr_die, pf);
         if (ret == 0 && pf->pvar->field) {
                 ret = convert_variable_fields(vr_die, pf->pvar->var,
                                               pf->pvar->field, &pf->tvar->ref,
                                               &die_mem);
                 vr_die = &die_mem;
         }
-        if (ret == 0) {
-                if (pf->pvar->type) {
-                        pf->tvar->type = strdup(pf->pvar->type);
-                        if (pf->tvar->type == NULL)
-                                ret = -ENOMEM;
-                } else
-                        ret = convert_variable_type(vr_die, pf->tvar);
-        }
+        if (ret == 0)
+                ret = convert_variable_type(vr_die, pf->tvar, pf->pvar->type);
         /* *expr will be cached in libdw. Don't free it. */
         return ret;
-error:
-        /* TODO: Support const_value */
-        pr_err("Failed to find the location of %s at this address.\n"
-               " Perhaps, it has been optimized out.\n", pf->pvar->var);
-        return -ENOENT;
 }
 
 /* Find a variable in a subprogram die */
 static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
 {
-        Dwarf_Die vr_die;
+        Dwarf_Die vr_die, *scopes;
         char buf[32], *ptr;
-        int ret;
+        int ret, nscopes;
 
-        /* TODO: Support arrays */
         if (pf->pvar->name)
                 pf->tvar->name = strdup(pf->pvar->name);
         else {
@@ -657,12 +753,26 @@ static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
         pr_debug("Searching '%s' variable in context.\n",
                  pf->pvar->var);
         /* Search child die for local variables and parameters. */
-        if (!die_find_variable(sp_die, pf->pvar->var, &vr_die)) {
+        if (die_find_variable(sp_die, pf->pvar->var, &vr_die))
+                ret = convert_variable(&vr_die, pf);
+        else {
+                /* Search upper class */
+                nscopes = dwarf_getscopes_die(sp_die, &scopes);
+                if (nscopes > 0) {
+                        ret = dwarf_getscopevar(scopes, nscopes, pf->pvar->var,
+                                                0, NULL, 0, 0, &vr_die);
+                        if (ret >= 0)
+                                ret = convert_variable(&vr_die, pf);
+                        else
+                                ret = -ENOENT;
+                        free(scopes);
+                } else
+                        ret = -ENOENT;
+        }
+        if (ret < 0)
                 pr_warning("Failed to find '%s' in this function.\n",
                            pf->pvar->var);
-                return -ENOENT;
-        }
-        return convert_variable(&vr_die, pf);
+        return ret;
 }
 
 /* Show a probe point to output buffer */