[PATCH v6 3/4] docs: tracing/fprobe: Document list filters and :entry/:exit

Seokwoo Chung (Ryan)
2026-02-05T13:59:05Z

Update fprobe event documentation to describe comma-separated symbol lists,
exclusions, and explicit suffixes.

Signed-off-by: Seokwoo Chung (Ryan) <seokwoo.chung130@gmail.com>
---
Documentation/trace/fprobetrace.rst | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/Documentation/trace/fprobetrace.rst b/Documentation/trace/fprobetrace.rst
index b4c2ca3d02c1..bbcfd57f0005 100644
--- a/Documentation/trace/fprobetrace.rst
+++ b/Documentation/trace/fprobetrace.rst
@@ -25,14 +25,18 @@ Synopsis of fprobe-events
-------------------------
::

- f[:[GRP1/][EVENT1]] SYM [FETCHARGS] : Probe on function entry
- f[MAXACTIVE][:[GRP1/][EVENT1]] SYM%return [FETCHARGS] : Probe on function exit
+ f[:[GRP1/][EVENT1]] SYM[%return] [FETCHARGS] : Single function
+ f[:[GRP1/][EVENT1]] SYM[,[!]SYM[,...]][:entry|:exit] [FETCHARGS] :Multiple
+ function
t[:[GRP2/][EVENT2]] TRACEPOINT [FETCHARGS] : Probe on tracepoint

GRP1 : Group name for fprobe. If omitted, use "fprobes" for it.
GRP2 : Group name for tprobe. If omitted, use "tracepoints" for it.
EVENT1 : Event name for fprobe. If omitted, the event name is
- "SYM__entry" or "SYM__exit".
+ - For a single literal symbol, the event name is
+ "SYM__entry" or "SYM__exit".
+ - For a *list or any wildcard*, an explicit [GRP1/][EVENT1] is
+ required; otherwise the parser rejects it.
EVENT2 : Event name for tprobe. If omitted, the event name is
the same as "TRACEPOINT", but if the "TRACEPOINT" starts
with a digit character, "_TRACEPOINT" is used.
@@ -40,6 +44,13 @@ Synopsis of fprobe-events
can be probed simultaneously, or 0 for the default value
as defined in Documentation/trace/fprobe.rst

+ SYM : Function name or comma-separated list of symbols.
+ - SYM prefixed with "!" are exclusions.
+ - ":entry" suffix means it probes entry of given symbols
+ (default)
+ - ":exit" suffix means it probes exit of given symbols.
+ - "%return" suffix means it probes exit of SYM (single
+ symbol).
FETCHARGS : Arguments. Each probe can have up to 128 args.
ARG : Fetch "ARG" function argument using BTF (only for function
entry or tracepoint.) (\*1)
--
2.43.0