How to understand "$location" in a Systemtap script?

Question

The Systemtap script:

# Array to hold the list of drop points we find
global locations

# Note when we turn the monitor on and off
probe begin { printf("Monitoring for dropped packets\n") }
probe end { printf("Stopping dropped packet monitor\n") }

# increment a drop counter for every location we drop at
#probe kernel.trace("kfree_skb") { locations[$location] <<< 1 }

# Every 5 seconds report our drop locations
probe timer.sec(5)
{
        printf("\n")
        foreach (l in locations-) {
                printf("%d packets dropped at location %p\n",
                           @count(locations[l]), l)
        }
        delete locations
}

and the source code of kfree_skb() is:

void kfree_skb(struct sk_buff *skb)
{
    if (unlikely(!skb))
        return;
    if (likely(atomic_read(&skb->users) == 1))
        smp_rmb();
    else if (likely(!atomic_dec_and_test(&skb->users)))
        return;
    trace_kfree_skb(skb, __builtin_return_address(0));
    __kfree_skb(skb);
}

I just want to know where is the $location from? And
what is the relationship between $location and kfree_skb()?
Thank you.

Answer 1

As per the stap.1 man page:

   Many types of probe points provide context variables, which are
   run-time values, safely extracted from the kernel or userspace
   program being probed.  These are pre‐ fixed with the $
   character.  The CONTEXT VARIABLES section in stapprobes(3stap)
   lists what is available for each type of probe point.

As per the stapprobes.3stap man page:

KERNEL TRACEPOINTS

   This family of probe points hooks up to static probing
   tracepoints inserted into the kernel or modules.  [...]

   Tracepoint probes look like: kernel.trace("name").  The
   tracepoint name string, which may contain the usual wildcard
   characters, is matched against the names defined by the kernel
   developers in the tracepoint header files.

   The handler associated with a tracepoint-based probe may read
   the optional parame‐ ters specified at the macro call site.
   [...] For example, the tracepoint probe kernel.trace("sched_switch")
   provides the parameters $rq, $prev, and $next.  [...]

   The name of the tracepoint is available in $$name, and a string
   of name=value pairs for all parameters of the tracepoint is
   available in $$vars or $$parms.

As per the linux kernel source code:

% cd net/core
% git grep trace_kfree_skb

dev.c: [...]
drop_monitor.c: [...]
skbuff.c: [...]

% cd ../../include/trace/events
% git grep -A5 'TRACE_EVENT.*kfree_skb'

skb.h:TRACE_EVENT(kfree_skb,
skb.h-
skb.h-  TP_PROTO(struct sk_buff *skb, void *location),
skb.h-
skb.h-  TP_ARGS(skb, location),
skb.h-