[PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes

[PATCH v2 0/2] tracing: Documentation: Add missing config and document for eprobes

[Steven Rostedt]

Add missing eprobe config option and documentation which should have both been
added back in 5.15.

Steven Rostedt (2):
      tracing: Have eprobes have their own config option
      Documentation: tracing: Add documentation about eprobes

----
 Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++++++++++
 Documentation/trace/index.rst       |   1 +
 kernel/trace/Kconfig                |  13 ++
 kernel/trace/Makefile               |   2 +-
 4 files changed, 284 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/trace/eprobetrace.rst

[PATCH v2 1/2] tracing: Have eprobes have their own config option

[Steven Rostedt]

From: Steven Rostedt <rostedt@goodmis.org>

Eprobes were added in 5.15 and were selected whenever any of the other
probe events were selected. If kprobe events were enabled (which it is by
default if kprobes are enabled) it would enable eprobe events as well. The
same for uprobes and fprobes.

Have eprobes have its own config and it gets enabled by default if tracing
is enabled.

Link: https://lore.kernel.org/all/20250729102636.b7cce553e7cc263722b12365@kernel.org/

Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
 kernel/trace/Kconfig  | 13 +++++++++++++
 kernel/trace/Makefile |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 93e8e7fc11c0..b951c027fffb 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -792,6 +792,19 @@ config UPROBE_EVENTS
 	  This option is required if you plan to use perf-probe subcommand
 	  of perf tools on user space applications.
 
+config EPROBE_EVENTS
+	bool "Enable event-based dynamic events"
+	depends on TRACING
+	select PROBE_EVENTS
+	select DYNAMIC_EVENTS
+	default y
+	help
+	  Eprobes are dynamic events that can be placed on other existing
+	  events. It can be used to limit what fields are recorded in
+	  an event or even dereference a field of an event. It can
+	  convert the type of an event field. For example, turn an
+	  address into a string.
+
 config BPF_EVENTS
 	depends on BPF_SYSCALL
 	depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 057cd975d014..dcb4e02afc5f 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -82,7 +82,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o
 endif
 obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
 obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o
-obj-$(CONFIG_PROBE_EVENTS) += trace_eprobe.o
+obj-$(CONFIG_EPROBE_EVENTS) += trace_eprobe.o
 obj-$(CONFIG_TRACE_EVENT_INJECT) += trace_events_inject.o
 obj-$(CONFIG_SYNTH_EVENTS) += trace_events_synth.o
 obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o
-- 
2.47.2

[PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes

[Steven Rostedt]

From: Steven Rostedt <rostedt@goodmis.org>

Eprobes was added back in 5.15, but was never documented. It became a
"secret" interface even though it has been a topic of several
presentations. For some reason, when eprobes was added, documenting it
never became a priority, until now.

Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home

- Renamed to eprobetrace.rst (Masami Hiramatsu)

- Fixed title of document (Masami Hiramatsu)

- Fixed grammar and spellings (Randy Dunlap)

 Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++
 Documentation/trace/index.rst       |   1 +
 2 files changed, 270 insertions(+)
 create mode 100644 Documentation/trace/eprobetrace.rst

diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst
new file mode 100644
index 000000000000..6d8946983466
--- /dev/null
+++ b/Documentation/trace/eprobetrace.rst
@@ -0,0 +1,269 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==================================
+Eprobe - Event-based Probe Tracing
+==================================
+
+:Author: Steven Rostedt <rostedt@goodmis.org>
+
+- Written for v6.17
+
+Overview
+========
+
+Eprobes are dynamic events that are placed on existing events to either
+dereference a field that is a pointer, or simply to limit what fields are
+recorded in the trace event.
+
+Eprobes depend on kprobe events so to enable this feature; build your kernel
+with CONFIG_EPROBE_EVENTS=y.
+
+Eprobes are created via the /sys/kernel/tracing/dynamic_events file.
+
+Synopsis of eprobe_events
+-------------------------
+::
+
+  e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS]	: Set a probe
+  -:[EGRP/][EEVENT]				: Clear a probe
+
+ EGRP		: Group name of the new event. If omitted, use "eprobes" for it.
+ EEVENT		: Event name. If omitted, the event name is generated and will
+		  be the same event name as the event it attached to.
+ GRP		: Group name of the event to attach to.
+ EVENT		: Event name of the event to attach to.
+
+ FETCHARGS	: Arguments. Each probe can have up to 128 args.
+  $FIELD	: Fetch the value of the event field called FIELD.
+  @ADDR		: Fetch memory at ADDR (ADDR should be in kernel)
+  @SYM[+|-offs]	: Fetch memory at SYM +|- offs (SYM should be a data symbol)
+  $comm		: Fetch current task comm.
+  +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4)
+  \IMM		: Store an immediate value to the argument.
+  NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
+  FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
+		  (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types
+		  (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char",
+                  "string", "ustring", "symbol", "symstr" and "bitfield" are
+                  supported.
+
+Types
+-----
+The FETCHARGS above is very similar to the kprobe events as described in
+Documentation/trace/kprobetrace.rst.
+
+The difference between eprobes and kprobes FETCHARGS is that eprobes has a
+$FIELD command that returns the content of the event field of the event
+that is attached. Eprobes do not have access to registers, stacks and function
+arguments that kprobes has.
+
+If a field argument is a pointer, it may be dereferenced just like a memory
+address using the FETCHARGS syntax.
+
+
+Attaching to dynamic events
+---------------------------
+
+Eprobes may attach to dynamic events as well as to normal events. It may
+attach to a kprobe event, a synthetic event or a fprobe event. This is useful
+if the type of a field needs to be changed. See Example 2 below.
+
+Usage examples
+==============
+
+Example 1
+---------
+
+The basic usage of eprobes is to limit the data that is being recorded into
+the tracing buffer. For example, a common event to trace is the sched_switch
+trace event. That has a format of::
+
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:char prev_comm[16];	offset:8;	size:16;	signed:0;
+	field:pid_t prev_pid;	offset:24;	size:4;	signed:1;
+	field:int prev_prio;	offset:28;	size:4;	signed:1;
+	field:long prev_state;	offset:32;	size:8;	signed:1;
+	field:char next_comm[16];	offset:40;	size:16;	signed:0;
+	field:pid_t next_pid;	offset:56;	size:4;	signed:1;
+	field:int next_prio;	offset:60;	size:4;	signed:1;
+
+The first four fields are common to all events and can not be limited. But the
+rest of the event has 60 bytes of information. It records the names of the
+previous and next tasks being scheduled out and in, as well as their pids and
+priorities. It also records the state of the previous task. If only the pids
+of the tasks are of interest, why waste the ring buffer with all the other
+fields?
+
+An eprobe can limit what gets recorded. Note, it does not help in performance,
+as all the fields are recorded in a temporary buffer to process the eprobe.
+::
+
+ # echo 'e:sched/switch sched.sched_switch prev=$prev_pid:u32 next=$next_pid:u32' >> /sys/kernel/tracing/dynamic_events
+ # echo 1 > /sys/kernel/tracing/events/sched/switch/enable
+ # cat /sys/kernel/tracing/trace
+
+ # tracer: nop
+ #
+ # entries-in-buffer/entries-written: 2721/2721   #P:8
+ #
+ #                                _-----=> irqs-off/BH-disabled
+ #                               / _----=> need-resched
+ #                              | / _---=> hardirq/softirq
+ #                              || / _--=> preempt-depth
+ #                              ||| / _-=> migrate-disable
+ #                              |||| /     delay
+ #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
+ #              | |         |   |||||     |         |
+     sshd-session-1082    [004] d..4.  5041.239906: switch: (sched.sched_switch) prev=1082 next=0
+             bash-1085    [001] d..4.  5041.240198: switch: (sched.sched_switch) prev=1085 next=141
+    kworker/u34:5-141     [001] d..4.  5041.240259: switch: (sched.sched_switch) prev=141 next=1085
+           <idle>-0       [004] d..4.  5041.240354: switch: (sched.sched_switch) prev=0 next=1082
+             bash-1085    [001] d..4.  5041.240385: switch: (sched.sched_switch) prev=1085 next=141
+    kworker/u34:5-141     [001] d..4.  5041.240410: switch: (sched.sched_switch) prev=141 next=1085
+             bash-1085    [001] d..4.  5041.240478: switch: (sched.sched_switch) prev=1085 next=0
+     sshd-session-1082    [004] d..4.  5041.240526: switch: (sched.sched_switch) prev=1082 next=0
+           <idle>-0       [001] d..4.  5041.247524: switch: (sched.sched_switch) prev=0 next=90
+           <idle>-0       [002] d..4.  5041.247545: switch: (sched.sched_switch) prev=0 next=16
+      kworker/1:1-90      [001] d..4.  5041.247580: switch: (sched.sched_switch) prev=90 next=0
+        rcu_sched-16      [002] d..4.  5041.247591: switch: (sched.sched_switch) prev=16 next=0
