Re: [PATCH v12 04/11] tracing/wprobe: Add wprobe (watchpoint probe) trace event support

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Mon, 17 Aug 2026 19:51:22 +0800
Jinchao Wang <wangjinchao600@gmail.com> wrote:

[...]
> > +Synopsis of wprobe-events
> > +-------------------------
> > +::
> > +
> > +  w:[GRP/][EVENT] SPEC [FETCHARGS]                       : Probe on data access
> > +
> > + GRP            : Group name for wprobe. If omitted, use "wprobes" for it.
> > + EVENT          : Event name for wprobe. If omitted, an event name is
> > +                  generated based on the address or symbol.
> > + SPEC           : Breakpoint specification.
> > +                  [r|w|rw]@<ADDRESS|SYMBOL[[+|-]OFFS]>[:LENGTH]
> > +
> > +   r|w|rw       : Access type, r for read, w for write, and rw for both.
> > +                  Default is rw if omitted.
> > +   ADDRESS      : Address to trace (hexadecimal). MUST be in kernel space.
> > +   SYMBOL       : Symbol name to trace.
> > +   LENGTH       : Length of the data to trace in bytes. (1, 2, 4, or 8)
> 
> Should it show default value 4?

Ah, good catch!

> > +
> > +  FETCHARGS      : Arguments. Each probe can have up to 128 args.
> > +   $addr         : Fetch the accessing address.
> > +   $value        : Fetch the memory value at the accessing address (same as +0($addr)).
> > +   @ADDR         : Fetch memory at ADDR (ADDR should be in kernel)
> > +  @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol)
> > +  +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*1)(\*2)
> > +  \IMM          : Store an immediate value to the argument.
> > +  NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
> > +  FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
> > +                  (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types
> > +                  (x8/x16/x32/x64), "char", "string", "ustring", "symbol", "symstr"
> > +                  and bitfield are supported.
> 
> FETCHARGS block is not aligned.

OK.

