* [PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes
@ 2025-07-29 16:18 Steven Rostedt
2025-07-29 16:18 ` [PATCH v2 1/2] tracing: Have eprobes have their own config option Steven Rostedt
2025-07-29 16:18 ` [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes Steven Rostedt
0 siblings, 2 replies; 13+ messages in thread
From: Steven Rostedt @ 2025-07-29 16:18 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel, linux-doc
Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton,
Namhyung Kim, Jonathan Corbet, Randy Dunlap
Add missing eprobe config option and documentation which should have both been
added back in 5.15.
Steven Rostedt (2):
tracing: Have eprobes have their own config option
Documentation: tracing: Add documentation about eprobes
----
Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++++++++++
Documentation/trace/index.rst | 1 +
kernel/trace/Kconfig | 13 ++
kernel/trace/Makefile | 2 +-
4 files changed, 284 insertions(+), 1 deletion(-)
create mode 100644 Documentation/trace/eprobetrace.rst
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-29 16:18 [PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes Steven Rostedt @ 2025-07-29 16:18 ` Steven Rostedt 2025-07-30 3:07 ` Masami Hiramatsu 2025-07-30 6:27 ` kernel test robot 2025-07-29 16:18 ` [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes Steven Rostedt 1 sibling, 2 replies; 13+ messages in thread From: Steven Rostedt @ 2025-07-29 16:18 UTC (permalink / raw) To: linux-kernel, linux-trace-kernel, linux-doc Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Namhyung Kim, Jonathan Corbet, Randy Dunlap From: Steven Rostedt <rostedt@goodmis.org> Eprobes were added in 5.15 and were selected whenever any of the other probe events were selected. If kprobe events were enabled (which it is by default if kprobes are enabled) it would enable eprobe events as well. The same for uprobes and fprobes. Have eprobes have its own config and it gets enabled by default if tracing is enabled. Link: https://lore.kernel.org/all/20250729102636.b7cce553e7cc263722b12365@kernel.org/ Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> --- kernel/trace/Kconfig | 13 +++++++++++++ kernel/trace/Makefile | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig index 93e8e7fc11c0..b951c027fffb 100644 --- a/kernel/trace/Kconfig +++ b/kernel/trace/Kconfig @@ -792,6 +792,19 @@ config UPROBE_EVENTS This option is required if you plan to use perf-probe subcommand of perf tools on user space applications. +config EPROBE_EVENTS + bool "Enable event-based dynamic events" + depends on TRACING + select PROBE_EVENTS + select DYNAMIC_EVENTS + default y + help + Eprobes are dynamic events that can be placed on other existing + events. It can be used to limit what fields are recorded in + an event or even dereference a field of an event. It can + convert the type of an event field. For example, turn an + address into a string. + config BPF_EVENTS depends on BPF_SYSCALL depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile index 057cd975d014..dcb4e02afc5f 100644 --- a/kernel/trace/Makefile +++ b/kernel/trace/Makefile @@ -82,7 +82,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o endif obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o -obj-$(CONFIG_PROBE_EVENTS) += trace_eprobe.o +obj-$(CONFIG_EPROBE_EVENTS) += trace_eprobe.o obj-$(CONFIG_TRACE_EVENT_INJECT) += trace_events_inject.o obj-$(CONFIG_SYNTH_EVENTS) += trace_events_synth.o obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o -- 2.47.2 ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-29 16:18 ` [PATCH v2 1/2] tracing: Have eprobes have their own config option Steven Rostedt @ 2025-07-30 3:07 ` Masami Hiramatsu 2025-07-30 6:27 ` kernel test robot 1 sibling, 0 replies; 13+ messages in thread From: Masami Hiramatsu @ 2025-07-30 3:07 UTC (permalink / raw) To: Steven Rostedt Cc: linux-kernel, linux-trace-kernel, linux-doc, Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Tue, 29 Jul 2025 12:18:17 -0400 Steven Rostedt <rostedt@kernel.org> wrote: > From: Steven Rostedt <rostedt@goodmis.org> > > Eprobes were added in 5.15 and were selected whenever any of the other > probe events were selected. If kprobe events were enabled (which it is by > default if kprobes are enabled) it would enable eprobe events as well. The > same for uprobes and fprobes. > > Have eprobes have its own config and it gets enabled by default if tracing > is enabled. > > Link: https://lore.kernel.org/all/20250729102636.b7cce553e7cc263722b12365@kernel.org/ > Looks good to me. Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> BTW, is it a bugfix or improvement? Thanks, > Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> > --- > kernel/trace/Kconfig | 13 +++++++++++++ > kernel/trace/Makefile | 2 +- > 2 files changed, 14 insertions(+), 1 deletion(-) > > diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig > index 93e8e7fc11c0..b951c027fffb 100644 > --- a/kernel/trace/Kconfig > +++ b/kernel/trace/Kconfig > @@ -792,6 +792,19 @@ config UPROBE_EVENTS > This option is required if you plan to use perf-probe subcommand > of perf tools on user space applications. > > +config EPROBE_EVENTS > + bool "Enable event-based dynamic events" > + depends on TRACING > + select PROBE_EVENTS > + select DYNAMIC_EVENTS > + default y > + help > + Eprobes are dynamic events that can be placed on other existing > + events. It can be used to limit what fields are recorded in > + an event or even dereference a field of an event. It can > + convert the type of an event field. For example, turn an > + address into a string. > + > config BPF_EVENTS > depends on BPF_SYSCALL > depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS > diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile > index 057cd975d014..dcb4e02afc5f 100644 > --- a/kernel/trace/Makefile > +++ b/kernel/trace/Makefile > @@ -82,7 +82,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o > endif > obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o > obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o > -obj-$(CONFIG_PROBE_EVENTS) += trace_eprobe.o > +obj-$(CONFIG_EPROBE_EVENTS) += trace_eprobe.o > obj-$(CONFIG_TRACE_EVENT_INJECT) += trace_events_inject.o > obj-$(CONFIG_SYNTH_EVENTS) += trace_events_synth.o > obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o > -- > 2.47.2 > > -- Masami Hiramatsu (Google) <mhiramat@kernel.org> ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-29 16:18 ` [PATCH v2 1/2] tracing: Have eprobes have their own config option Steven Rostedt 2025-07-30 3:07 ` Masami Hiramatsu @ 2025-07-30 6:27 ` kernel test robot 2025-07-30 10:11 ` Masami Hiramatsu 1 sibling, 1 reply; 13+ messages in thread From: kernel test robot @ 2025-07-30 6:27 UTC (permalink / raw) To: Steven Rostedt, linux-kernel, linux-trace-kernel, linux-doc Cc: oe-kbuild-all, Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap Hi Steven, kernel test robot noticed the following build errors: [auto build test ERROR on trace/for-next] [also build test ERROR on lwn/docs-next akpm-mm/mm-everything linus/master v6.16 next-20250729] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Steven-Rostedt/tracing-Have-eprobes-have-their-own-config-option/20250730-001958 base: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace for-next patch link: https://lore.kernel.org/r/20250729161912.056641407%40kernel.org patch subject: [PATCH v2 1/2] tracing: Have eprobes have their own config option config: xtensa-randconfig-002-20250730 (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/config) compiler: xtensa-linux-gcc (GCC) 12.