+           <idle>-0       [002] d..4.  5041.257536: switch: (sched.sched_switch) prev=0 next=16
+        rcu_sched-16      [002] d..4.  5041.257573: switch: (sched.sched_switch) prev=16 next=0
+
+Note, without adding the "u32" after the prev_pid and next_pid, the values
+would default showing in hexadecimal.
+
+Example 2
+---------
+
+If a specific system call is to be recorded but the syscalls events are not
+enabled, the raw_syscalls can still be used (syscalls are system call
+events are not normal events, but are created from the raw_syscalls events
+within the kernel). In order to trace the openat system call, one can create
+an event probe on top of the raw_syscalls event:
+::
+
+ # cd /sys/kernel/tracing
+ # cat events/raw_syscalls/sys_enter/format
+ name: sys_enter
+ ID: 395
+ format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:long id;	offset:8;	size:8;	signed:1;
+	field:unsigned long args[6];	offset:16;	size:48;	signed:0;
+
+ print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5]
+
+From the source code, the sys_openat() has:
+::
+
+ int sys_openat(int dirfd, const char *path, int flags, mode_t mode)
+ {
+	return my_syscall4(__NR_openat, dirfd, path, flags, mode);
+ }
+
+The path is the second parameter, and that is what is wanted.
+::
+
+ # echo 'e:openat raw_syscalls.sys_enter nr=$id filename=+8($args):ustring' >> dynamic_events
+
+This is being run on x86_64 where the word size is 8 bytes and the openat
+system call __NR_openat is set at 257.
+::
+
+ # echo 'nr == 257' > events/eprobes/openat/filter
+
+Now enable the event and look at the trace.
+::
+
+ # echo 1 > events/eprobes/openat/enable
+ # cat trace
+
+ # tracer: nop
+ #
+ # entries-in-buffer/entries-written: 4/4   #P:8
+ #
+ #                                _-----=> irqs-off/BH-disabled
+ #                               / _----=> need-resched
+ #                              | / _---=> hardirq/softirq
+ #                              || / _--=> preempt-depth
+ #                              ||| / _-=> migrate-disable
+ #                              |||| /     delay
+ #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
+ #              | |         |   |||||     |         |
+              cat-1298    [003] ...2.  2060.875970: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
+              cat-1298    [003] ...2.  2060.876197: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
+              cat-1298    [003] ...2.  2060.879126: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
+              cat-1298    [003] ...2.  2060.879639: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
+
+The filename shows "(fault)". This is likely because the filename has not been
+pulled into memory yet and currently trace events cannot fault in memory that
+is not present. When an eprobe tries to read memory that has not been faulted
+in yet, it will show the "(fault)" text.
+
+To get around this, as the kernel will likely pull in this filename and make
+it present, attaching it to a synthetic event that can pass the address of the
+filename from the entry of the event to the end of the event, this can be used
+to show the filename when the system call returns.
+
+Remove the old eprobe::
+
+ # echo 1 > events/eprobes/openat/enable
+ # echo '-:openat' >> dynamic_events
+
+This time make an eprobe where the address of the filename is saved::
+
+ # echo 'e:openat_start raw_syscalls.sys_enter nr=$id filename=+8($args):x64' >> dynamic_events
+
+Create a synthetic event that passes the address of the filename to the
+end of the event::
+
+ # echo 's:filename u64 file' >> dynamic_events
+ # echo 'hist:keys=common_pid:f=filename if nr == 257' > events/eprobes/openat_start/trigger
+ # echo 'hist:keys=common_pid:file=$f:onmatch(eprobes.openat_start).trace(filename,$file) if id == 257' > events/raw_syscalls/sys_exit/trigger
+
+Now that the address of the filename has been passed to the end of the
+system call, create another eprobe to attach to the exit event to show the
+string::
+
+ # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events
+ # echo 1 > events/eprobes/openat/enable
+ # cat trace
+
+ # tracer: nop
+ #
+ # entries-in-buffer/entries-written: 4/4   #P:8
+ #
+ #                                _-----=> irqs-off/BH-disabled
+ #                               / _----=> need-resched
+ #                              | / _---=> hardirq/softirq
+ #                              || / _--=> preempt-depth
+ #                              ||| / _-=> migrate-disable
+ #                              |||| /     delay
+ #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
+ #              | |         |   |||||     |         |
+              cat-1331    [001] ...5.  2944.787977: openat: (synthetic.filename) filename="/etc/ld.so.cache"
+              cat-1331    [001] ...5.  2944.788480: openat: (synthetic.filename) filename="/lib/x86_64-linux-gnu/libc.so.6"
+              cat-1331    [001] ...5.  2944.793426: openat: (synthetic.filename) filename="/usr/lib/locale/locale-archive"
+              cat-1331    [001] ...5.  2944.831362: openat: (synthetic.filename) filename="trace"
+
+Example 3
+---------
+
+If syscall trace events are available, the above would not need the first
+eprobe, but it would still need the last one::
+
+ # echo 's:filename u64 file' >> dynamic_events
+ # echo 'hist:keys=common_pid:f=filename' > events/syscalls/sys_enter_openat/trigger
+ # echo 'hist:keys=common_pid:file=$f:onmatch(syscalls.sys_enter_openat).trace(filename,$file)' > events/syscalls/sys_exit_openat/trigger
+ # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events
+ # echo 1 > events/eprobes/openat/enable
+
+And this would produce the same result as Example 2.
diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
index cc1dc5a087e8..b4a429dc4f7a 100644
--- a/Documentation/trace/index.rst
+++ b/Documentation/trace/index.rst
@@ -36,6 +36,7 @@ the Linux kernel.
    kprobes
    kprobetrace
    fprobetrace
+   eprobetrace
    fprobe
    ring-buffer-design
 
