Re: [PATCH v6 3/4] docs: tracing/fprobe: Document list filters and :entry/:exit

Masami Hiramatsu
2026-03-24T04:07:57Z

On Thu, 5 Feb 2026 08:58:41 -0500
"Seokwoo Chung (Ryan)" <seokwoo.chung130@gmail.com> wrote:

> Update fprobe event documentation to describe comma-separated symbol lists,
> exclusions, and explicit suffixes.
>
> Signed-off-by: Seokwoo Chung (Ryan) <seokwoo.chung130@gmail.com>
> ---
> Documentation/trace/fprobetrace.rst | 17 ++++++++++++++---
> 1 file changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/trace/fprobetrace.rst b/Documentation/trace/fprobetrace.rst
> index b4c2ca3d02c1..bbcfd57f0005 100644
> --- a/Documentation/trace/fprobetrace.rst
> +++ b/Documentation/trace/fprobetrace.rst
> @@ -25,14 +25,18 @@ Synopsis of fprobe-events
> -------------------------
> ::
>
> - f[:[GRP1/][EVENT1]] SYM [FETCHARGS] : Probe on function entry
> - f[MAXACTIVE][:[GRP1/][EVENT1]] SYM%return [FETCHARGS] : Probe on function exit
> + f[:[GRP1/][EVENT1]] SYM[%return] [FETCHARGS] : Single function

We also accept wildcard pattern instead of SYM.

f[:[GRP1/][EVENT1]] (SYM|PATTERN)[%return] [FETCHARGS] : Single target

> + f[:[GRP1/][EVENT1]] SYM[,[!]SYM[,...]][:entry|:exit] [FETCHARGS] :Multiple

Hmm if this is for multiple function, we can not omit event name, so

f:[GRP1/]EVNET1 SYM[,[!]SYM[,...]][:entry|:exit] [FETCHARGS] : Multiple function

> + function

Also, if you put this in the next line, please indent it.

> t[:[GRP2/][EVENT2]] TRACEPOINT [FETCHARGS] : Probe on tracepoint
>
> GRP1 : Group name for fprobe. If omitted, use "fprobes" for it.
> GRP2 : Group name for tprobe. If omitted, use "tracepoints" for it.
> EVENT1 : Event name for fprobe. If omitted, the event name is
> - "SYM__entry" or "SYM__exit".
> + - For a single literal symbol, the event name is
> + "SYM__entry" or "SYM__exit".
> + - For a *list or any wildcard*, an explicit [GRP1/][EVENT1] is

an explicit EVENT1 is required. (group name can be omitted)

> + required; otherwise the parser rejects it.
> EVENT2 : Event name for tprobe. If omitted, the event name is
> the same as "TRACEPOINT", but if the "TRACEPOINT" starts
> with a digit character, "_TRACEPOINT" is used.
> @@ -40,6 +44,13 @@ Synopsis of fprobe-events
> can be probed simultaneously, or 0 for the default value
> as defined in Documentation/trace/fprobe.rst
>
> + SYM : Function name or comma-separated list of symbols.

Doesn't SYM still be a function name? In above synopsis, SYM is an entry of
comma-separated list.

> + - SYM prefixed with "!" are exclusions.
> + - ":entry" suffix means it probes entry of given symbols
> + (default)
> + - ":exit" suffix means it probes exit of given symbols.
> + - "%return" suffix means it probes exit of SYM (single
> + symbol).

And we need PATTERN here.

PATTERN : Function name pattern with wildcards (You can use "*" or "?").

Thank you,

> FETCHARGS : Arguments. Each probe can have up to 128 args.
> ARG : Fetch "ARG" function argument using BTF (only for function
> entry or tracepoint.) (\*1)
> --
> 2.43.0