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507301452.JPAcMvT0-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/trace/trace_probe.c: In function 'parse_probe_arg': >> kernel/trace/trace_probe.c:1105:23: error: implicit declaration of function 'regs_query_register_offset'; did you mean 'ftrace_regs_query_register_offset'? [-Werror=implicit-function-declaration] 1105 | ret = regs_query_register_offset(arg + 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ | ftrace_regs_query_register_offset cc1: some warnings being treated as errors vim +1105 kernel/trace/trace_probe.c a42e3c4de9642d Masami Hiramatsu 2019-06-20 1080 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1081 /* Recursive argument parser */ 533059281ee594 Masami Hiramatsu 2018-04-25 1082 static int 533059281ee594 Masami Hiramatsu 2018-04-25 1083 parse_probe_arg(char *arg, const struct fetch_type *type, 533059281ee594 Masami Hiramatsu 2018-04-25 1084 struct fetch_insn **pcode, struct fetch_insn *end, 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1085) struct traceprobe_parse_context *ctx) 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1086 { 533059281ee594 Masami Hiramatsu 2018-04-25 1087 struct fetch_insn *code = *pcode; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1088 unsigned long param; e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1089 int deref = FETCH_OP_DEREF; bf173ca92da978 Steven Rostedt (VMware 2018-10-12 1090) long offset = 0; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1091 char *tmp; 34fee3a104cea1 Namhyung Kim 2013-11-26 1092 int ret = 0; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1093 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1094 switch (arg[0]) { 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1095 case '$': d157d7694460b9 Masami Hiramatsu (Google 2023-08-23 1096) ret = parse_probe_vars(arg, type, pcode, end, ctx); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1097 break; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1098 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1099 case '%': /* named register */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1100) if (ctx->flags & (TPARG_FL_TEVENT | TPARG_FL_FPROBE)) { 334e5519c37570 Masami Hiramatsu (Google 2023-06-06 1101) /* eprobe and fprobe do not handle registers */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1102) trace_probe_log_err(ctx->offset, BAD_VAR); 2673c60ee67e71 Steven Rostedt (Google 2022-08-20 1103) break; 2673c60ee67e71 Steven Rostedt (Google 2022-08-20 1104) } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 @1105 ret = regs_query_register_offset(arg + 1); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1106 if (ret >= 0) { 533059281ee594 Masami Hiramatsu 2018-04-25 1107 code->op = FETCH_OP_REG; 533059281ee594 Masami Hiramatsu 2018-04-25 1108 code->param = (unsigned int)ret; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1109 ret = 0; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1110 } else 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1111) trace_probe_log_err(ctx->offset, BAD_REG_NAME); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1112 break; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1113 b7e0bf341f6cfa Namhyung Kim 2013-11-25 1114 case '@': /* memory, file-offset or symbol */ 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1115 if (isdigit(arg[1])) { bcd83ea6cbfee5 Daniel Walter 2012-09-26 1116 ret = kstrtoul(arg + 1, 0, ¶m); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1117 if (ret) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1118) trace_probe_log_err(ctx->offset, BAD_MEM_ADDR); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1119 break; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1120 } 533059281ee594 Masami Hiramatsu 2018-04-25 1121 /* load address */ 533059281ee594 Masami Hiramatsu 2018-04-25 1122 code->op = FETCH_OP_IMM; 533059281ee594 Masami Hiramatsu 2018-04-25 1123 code->immediate = param; b7e0bf341f6cfa Namhyung Kim 2013-11-25 1124 } else if (arg[1] == '+') { b7e0bf341f6cfa Namhyung Kim 2013-11-25 1125 /* kprobes don't support file offsets */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1126) if (ctx->flags & TPARG_FL_KERNEL) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1127) trace_probe_log_err(ctx->offset, FILE_ON_KPROBE); b7e0bf341f6cfa Namhyung Kim 2013-11-25 1128 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1129 } b7e0bf341f6cfa Namhyung Kim 2013-11-25 1130 ret = kstrtol(arg + 2, 0, &offset); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1131 if (ret) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1132) trace_probe_log_err(ctx->offset, BAD_FILE_OFFS); b7e0bf341f6cfa Namhyung Kim 2013-11-25 1133 break; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1134 } b7e0bf341f6cfa Namhyung Kim 2013-11-25 1135 533059281ee594 Masami Hiramatsu 2018-04-25 1136 code->op = FETCH_OP_FOFFS; 533059281ee594 Masami Hiramatsu 2018-04-25 1137 code->immediate = (unsigned long)offset; // imm64? 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1138 } else { b079d374fd8463 Namhyung Kim 2013-07-03 1139 /* uprobes don't support symbols */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1140) if (!(ctx->flags & TPARG_FL_KERNEL)) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1141) trace_probe_log_err(ctx->offset, SYM_ON_UPROBE); b079d374fd8463 Namhyung Kim 2013-07-03 1142 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1143 } a6682814f37124 Masami Hiramatsu 2018-08-29 1144 /* Preserve symbol for updating */ a6682814f37124 Masami Hiramatsu 2018-08-29 1145 code->op = FETCH_NOP_SYMBOL; a6682814f37124 Masami Hiramatsu 2018-08-29 1146 code->data = kstrdup(arg + 1, GFP_KERNEL); a6682814f37124 Masami Hiramatsu 2018-08-29 1147 if (!code->data) a6682814f37124 Masami Hiramatsu 2018-08-29 1148 return -ENOMEM; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1149 if (++code == end) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1150) trace_probe_log_err(ctx->offset, TOO_MANY_OPS); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1151 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1152 } 533059281ee594 Masami Hiramatsu 2018-04-25 1153 code->op = FETCH_OP_IMM; a6682814f37124 Masami Hiramatsu 2018-08-29 1154 code->immediate = 0; 533059281ee594 Masami Hiramatsu 2018-04-25 1155 } 533059281ee594 Masami Hiramatsu 2018-04-25 1156 /* These are fetching from memory */ ab105a4fb89496 Masami Hiramatsu 2019-03-31 1157 if (++code == end) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1158) trace_probe_log_err(ctx->offset, TOO_MANY_OPS); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1159 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1160 } 533059281ee594 Masami Hiramatsu 2018-04-25 1161 *pcode = code; 533059281ee594 Masami Hiramatsu 2018-04-25 1162 code->op = FETCH_OP_DEREF; 533059281ee594 Masami Hiramatsu 2018-04-25 1163 code->offset = offset; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1164 break; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1165 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1166 case '+': /* deref memory */ 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1167 case '-': e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1168 if (arg[1] == 