-- 
2.47.2

Re: [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes

[Randy Dunlap]

Hi Steven,


On 7/29/25 9:18 AM, Steven Rostedt wrote:
> From: Steven Rostedt <rostedt@goodmis.org>
> 
> Eprobes was added back in 5.15, but was never documented. It became a
> "secret" interface even though it has been a topic of several
> presentations. For some reason, when eprobes was added, documenting it
> never became a priority, until now.
> 
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> ---
> Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home
> 
> - Renamed to eprobetrace.rst (Masami Hiramatsu)
> 
> - Fixed title of document (Masami Hiramatsu)
> 
> - Fixed grammar and spellings (Randy Dunlap)
> 
>  Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++
>  Documentation/trace/index.rst       |   1 +
>  2 files changed, 270 insertions(+)
>  create mode 100644 Documentation/trace/eprobetrace.rst
> 
> diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst
> new file mode 100644
> index 000000000000..6d8946983466
> --- /dev/null
> +++ b/Documentation/trace/eprobetrace.rst
> @@ -0,0 +1,269 @@
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +==================================
> +Eprobe - Event-based Probe Tracing
> +==================================
> +
> +:Author: Steven Rostedt <rostedt@goodmis.org>
> +
> +- Written for v6.17
> +
> +Overview
> +========
> +
> +Eprobes are dynamic events that are placed on existing events to either
> +dereference a field that is a pointer, or simply to limit what fields are
> +recorded in the trace event.
> +
> +Eprobes depend on kprobe events so to enable this feature; build your kernel

I mucked that one up also. :(
Please s/;/,/ above. Sorry.