> 
> > +
> > +  (\*1) this is useful for fetching a field of data structures.
> > +  (\*2) "u" means user-space dereference.
> > +
> > +For the details of TYPE, see :ref:`kprobetrace documentation <kprobetrace_types>`.
> > +
> > +Usage examples
> > +--------------
> > +Here is an example to add a wprobe event on a variable `jiffies`.
> > +::
> > +
> > +  # echo 'w:my_jiffies w@jiffies' >> dynamic_events
> > +  # cat dynamic_events
> > +  w:wprobes/my_jiffies w@jiffies
> > +  # echo 1 > events/wprobes/enable
> > +  # cat trace | head
> > +  #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
> > +  #              | |         |   |||||     |         |
> > +           <idle>-0       [000] d.Z1.  717.026259: my_jiffies: (tick_do_update_jiffies64+0xbe/0x130)
> > +           <idle>-0       [000] d.Z1.  717.026373: my_jiffies: (tick_do_update_jiffies64+0xbe/0x130)
> > +
> > +You can see the code which writes to `jiffies` is `tick_do_update_jiffies64()`.
> > diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
> > index 5cbd09c8be8d..43ffd9a76d88 100644
> > --- a/include/linux/trace_events.h
> > +++ b/include/linux/trace_events.h
> > @@ -337,6 +337,7 @@ enum {
> >  	TRACE_EVENT_FL_UPROBE_BIT,
> >  	TRACE_EVENT_FL_EPROBE_BIT,
> >  	TRACE_EVENT_FL_FPROBE_BIT,
> > +	TRACE_EVENT_FL_WPROBE_BIT,
> >  	TRACE_EVENT_FL_CUSTOM_BIT,
> >  	TRACE_EVENT_FL_TEST_STR_BIT,
> >  };
> > @@ -367,6 +368,7 @@ enum {
> >  	TRACE_EVENT_FL_UPROBE		= (1 << TRACE_EVENT_FL_UPROBE_BIT),
> >  	TRACE_EVENT_FL_EPROBE		= (1 << TRACE_EVENT_FL_EPROBE_BIT),
> >  	TRACE_EVENT_FL_FPROBE		= (1 << TRACE_EVENT_FL_FPROBE_BIT),
> > +	TRACE_EVENT_FL_WPROBE		= (1 << TRACE_EVENT_FL_WPROBE_BIT),
> >  	TRACE_EVENT_FL_CUSTOM		= (1 << TRACE_EVENT_FL_CUSTOM_BIT),
> >  	TRACE_EVENT_FL_TEST_STR		= (1 << TRACE_EVENT_FL_TEST_STR_BIT),
> >  };
> > diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> > index 0ab5916575a9..b58c2565024f 100644
> > --- a/kernel/trace/Kconfig
> > +++ b/kernel/trace/Kconfig
> > @@ -862,6 +862,19 @@ config EPROBE_EVENTS
> >  	  convert the type of an event field. For example, turn an
> >  	  address into a string.
> >  
> > +config WPROBE_EVENTS
> > +	bool "Enable wprobe-based dynamic events"
> > +	depends on TRACING
> > +	depends on HAVE_HW_BREAKPOINT
> > +	select PROBE_EVENTS
> > +	select DYNAMIC_EVENTS
> > +	help
> > +	  This allows the user to add watchpoint tracing events based on
> > +	  hardware breakpoints on the fly via the ftrace interface.
> > +
> > +	  Those events can be inserted wherever hardware breakpoints can be
> > +	  set, and record accessed memory address and values.
> > +
> >  config BPF_EVENTS
> >  	depends on BPF_SYSCALL
> >  	depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS
> > diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
> > index f934ff586bd4..141c8323de20 100644
> > --- a/kernel/trace/Makefile
> > +++ b/kernel/trace/Makefile
> > @@ -126,6 +126,7 @@ obj-$(CONFIG_FTRACE_RECORD_RECURSION) += trace_recursion_record.o
> >  obj-$(CONFIG_FPROBE) += fprobe.o
> >  obj-$(CONFIG_RETHOOK) += rethook.o
> >  obj-$(CONFIG_FPROBE_EVENTS) += trace_fprobe.o
> > +obj-$(CONFIG_WPROBE_EVENTS) += trace_wprobe.o
> >  
> >  obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
> >  obj-$(CONFIG_RV) += rv/
> > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> > index 19cc07360005..4ebece96d8b7 100644
> > --- a/kernel/trace/trace.c
> > +++ b/kernel/trace/trace.c
> > @@ -4294,8 +4294,12 @@ static const char readme_msg[] =
> >  	"  uprobe_events\t\t- Create/append/remove/show the userspace dynamic events\n"
> >  	"\t\t\t  Write into this file to define/undefine new trace events.\n"
> >  #endif
> > +#ifdef CONFIG_WPROBE_EVENTS
> > +	"  wprobe_events\t\t- Create/append/remove/show the hardware breakpoint dynamic events\n"
> > +	"\t\t\t  Write into this file to define/undefine new trace events.\n"
> > +#endif
> >  #if defined(CONFIG_KPROBE_EVENTS) || defined(CONFIG_UPROBE_EVENTS) || \
> > -    defined(CONFIG_FPROBE_EVENTS)
> > +    defined(CONFIG_FPROBE_EVENTS) || defined(CONFIG_WPROBE_EVENTS)
> >  	"\t  accepts: event-definitions (one definition per line)\n"
> >  #if defined(CONFIG_KPROBE_EVENTS) || defined(CONFIG_UPROBE_EVENTS)
> >  	"\t   Format: p[:[<group>/][<event>]] <place> [<args>]\n"
> > @@ -4305,6 +4309,9 @@ static const char readme_msg[] =
> >  	"\t           f[:[<group>/][<event>]] <func-name>[%return] [<args>]\n"
> >  	"\t           t[:[<group>/][<event>]] <tracepoint> [<args>]\n"
> >  #endif
> > +#ifdef CONFIG_WPROBE_EVENTS
> > +	"\t           w[:[<group>/][<event>]] [r|w|rw]@<addr>[:<len>]\n"
> 
> missing [<args>]

Oops, let me fix it.

Thanks!

> 
> > +#endif
> >  #ifdef CONFIG_HIST_TRIGGERS
> >  	"\t           s:[synthetic/]<event> <field> [<field>]\n"
> >  #endif
> 
> Thanks,
> Jinchao
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>