'u') { e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1169 deref = FETCH_OP_UDEREF; e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1170 arg[1] = arg[0]; e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1171 arg++; e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1172 } e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1173 if (arg[0] == '+') e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1174 arg++; /* Skip '+', because kstrtol() rejects it. */ 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1175 tmp = strchr(arg, '('); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1176 if (!tmp) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1177) trace_probe_log_err(ctx->offset, DEREF_NEED_BRACE); 533059281ee594 Masami Hiramatsu 2018-04-25 1178 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1179 } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1180 *tmp = '\0'; bcd83ea6cbfee5 Daniel Walter 2012-09-26 1181 ret = kstrtol(arg, 0, &offset); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1182 if (ret) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1183) trace_probe_log_err(ctx->offset, BAD_DEREF_OFFS); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1184 break; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1185 } 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1186) ctx->offset += (tmp + 1 - arg) + (arg[0] != '-' ? 1 : 0); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1187 arg = tmp + 1; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1188 tmp = strrchr(arg, ')'); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1189 if (!tmp) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1190) trace_probe_log_err(ctx->offset + strlen(arg), ab105a4fb89496 Masami Hiramatsu 2019-03-31 1191 DEREF_OPEN_BRACE); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1192 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1193 } else { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1194) const struct fetch_type *t2 = find_fetch_type(NULL, ctx->flags); 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1195) int cur_offs = ctx->offset; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1196 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1197 *tmp = '\0'; 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1198) ret = parse_probe_arg(arg, t2, &code, end, ctx); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1199 if (ret) 533059281ee594 Masami Hiramatsu 2018-04-25 1200 break; 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1201) ctx->offset = cur_offs; a42e3c4de9642d Masami Hiramatsu 2019-06-20 1202 if (code->op == FETCH_OP_COMM || a42e3c4de9642d Masami Hiramatsu 2019-06-20 1203 code->op == FETCH_OP_DATA) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1204) trace_probe_log_err(ctx->offset, COMM_CANT_DEREF); 533059281ee594 Masami Hiramatsu 2018-04-25 1205 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1206 } ab105a4fb89496 Masami Hiramatsu 2019-03-31 1207 if (++code == end) { 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1208) trace_probe_log_err(ctx->offset, TOO_MANY_OPS); ab105a4fb89496 Masami Hiramatsu 2019-03-31 1209 return -EINVAL; ab105a4fb89496 Masami Hiramatsu 2019-03-31 1210 } 533059281ee594 Masami Hiramatsu 2018-04-25 1211 *pcode = code; 533059281ee594 Masami Hiramatsu 2018-04-25 1212 e65f7ae7f4da56 Masami Hiramatsu 2019-05-15 1213 code->op = deref; 533059281ee594 Masami Hiramatsu 2018-04-25 1214 code->offset = offset; c440adfbe30257 Masami Hiramatsu (Google 2023-08-23 1215) /* Reset the last type if used */ c440adfbe30257 Masami Hiramatsu (Google 2023-08-23 1216) ctx->last_type = NULL; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1217 } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1218 break; 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1219 case '\\': /* Immediate value */ a42e3c4de9642d Masami Hiramatsu 2019-06-20 1220 if (arg[1] == '"') { /* Immediate string */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1221) ret = __parse_imm_string(arg + 2, &tmp, ctx->offset + 2); a42e3c4de9642d Masami Hiramatsu 2019-06-20 1222 if (ret) a42e3c4de9642d Masami Hiramatsu 2019-06-20 1223 break; a42e3c4de9642d Masami Hiramatsu 2019-06-20 1224 code->op = FETCH_OP_DATA; a42e3c4de9642d Masami Hiramatsu 2019-06-20 1225 code->data = tmp; a42e3c4de9642d Masami Hiramatsu 2019-06-20 1226 } else { 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1227 ret = str_to_immediate(arg + 1, &code->immediate); 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1228 if (ret) 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1229) trace_probe_log_err(ctx->offset + 1, BAD_IMM); 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1230 else 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1231 code->op = FETCH_OP_IMM; a42e3c4de9642d Masami Hiramatsu 2019-06-20 1232 } 6218bf9f4d2942 Masami Hiramatsu 2019-06-20 1233 break; b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1234) default: b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1235) if (isalpha(arg[0]) || arg[0] == '_') { /* BTF variable */ 25f00e40ce7953 Masami Hiramatsu (Google 2024-03-04 1236) if (!tparg_is_function_entry(ctx->flags) && 25f00e40ce7953 Masami Hiramatsu (Google 2024-03-04 1237) !tparg_is_function_return(ctx->flags)) { b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1238) trace_probe_log_err(ctx->offset, NOSUP_BTFARG); b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1239) return -EINVAL; b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1240) } c440adfbe30257 Masami Hiramatsu (Google 2023-08-23 1241) ret = parse_btf_arg(arg, pcode, end, ctx); b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1242) break; b576e09701c7d0 Masami Hiramatsu (Google 2023-06-06 1243) } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1244 } 533059281ee594 Masami Hiramatsu 2018-04-25 1245 if (!ret && code->op == FETCH_OP_NOP) { 533059281ee594 Masami Hiramatsu 2018-04-25 1246 /* Parsed, but do not find fetch method */ 1b8b0cd754cdbb Masami Hiramatsu (Google 2023-06-06 1247) trace_probe_log_err(ctx->offset, BAD_FETCH_ARG); 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1248 ret = -EINVAL; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1249 } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1250 return ret; 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1251 } 8ab83f56475ec9 Srikar Dronamraju 2012-04-09 1252 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 6:27 ` kernel test robot @ 2025-07-30 10:11 ` Masami Hiramatsu 2025-07-30 13:17 ` Steven Rostedt 0 siblings, 1 reply; 13+ messages in thread From: Masami Hiramatsu @ 2025-07-30 10:11 UTC (permalink / raw) To: kernel test robot Cc: Steven Rostedt, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Wed, 30 Jul 2025 14:27:08 +0800 kernel test robot <lkp@intel.com> wrote: > Hi Steven, > > kernel test robot noticed the following build errors: > > [auto build test ERROR on trace/for-next] > [also build test ERROR on lwn/docs-next akpm-mm/mm-everything linus/master v6.16 next-20250729] > [If your patch is applied to the wrong git tree, kindly drop us a note. > And when submitting patch, we suggest to use '--base' as documented in > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > url: https://github.com/intel-lab-lkp/linux/commits/Steven-Rostedt/tracing-Have-eprobes-have-their-own-config-option/20250730-001958 > base: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace for-next > patch link: https://lore.kernel.org/r/20250729161912.056641407%40kernel.org > patch subject: [PATCH v2 1/2] tracing: Have eprobes have their own config option > config: xtensa-randconfig-002-20250730 (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/config) > compiler: xtensa-linux-gcc (GCC) 12.5.0 > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/reproduce) > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > the same patch/commit), kindly add following tags > | Reported-by: kernel test robot <lkp@intel.com> > | Closes: https://lore.kernel.org/oe-kbuild-all/202507301452.JPAcMvT0-lkp@intel.com/ > > All errors (new ones prefixed by >>): > > kernel/trace/trace_probe.c: In function 'parse_probe_arg': > >> kernel/trace/trace_probe.c:1105:23: error: implicit declaration of function 'regs_query_register_offset'; did you mean 'ftrace_regs_query_register_offset'? [-Werror=implicit-function-declaration] > 1105 | ret = regs_query_register_offset(arg + 1); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~ > | ftrace_regs_query_register_offset > cc1: some warnings being treated as errors Interesting, this find another issue. Since this is provided by CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending on HAVE_REGS_AND_STACK_ACCESS_API. diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig index a3f35c7d83b6..cd239240b0ef 100644 --- a/kernel/trace/Kconfig +++ b/kernel/trace/Kconfig @@ -792,6 +792,7 @@ config DYNAMIC_EVENTS def_bool n config PROBE_EVENTS + depends on HAVE_REGS_AND_STACK_ACCESS_API def_bool n config BPF_KPROBE_OVERRIDE -- Masami Hiramatsu (Google) <mhiramat@kernel.org> ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 10:11 ` Masami Hiramatsu @ 2025-07-30 13:17 ` Steven Rostedt 2025-07-30 13:57 ` Masami Hiramatsu 0 siblings, 1 reply; 13+ messages in thread From: Steven Rostedt @ 2025-07-30 13:17 UTC (permalink / raw) To: Masami Hiramatsu (Google) Cc: kernel test robot, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Wed, 30 Jul 2025 19:11:01 +0900 Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > Interesting, this find another issue. Since this is provided by > CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending > on HAVE_REGS_AND_STACK_ACCESS_API. > > diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig > index a3f35c7d83b6..cd239240b0ef 100644 > --- a/kernel/trace/Kconfig > +++ b/kernel/trace/Kconfig > @@ -792,6 +792,7 @@ config DYNAMIC_EVENTS > def_bool n > > config PROBE_EVENTS > + depends on HAVE_REGS_AND_STACK_ACCESS_API > def_bool n > > config BPF_KPROBE_OVERRIDE OK, I'll send a v2. Did you want to take this in the tracing pull request? I see you already did the probe pull request. -- Steve ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 13:17 ` Steven Rostedt @ 2025-07-30 13:57 ` Masami Hiramatsu 2025-07-30 14:01 ` Steven Rostedt 0 siblings, 1 reply; 13+ messages in thread From: Masami Hiramatsu @ 2025-07-30 13:57 UTC (permalink / raw) To: Steven Rostedt Cc: kernel test robot, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Wed, 30 Jul 2025 09:17:27 -0400 Steven Rostedt <rostedt@goodmis.org> wrote: > On Wed, 30 Jul 2025 19:11:01 +0900 > Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > > > Interesting, this find another issue. Since this is provided by > > CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending > > on HAVE_REGS_AND_STACK_ACCESS_API. > > > > diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig > > index a3f35c7d83b6..cd239240b0ef 100644 > > --- a/kernel/trace/Kconfig > > +++ b/kernel/trace/Kconfig > > @@ -792,6 +792,7 @@ config DYNAMIC_EVENTS > > def_bool n > > > > config PROBE_EVENTS > > + depends on HAVE_REGS_AND_STACK_ACCESS_API > > def_bool n > > > > config BPF_KPROBE_OVERRIDE > > OK, I'll send a v2. > > Did you want to take this in the tracing pull request? > > I see you already did the probe pull request. Ah, I thought this was for the next one... (but I think it is a kind of bugfix?) Thank you, > > -- Steve -- Masami Hiramatsu (Google) <mhiramat@kernel.org> ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 13:57 ` Masami Hiramatsu @ 2025-07-30 14:01 ` Steven Rostedt 2025-07-30 22:08 ` Masami Hiramatsu 0 siblings, 1 reply; 13+ messages in thread From: Steven Rostedt @ 2025-07-30 14:01 UTC (permalink / raw) To: Masami Hiramatsu (Google) Cc: kernel test robot, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Wed, 30 Jul 2025 22:57:22 +0900 Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > > I see you already did the probe pull request. > > Ah, I thought this was for the next one... (but I think it is a kind of bugfix?) Yeah, as its not adding eprobes, but just making it configurable. But you haven't answered my question ;-) Do you want to push it to Linus or should I? I still have the trace/for-next to push (I've finished testing your last "attribute" patch and now I'm just letting it simmer in linux-next before doing the pull request). I can still add this to that one if you want. -- Steve ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 14:01 ` Steven Rostedt @ 2025-07-30 22:08 ` Masami Hiramatsu 2025-07-31 11:43 ` Steven Rostedt 0 siblings, 1 reply; 13+ messages in thread From: Masami Hiramatsu @ 2025-07-30 22:08 UTC (permalink / raw) To: Steven Rostedt Cc: kernel test robot, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Wed, 30 Jul 2025 10:01:55 -0400 Steven Rostedt <rostedt@goodmis.org> wrote: > On Wed, 30 Jul 2025 22:57:22 +0900 > Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > > > > I see you already did the probe pull request. > > > > Ah, I thought this was for the next one... (but I think it is a kind of bugfix?) > > Yeah, as its not adding eprobes, but just making it configurable. > > But you haven't answered my question ;-) > > Do you want to push it to Linus or should I? > > I still have the trace/for-next to push (I've finished testing your last > "attribute" patch and now I'm just letting it simmer in linux-next before > doing the pull request). I can still add this to that one if you want. > OK, could you push this to Linus? Thanks, > -- Steve > -- Masami Hiramatsu (Google) <mhiramat@kernel.org> ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option 2025-07-30 22:08 ` Masami Hiramatsu @ 2025-07-31 11:43 ` Steven Rostedt 0 siblings, 0 replies; 13+ messages in thread From: Steven Rostedt @ 2025-07-31 11:43 UTC (permalink / raw) To: Masami Hiramatsu (Google) Cc: kernel test robot, linux-kernel, linux-trace-kernel, linux-doc, oe-kbuild-all, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Linux Memory Management List, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Thu, 31 Jul 2025 07:08:36 +0900 Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > > I still have the trace/for-next to push (I've finished testing your last > > "attribute" patch and now I'm just letting it simmer in linux-next before > > doing the pull request). I can still add this to that one if you want. > > > > OK, could you push this to Linus? Will do later today. Thanks, -- Steve ^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes 2025-07-29 16:18 [PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes Steven Rostedt 2025-07-29 16:18 ` [PATCH v2 1/2] tracing: Have eprobes have their own config option Steven Rostedt @ 2025-07-29 16:18 ` Steven Rostedt 2025-07-29 19:31 ` Randy Dunlap 2025-07-30 2:58 ` Masami Hiramatsu 1 sibling, 2 replies; 13+ messages in thread From: Steven Rostedt @ 2025-07-29 16:18 UTC (permalink / raw) To: linux-kernel, linux-trace-kernel, linux-doc Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Namhyung Kim, Jonathan Corbet, Randy Dunlap From: Steven Rostedt <rostedt@goodmis.org> Eprobes was added back in 5.15, but was never documented. It became a "secret" interface even though it has been a topic of several presentations. For some reason, when eprobes was added, documenting it never became a priority, until now. Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> --- Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home - Renamed to eprobetrace.rst (Masami Hiramatsu) - Fixed title of document (Masami Hiramatsu) - Fixed grammar and spellings (Randy Dunlap) Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++ Documentation/trace/index.rst | 1 + 2 files changed, 270 insertions(+) create mode 100644 Documentation/trace/eprobetrace.rst diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst new file mode 100644 index 000000000000..6d8946983466 --- /dev/null +++ b/Documentation/trace/eprobetrace.rst @@ -0,0 +1,269 @@ +.. SPDX-License-Identifier: GPL-2.0 + +================================== +Eprobe - Event-based Probe Tracing +================================== + +:Author: Steven Rostedt <rostedt@goodmis.org> + +- Written for v6.17 + +Overview +======== + +Eprobes are dynamic events that are placed on existing events to either +dereference a field that is a pointer, or simply to limit what fields are +recorded in the trace event. + +Eprobes depend on kprobe events so to enable this feature; build your kernel +with CONFIG_EPROBE_EVENTS=y. + +Eprobes are created via the /sys/kernel/tracing/dynamic_events file. + +Synopsis of eprobe_events +------------------------- +:: + + e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS] : Set a probe + -:[EGRP/][EEVENT] : Clear a probe + + EGRP : Group name of the new event. If omitted, use "eprobes" for it. + EEVENT : Event name. If omitted, the event name is generated and will + be the same event name as the event it attached to. + GRP : Group name of the event to attach to. + EVENT : Event name of the event to attach to. + + FETCHARGS : Arguments. Each probe can have up to 128 args. + $FIELD : Fetch the value of the event field called FIELD. + @ADDR : Fetch memory at ADDR (ADDR should be in kernel) + @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol) + $comm : Fetch current task comm. + +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4) + \IMM : Store an immediate value to the argument. + NAME=FETCHARG : Set NAME as the argument name of FETCHARG. + FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types + (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types + (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char", + "string", "ustring", "symbol", "symstr" and "bitfield" are + supported. + +Types +----- +The FETCHARGS above is very similar to the kprobe events as described in +Documentation/trace/kprobetrace.rst. + +The difference between eprobes and kprobes FETCHARGS is that eprobes has a +$FIELD command that returns the content of the event field of the event +that is attached. Eprobes do not have access to registers, stacks and function +arguments that kprobes has. + +If a field argument is a pointer, it may be dereferenced just like a memory +address using the FETCHARGS syntax. + + +Attaching to dynamic events +--------------------------- + +Eprobes may attach to dynamic events as well as to normal events. It may +attach to a kprobe event, a synthetic event or a fprobe event. This is useful +if the type of a field needs to be changed. See Example 2 below. + +Usage examples +============== + +Example 1 +--------- + +The basic usage of eprobes is to limit the data that is being recorded into +the tracing buffer. For example, a common event to trace is the sched_switch +trace event. That has a format of:: + + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:char prev_comm[16]; offset:8; size:16; signed:0; + field:pid_t prev_pid; offset:24; size:4; signed:1; + field:int prev_prio; offset:28; size:4; signed:1; + field:long prev_state; offset:32; size:8; signed:1; + field:char next_comm[16]; offset:40; size:16; signed:0; + field:pid_t next_pid; offset:56; size:4; signed:1; + field:int next_prio; offset:60; size:4; signed:1; + +The first four fields are common to all events and can not be limited. But the +rest of the event has 60 bytes of information. It records the names of the +previous and next tasks being scheduled out and in, as well as their pids and +priorities. It also records the state of the previous task. If only the pids +of the tasks are of interest, why waste the ring buffer with all the other +fields? + +An eprobe can limit what gets recorded. Note, it does not help in performance, +as all the fields are recorded in a temporary buffer to process the eprobe. +:: + + # echo 'e:sched/switch sched.sched_switch prev=$prev_pid:u32 next=$next_pid:u32' >> /sys/kernel/tracing/dynamic_events + # echo 1 > /sys/kernel/tracing/events/sched/switch/enable + # cat /sys/kernel/tracing/trace + + # tracer: nop + # + # entries-in-buffer/entries-written: 2721/2721 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + sshd-session-1082 [004] d..4. 5041.239906: switch: (sched.sched_switch) prev=1082 next=0 + bash-1085 [001] d..4. 5041.240198: switch: (sched.sched_switch) prev=1085 next=141 + kworker/u34:5-141 [001] d..4. 5041.240259: switch: (sched.sched_switch) prev=141 next=1085 + <idle>-0 [004] d..4. 5041.240354: switch: (sched.sched_switch) prev=0 next=1082 + bash-1085 [001] d..4. 5041.240385: switch: (sched.sched_switch) prev=1085 next=141 + kworker/u34:5-141 [001] d..4. 5041.240410: switch: (sched.sched_switch) prev=141 next=1085 + bash-1085 [001] d..4. 5041.240478: switch: (sched.sched_switch) prev=1085 next=0 + sshd-session-1082 [004] d..4. 5041.240526: switch: (sched.sched_switch) prev=1082 next=0 + <idle>-0 [001] d..4. 5041.247524: switch: (sched.sched_switch) prev=0 next=90 + <idle>-0 [002] d..4. 5041.247545: switch: (sched.sched_switch) prev=0 next=16 + kworker/1:1-90 [001] d..4. 5041.247580: switch: (sched.sched_switch) prev=90 next=0 + rcu_sched-16 [002] d..4. 5041.247591: switch: (sched.sched_switch) prev=16 next=0 + <idle>-0 [002] d..4. 5041.257536: switch: (sched.sched_switch) prev=0 next=16 + rcu_sched-16 [002] d..4. 5041.257573: switch: (sched.sched_switch) prev=16 next=0 + +Note, without adding the "u32" after the prev_pid and next_pid, the values +would default showing in hexadecimal. + +Example 2 +--------- + +If a specific system call is to be recorded but the syscalls events are not +enabled, the raw_syscalls can still be used (syscalls are system call +events are not normal events, but are created from the raw_syscalls events +within the kernel). In order to trace the openat system call, one can create +an event probe on top of the raw_syscalls event: +:: + + # cd /sys/kernel/tracing + # cat events/raw_syscalls/sys_enter/format + name: sys_enter + ID: 395 + format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:long id; offset:8; size:8; signed:1; + field:unsigned long args[6]; offset:16; size:48; signed:0; + + print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5] + +From the source code, the sys_openat() has: +:: + + int sys_openat(int dirfd, const char *path, int flags, mode_t mode) + { + return my_syscall4(__NR_openat, dirfd, path, flags, mode); + } + +The path is the second parameter, and that is what is wanted. +:: + + # echo 'e:openat raw_syscalls.sys_enter nr=$id filename=+8($args):ustring' >> dynamic_events + +This is being run on x86_64 where the word size is 8 bytes and the openat +system call __NR_openat is set at 257. +:: + + # echo 'nr == 257' > events/eprobes/openat/filter + +Now enable the event and look at the trace. +:: + + # echo 1 > events/eprobes/openat/enable + # cat trace + + # tracer: nop + # + # entries-in-buffer/entries-written: 4/4 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + cat-1298 [003] ...2. 