> +with CONFIG_EPROBE_EVENTS=y.
> +
> +Eprobes are created via the /sys/kernel/tracing/dynamic_events file.
> +
> +Synopsis of eprobe_events
> +-------------------------
> +::
> +
> +  e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS]	: Set a probe
> +  -:[EGRP/][EEVENT]				: Clear a probe
> +
> + EGRP		: Group name of the new event. If omitted, use "eprobes" for it.
> + EEVENT		: Event name. If omitted, the event name is generated and will
> +		  be the same event name as the event it attached to.
> + GRP		: Group name of the event to attach to.
> + EVENT		: Event name of the event to attach to.
> +
> + FETCHARGS	: Arguments. Each probe can have up to 128 args.
> +  $FIELD	: Fetch the value of the event field called FIELD.
> +  @ADDR		: Fetch memory at ADDR (ADDR should be in kernel)
> +  @SYM[+|-offs]	: Fetch memory at SYM +|- offs (SYM should be a data symbol)
> +  $comm		: Fetch current task comm.
> +  +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4)
> +  \IMM		: Store an immediate value to the argument.
> +  NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
> +  FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
> +		  (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types
> +		  (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char",
> +                  "string", "ustring", "symbol", "symstr" and "bitfield" are
> +                  supported.
> +
> +Types
> +-----
> +The FETCHARGS above is very similar to the kprobe events as described in
> +Documentation/trace/kprobetrace.rst.
> +
> +The difference between eprobes and kprobes FETCHARGS is that eprobes has a
> +$FIELD command that returns the content of the event field of the event
> +that is attached. Eprobes do not have access to registers, stacks and function
> +arguments that kprobes has.
> +
> +If a field argument is a pointer, it may be dereferenced just like a memory
> +address using the FETCHARGS syntax.
> +
> +
> +Attaching to dynamic events
> +---------------------------
> +
> +Eprobes may attach to dynamic events as well as to normal events. It may
> +attach to a kprobe event, a synthetic event or a fprobe event. This is useful

                                                  an fprobe event.

> +if the type of a field needs to be changed. See Example 2 below.

Reviewed-by: Randy Dunlap <rdunlap@infradead.org>

Thanks.

-- 
~Randy

Re: [PATCH v2 2/2] Documentation: tracing: Add documentation about eprobes

[Masami Hiramatsu]

On Tue, 29 Jul 2025 12:18:18 -0400
Steven Rostedt <rostedt@kernel.org> wrote:

> From: Steven Rostedt <rostedt@goodmis.org>
> 
> Eprobes was added back in 5.15, but was never documented. It became a
> "secret" interface even though it has been a topic of several
> presentations. For some reason, when eprobes was added, documenting it
> never became a priority, until now.
> 
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Thanks!