2060.875970: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) + cat-1298 [003] ...2. 2060.876197: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) + cat-1298 [003] ...2. 2060.879126: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) + cat-1298 [003] ...2. 2060.879639: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) + +The filename shows "(fault)". This is likely because the filename has not been +pulled into memory yet and currently trace events cannot fault in memory that +is not present. When an eprobe tries to read memory that has not been faulted +in yet, it will show the "(fault)" text. + +To get around this, as the kernel will likely pull in this filename and make +it present, attaching it to a synthetic event that can pass the address of the +filename from the entry of the event to the end of the event, this can be used +to show the filename when the system call returns. + +Remove the old eprobe:: + + # echo 1 > events/eprobes/openat/enable + # echo '-:openat' >> dynamic_events + +This time make an eprobe where the address of the filename is saved:: + + # echo 'e:openat_start raw_syscalls.sys_enter nr=$id filename=+8($args):x64' >> dynamic_events + +Create a synthetic event that passes the address of the filename to the +end of the event:: + + # echo 's:filename u64 file' >> dynamic_events + # echo 'hist:keys=common_pid:f=filename if nr == 257' > events/eprobes/openat_start/trigger + # echo 'hist:keys=common_pid:file=$f:onmatch(eprobes.openat_start).trace(filename,$file) if id == 257' > events/raw_syscalls/sys_exit/trigger + +Now that the address of the filename has been passed to the end of the +system call, create another eprobe to attach to the exit event to show the +string:: + + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events + # echo 1 > events/eprobes/openat/enable + # cat trace + + # tracer: nop + # + # entries-in-buffer/entries-written: 4/4 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + cat-1331 [001] ...5. 2944.787977: openat: (synthetic.filename) filename="/etc/ld.so.cache" + cat-1331 [001] ...5. 2944.788480: openat: (synthetic.filename) filename="/lib/x86_64-linux-gnu/libc.so.6" + cat-1331 [001] ...5. 2944.793426: openat: (synthetic.filename) filename="/usr/lib/locale/locale-archive" + cat-1331 [001] ...5. 2944.831362: openat: (synthetic.filename) filename="trace" + +Example 3 +--------- + +If syscall trace events are available, the above would not need the first +eprobe, but it would still need the last one:: + + # echo 's:filename u64 file' >> dynamic_events + # echo 'hist:keys=common_pid:f=filename' > events/syscalls/sys_enter_openat/trigger + # echo 'hist:keys=common_pid:file=$f:onmatch(syscalls.sys_enter_openat).trace(filename,$file)' > events/syscalls/sys_exit_openat/trigger + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events + # echo 1 > events/eprobes/openat/enable + +And this would produce the same result as Example 2. diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst index cc1dc5a087e8..b4a429dc4f7a 100644 --- a/Documentation/trace/index.rst +++ b/Documentation/trace/index.rst @@ -36,6 +36,7 @@ the Linux kernel. kprobes kprobetrace fprobetrace + eprobetrace fprobe ring-buffer-design -- 2.47.2 ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes 2025-07-29 16:18 ` [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes Steven Rostedt @ 2025-07-29 19:31 ` Randy Dunlap 2025-07-30 2:58 ` Masami Hiramatsu 1 sibling, 0 replies; 13+ messages in thread From: Randy Dunlap @ 2025-07-29 19:31 UTC (permalink / raw) To: Steven Rostedt, linux-kernel, linux-trace-kernel, linux-doc Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Namhyung Kim, Jonathan Corbet Hi Steven, On 7/29/25 9:18 AM, Steven Rostedt wrote: > From: Steven Rostedt <rostedt@goodmis.org> > > Eprobes was added back in 5.15, but was never documented. It became a > "secret" interface even though it has been a topic of several > presentations. For some reason, when eprobes was added, documenting it > never became a priority, until now. > > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> > --- > Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home > > - Renamed to eprobetrace.rst (Masami Hiramatsu) > > - Fixed title of document (Masami Hiramatsu) > > - Fixed grammar and spellings (Randy Dunlap) > > Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++ > Documentation/trace/index.rst | 1 + > 2 files changed, 270 insertions(+) > create mode 100644 Documentation/trace/eprobetrace.rst > > diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst > new file mode 100644 > index 000000000000..6d8946983466 > --- /dev/null > +++ b/Documentation/trace/eprobetrace.rst > @@ -0,0 +1,269 @@ > +.. SPDX-License-Identifier: GPL-2.0 > + > +================================== > +Eprobe - Event-based Probe Tracing > +================================== > + > +:Author: Steven Rostedt <rostedt@goodmis.org> > + > +- Written for v6.17 > + > +Overview > +======== > + > +Eprobes are dynamic events that are placed on existing events to either > +dereference a field that is a pointer, or simply to limit what fields are > +recorded in the trace event. > + > +Eprobes depend on kprobe events so to enable this feature; build your kernel I mucked that one up also. :( Please s/;/,/ above. Sorry. > +with CONFIG_EPROBE_EVENTS=y. > + > +Eprobes are created via the /sys/kernel/tracing/dynamic_events file. > + > +Synopsis of eprobe_events > +------------------------- > +:: > + > + e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS] : Set a probe > + -:[EGRP/][EEVENT] : Clear a probe > + > + EGRP : Group name of the new event. If omitted, use "eprobes" for it. > + EEVENT : Event name. If omitted, the event name is generated and will > + be the same event name as the event it attached to. > + GRP : Group name of the event to attach to. > + EVENT : Event name of the event to attach to. > + > + FETCHARGS : Arguments. Each probe can have up to 128 args. > + $FIELD : Fetch the value of the event field called FIELD. > + @ADDR : Fetch memory at ADDR (ADDR should be in kernel) > + @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol) > + $comm : Fetch current task comm. > + +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4) > + \IMM : Store an immediate value to the argument. > + NAME=FETCHARG : Set NAME as the argument name of FETCHARG. > + FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types > + (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types > + (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char", > + "string", "ustring", "symbol", "symstr" and "bitfield" are > + supported. > + > +Types > +----- > +The FETCHARGS above is very similar to the kprobe events as described in > +Documentation/trace/kprobetrace.rst. > + > +The difference between eprobes and kprobes FETCHARGS is that eprobes has a > +$FIELD command that returns the content of the event field of the event > +that is attached. Eprobes do not have access to registers, stacks and function > +arguments that kprobes has. > + > +If a field argument is a pointer, it may be dereferenced just like a memory > +address using the FETCHARGS syntax. > + > + > +Attaching to dynamic events > +--------------------------- > + > +Eprobes may attach to dynamic events as well as to normal events. It may > +attach to a kprobe event, a synthetic event or a fprobe event. This is useful an fprobe event. > +if the type of a field needs to be changed. See Example 2 below. Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Thanks. -- ~Randy ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes 2025-07-29 16:18 ` [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes Steven Rostedt 2025-07-29 19:31 ` Randy Dunlap @ 2025-07-30 2:58 ` Masami Hiramatsu 1 sibling, 0 replies; 13+ messages in thread From: Masami Hiramatsu @ 2025-07-30 2:58 UTC (permalink / raw) To: Steven Rostedt Cc: linux-kernel, linux-trace-kernel, linux-doc, Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton, Namhyung Kim, Jonathan Corbet, Randy Dunlap On Tue, 29 Jul 2025 12:18:18 -0400 Steven Rostedt <rostedt@kernel.org> wrote: > From: Steven Rostedt <rostedt@goodmis.org> > > Eprobes was added back in 5.15, but was never documented. It became a > "secret" interface even though it has been a topic of several > presentations. For some reason, when eprobes was added, documenting it > never became a priority, until now. > > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Looks good to me. Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Thanks! > --- > Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home > > - Renamed to eprobetrace.rst (Masami Hiramatsu) > > - Fixed title of document (Masami Hiramatsu) > > - Fixed grammar and spellings (Randy Dunlap) > > Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++ > Documentation/trace/index.rst | 1 + > 2 files changed, 270 insertions(+) > create mode 100644 Documentation/trace/eprobetrace.rst > > diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst > new file mode 100644 > index 000000000000..6d8946983466 > --- /dev/null > +++ b/Documentation/trace/eprobetrace.rst > @@ -0,0 +1,269 @@ > +.. SPDX-License-Identifier: GPL-2.0 > + > +================================== > +Eprobe - Event-based Probe Tracing > +================================== > + > +:Author: Steven Rostedt <rostedt@goodmis.org> > + > +- Written for v6.17 > + > +Overview > +======== > + > +Eprobes are dynamic events that are placed on existing events to either > +dereference a field that is a pointer, or simply to limit what fields are > +recorded in the trace event. > + > +Eprobes depend on kprobe events so to enable this feature; build your kernel > +with CONFIG_EPROBE_EVENTS=y. > + > +Eprobes are created via the /sys/kernel/tracing/dynamic_events file. > + > +Synopsis of eprobe_events > +------------------------- > +:: > + > + e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS] : Set a probe > + -:[EGRP/][EEVENT] : Clear a probe > + > + EGRP : Group name of the new event. If omitted, use "eprobes" for it. > + EEVENT : Event name. If omitted, the event name is generated and will > + be the same event name as the event it attached to. > + GRP : Group name of the event to attach to. > + EVENT : Event name of the event to attach to. > + > + FETCHARGS : Arguments. Each probe can have up to 128 args. > + $FIELD : Fetch the value of the event field called FIELD. > + @ADDR : Fetch memory at ADDR (ADDR should be in kernel) > + @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol) > + $comm : Fetch current task comm. > + +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4) > + \IMM : Store an immediate value to the argument. > + NAME=FETCHARG : Set NAME as the argument name of FETCHARG. > + FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types > + (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types > + (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char", > + "string", "ustring", "symbol", "symstr" and "bitfield" are > + supported. > + > +Types > +----- > +The FETCHARGS above is very similar to the kprobe events as described in > +Documentation/trace/kprobetrace.rst. > + > +The difference between eprobes and kprobes FETCHARGS is that eprobes has a > +$FIELD command that returns the content of the event field of the event > +that is attached. Eprobes do not have access to registers, stacks and function > +arguments that kprobes has. > + > +If a field argument is a pointer, it may be dereferenced just like a memory > +address using the FETCHARGS syntax. > + > + > +Attaching to dynamic events > +--------------------------- > + > +Eprobes may attach to dynamic events as well as to normal events. It may > +attach to a kprobe event, a synthetic event or a fprobe event. This is useful > +if the type of a field needs to be changed. See Example 2 below. > + > +Usage examples > +============== > + > +Example 1 > +--------- > + > +The basic usage of eprobes is to limit the data that is being recorded into > +the tracing buffer. For example, a common event to trace is the sched_switch > +trace event. That has a format of:: > + > + field:unsigned short common_type; offset:0; size:2; signed:0; > + field:unsigned char common_flags; offset:2; size:1; signed:0; > + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; > + field:int common_pid; offset:4; size:4; signed:1; > + > + field:char prev_comm[16]; offset:8; size:16; signed:0; > + field:pid_t prev_pid; offset:24; size:4; signed:1; > + field:int prev_prio; offset:28; size:4; signed:1; > + field:long prev_state; offset:32; size:8; signed:1; > + field:char next_comm[16]; offset:40; size:16; signed:0; > + field:pid_t next_pid; offset:56; size:4; signed:1; > + field:int next_prio; offset:60; size:4; signed:1; > + > +The first four fields are common to all events and can not be limited. But the > +rest of the event has 60 bytes of information. It records the names of the > +previous and next tasks being scheduled out and in, as well as their pids and > +priorities. It also records the state of the previous task. If only the pids > +of the tasks are of interest, why waste the ring buffer with all the other > +fields? > + > +An eprobe can limit what gets recorded. Note, it does not help in performance, > +as all the fields are recorded in a temporary buffer to process the eprobe. > +:: > + > + # echo 'e:sched/switch sched.sched_switch prev=$prev_pid:u32 next=$next_pid:u32' >> /sys/kernel/tracing/dynamic_events > + # echo 1 > /sys/kernel/tracing/events/sched/switch/enable > + # cat /sys/kernel/tracing/trace > + > + # tracer: nop > + # > + # entries-in-buffer/entries-written: 2721/2721 #P:8 > + # > + # _-----=> irqs-off/BH-disabled > + # / _----=> need-resched > + # | / _---=> hardirq/softirq > + # || / _--=> preempt-depth > + # ||| / _-=> migrate-disable > + # |||| / delay > + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION > + # | | | ||||| | | > + sshd-session-1082 [004] d..4. 5041.239906: switch: (sched.sched_switch) prev=1082 next=0 > + bash-1085 [001] d..4. 5041.240198: switch: (sched.sched_switch) prev=1085 next=141 > + kworker/u34:5-141 [001] d..4. 5041.240259: switch: (sched.sched_switch) prev=141 next=1085 > + <idle>-0 [004] d..4. 5041.240354: switch: (sched.sched_switch) prev=0 next=1082 > + bash-1085 [001] d..4. 5041.240385: switch: (sched.sched_switch) prev=1085 next=141 > + kworker/u34:5-141 [001] d..4. 5041.240410: switch: (sched.sched_switch) prev=141 next=1085 > + bash-1085 [001] d..4. 5041.240478: switch: (sched.sched_switch) prev=1085 next=0 > + sshd-session-1082 [004] d..4. 5041.240526: switch: (sched.sched_switch) prev=1082 next=0 > + <idle>-0 [001] d..4. 5041.247524: switch: (sched.sched_switch) prev=0 next=90 > + <idle>-0 [002] d..4. 5041.247545: switch: (sched.sched_switch) prev=0 next=16 > + kworker/1:1-90 [001] d..4. 5041.247580: switch: (sched.sched_switch) prev=90 next=0 > + rcu_sched-16 [002] d..4. 5041.247591: switch: (sched.sched_switch) prev=16 next=0 > + <idle>-0 [002] d..4. 5041.257536: switch: (sched.sched_switch) prev=0 next=16 > + rcu_sched-16 [002] d..4. 5041.257573: switch: (sched.sched_switch) prev=16 next=0 > + > +Note, without adding the "u32" after the prev_pid and next_pid, the values > +would default showing in hexadecimal. > + > +Example 2 > +--------- > + > +If a specific system call is to be recorded but the syscalls events are not > +enabled, the raw_syscalls can still be used (syscalls are system call > +events are not normal events, but are created from the raw_syscalls events > +within the kernel). In order to trace the openat system call, one can create > +an event probe on top of the raw_syscalls event: > +:: > + > + # cd /sys/kernel/tracing > + # cat events/raw_syscalls/sys_enter/format > + name: sys_enter > + ID: 395 > + format: > + field:unsigned short common_type; offset:0; size:2; signed:0; > + field:unsigned char common_flags; offset:2; size:1; signed:0; > + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; > + field:int common_pid; offset:4; size:4; signed:1; > + > + field:long id; offset:8; size:8; signed:1; > + field:unsigned long args[6]; offset:16; size:48; signed:0; > + > + print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5] > + > +From the source code, the sys_openat() has: > +:: > + > + int sys_openat(int dirfd, const char *path, int flags, mode_t mode) > + { > + return my_syscall4(__NR_openat, dirfd, path, flags, mode); > + } > + > +The path is the second parameter, and that is what is wanted. > +:: > + > + # echo 'e:openat raw_syscalls.sys_enter nr=$id filename=+8($args):ustring' >> dynamic_events > + > +This is being run on x86_64 where the word size is 8 bytes and the openat > +system call __NR_openat is set at 257. > +:: > + > + # echo 'nr == 257' > events/eprobes/openat/filter > + > +Now enable the event and look at the trace. > +:: > + > + # echo 1 > events/eprobes/openat/enable > + # cat trace > + > + # tracer: nop > + # > + # entries-in-buffer/entries-written: 4/4 #P:8 > + # > + # _-----=> irqs-off/BH-disabled > + # / _----=> need-resched > + # | / _---=> hardirq/softirq > + # || / _--=> preempt-depth > + # ||| / _-=> migrate-disable > + # |||| / delay > + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION > + # | | | ||||| | | > + cat-1298 [003] ...2. 2060.875970: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) > + cat-1298 [003] ...2. 2060.876197: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) > + cat-1298 [003] ...2. 2060.879126: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) > + cat-1298 [003] ...2. 2060.879639: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault) > + > +The filename shows "(fault)". This is likely because the filename has not been > +pulled into memory yet and currently trace events cannot fault in memory that > +is not present. When an eprobe tries to read memory that has not been faulted > +in yet, it will show the "(fault)" text. > + > +To get around this, as the kernel will likely pull in this filename and make > +it present, attaching it to a synthetic event that can pass the address of the > +filename from the entry of the event to the end of the event, this can be used > +to show the filename when the system call returns. > + > +Remove the old eprobe:: > + > + # echo 1 > events/eprobes/openat/enable > + # echo '-:openat' >> dynamic_events > + > +This time make an eprobe where the address of the filename is saved:: > + > + # echo 'e:openat_start raw_syscalls.sys_enter nr=$id filename=+8($args):x64' >> dynamic_events > + > +Create a synthetic event that passes the address of the filename to the > +end of the event:: > + > + # echo 's:filename u64 file' >> dynamic_events > + # echo 'hist:keys=common_pid:f=filename if nr == 257' > events/eprobes/openat_start/trigger > + # echo 'hist:keys=common_pid:file=$f:onmatch(eprobes.openat_start).trace(filename,$file) if id == 257' > events/raw_syscalls/sys_exit/trigger > + > +Now that the address of the filename has been passed to the end of the > +system call, create another eprobe to attach to the exit event to show the > +string:: > + > + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events > + # echo 1 > events/eprobes/openat/enable > + # cat trace > + > + # tracer: nop > + # > + # entries-in-buffer/entries-written: 4/4 #P:8 > + # > + # _-----=> irqs-off/BH-disabled > + # / _----=> need-resched > + # | / _---=> hardirq/softirq > + # || / _--=> preempt-depth > + # ||| / _-=> migrate-disable > + # |||| / delay > + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION > + # | | | ||||| | | > + cat-1331 [001] ...5. 2944.787977: openat: (synthetic.filename) filename="/etc/ld.so.cache" > + cat-1331 [001] ...5. 2944.788480: openat: (synthetic.filename) filename="/lib/x86_64-linux-gnu/libc.so.6" > + cat-1331 [001] ...5. 2944.793426: openat: (synthetic.filename) filename="/usr/lib/locale/locale-archive" > + cat-1331 [001] ...5. 2944.831362: openat: (synthetic.filename) filename="trace" > + > +Example 3 > +--------- > + > +If syscall trace events are available, the above would not need the first > +eprobe, but it would still need the last one:: > + > + # echo 's:filename u64 file' >> dynamic_events > + # echo 'hist:keys=common_pid:f=filename' > events/syscalls/sys_enter_openat/trigger > + # echo 'hist:keys=common_pid:file=$f:onmatch(syscalls.sys_enter_openat).trace(filename,$file)' > events/syscalls/sys_exit_openat/trigger > + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events > + # echo 1 > events/eprobes/openat/enable > + > +And this would produce the same result as Example 2. > diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst > index cc1dc5a087e8..b4a429dc4f7a 100644 > --- a/Documentation/trace/index.rst > +++ b/Documentation/trace/index.rst > @@ -36,6 +36,7 @@ the Linux kernel. > kprobes > kprobetrace > fprobetrace > + eprobetrace > fprobe > ring-buffer-design > > -- > 2.47.2 > > -- Masami Hiramatsu (Google) <mhiramat@kernel.org> ^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2025-07-31 11:43 UTC | newest] Thread overview: 13+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-07-29 16:18 [PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes Steven Rostedt 2025-07-29 16:18 ` [PATCH v2 1/2] tracing: Have eprobes have their own config option Steven Rostedt 2025-07-30 3:07 ` Masami Hiramatsu 2025-07-30 6:27 ` kernel test robot 2025-07-30 10:11 ` Masami Hiramatsu 2025-07-30 13:17 ` Steven Rostedt 2025-07-30 13:57 ` Masami Hiramatsu 2025-07-30 14:01 ` Steven Rostedt 2025-07-30 22:08 ` Masami Hiramatsu 2025-07-31 11:43 ` Steven Rostedt 2025-07-29 16:18 ` [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes Steven Rostedt 2025-07-29 19:31 ` Randy Dunlap 2025-07-30 2:58 ` Masami Hiramatsu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).