> ---
> Changes since v1: https://lore.kernel.org/20250728171522.7d54e116@batman.local.home
> 
> - Renamed to eprobetrace.rst (Masami Hiramatsu)
> 
> - Fixed title of document (Masami Hiramatsu)
> 
> - Fixed grammar and spellings (Randy Dunlap)
> 
>  Documentation/trace/eprobetrace.rst | 269 ++++++++++++++++++++++++++++
>  Documentation/trace/index.rst       |   1 +
>  2 files changed, 270 insertions(+)
>  create mode 100644 Documentation/trace/eprobetrace.rst
> 
> diff --git a/Documentation/trace/eprobetrace.rst b/Documentation/trace/eprobetrace.rst
> new file mode 100644
> index 000000000000..6d8946983466
> --- /dev/null
> +++ b/Documentation/trace/eprobetrace.rst
> @@ -0,0 +1,269 @@
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +==================================
> +Eprobe - Event-based Probe Tracing
> +==================================
> +
> +:Author: Steven Rostedt <rostedt@goodmis.org>
> +
> +- Written for v6.17
> +
> +Overview
> +========
> +
> +Eprobes are dynamic events that are placed on existing events to either
> +dereference a field that is a pointer, or simply to limit what fields are
> +recorded in the trace event.
> +
> +Eprobes depend on kprobe events so to enable this feature; build your kernel
> +with CONFIG_EPROBE_EVENTS=y.
> +
> +Eprobes are created via the /sys/kernel/tracing/dynamic_events file.
> +
> +Synopsis of eprobe_events
> +-------------------------
> +::
> +
> +  e[:[EGRP/][EEVENT]] GRP.EVENT [FETCHARGS]	: Set a probe
> +  -:[EGRP/][EEVENT]				: Clear a probe
> +
> + EGRP		: Group name of the new event. If omitted, use "eprobes" for it.
> + EEVENT		: Event name. If omitted, the event name is generated and will
> +		  be the same event name as the event it attached to.
> + GRP		: Group name of the event to attach to.
> + EVENT		: Event name of the event to attach to.
> +
> + FETCHARGS	: Arguments. Each probe can have up to 128 args.
> +  $FIELD	: Fetch the value of the event field called FIELD.
> +  @ADDR		: Fetch memory at ADDR (ADDR should be in kernel)
> +  @SYM[+|-offs]	: Fetch memory at SYM +|- offs (SYM should be a data symbol)
> +  $comm		: Fetch current task comm.
> +  +|-[u]OFFS(FETCHARG) : Fetch memory at FETCHARG +|- OFFS address.(\*3)(\*4)
> +  \IMM		: Store an immediate value to the argument.
> +  NAME=FETCHARG : Set NAME as the argument name of FETCHARG.
> +  FETCHARG:TYPE : Set TYPE as the type of FETCHARG. Currently, basic types
> +		  (u8/u16/u32/u64/s8/s16/s32/s64), hexadecimal types
> +		  (x8/x16/x32/x64), VFS layer common type(%pd/%pD), "char",
> +                  "string", "ustring", "symbol", "symstr" and "bitfield" are
> +                  supported.
> +
> +Types
> +-----
> +The FETCHARGS above is very similar to the kprobe events as described in
> +Documentation/trace/kprobetrace.rst.
> +
> +The difference between eprobes and kprobes FETCHARGS is that eprobes has a
> +$FIELD command that returns the content of the event field of the event
> +that is attached. Eprobes do not have access to registers, stacks and function
> +arguments that kprobes has.
> +
> +If a field argument is a pointer, it may be dereferenced just like a memory
> +address using the FETCHARGS syntax.
> +
> +
> +Attaching to dynamic events
> +---------------------------
> +
> +Eprobes may attach to dynamic events as well as to normal events. It may
> +attach to a kprobe event, a synthetic event or a fprobe event. This is useful
> +if the type of a field needs to be changed. See Example 2 below.
> +
> +Usage examples
> +==============
> +
> +Example 1
> +---------
> +
> +The basic usage of eprobes is to limit the data that is being recorded into
> +the tracing buffer. For example, a common event to trace is the sched_switch
> +trace event. That has a format of::
> +
> +	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
> +	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
> +	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
> +	field:int common_pid;	offset:4;	size:4;	signed:1;
> +
> +	field:char prev_comm[16];	offset:8;	size:16;	signed:0;
> +	field:pid_t prev_pid;	offset:24;	size:4;	signed:1;
> +	field:int prev_prio;	offset:28;	size:4;	signed:1;
> +	field:long prev_state;	offset:32;	size:8;	signed:1;
> +	field:char next_comm[16];	offset:40;	size:16;	signed:0;
> +	field:pid_t next_pid;	offset:56;	size:4;	signed:1;
> +	field:int next_prio;	offset:60;	size:4;	signed:1;
> +
> +The first four fields are common to all events and can not be limited. But the
> +rest of the event has 60 bytes of information. It records the names of the
> +previous and next tasks being scheduled out and in, as well as their pids and
> +priorities. It also records the state of the previous task. If only the pids
> +of the tasks are of interest, why waste the ring buffer with all the other
> +fields?
> +
> +An eprobe can limit what gets recorded. Note, it does not help in performance,
> +as all the fields are recorded in a temporary buffer to process the eprobe.
> +::
> +
> + # echo 'e:sched/switch sched.sched_switch prev=$prev_pid:u32 next=$next_pid:u32' >> /sys/kernel/tracing/dynamic_events
> + # echo 1 > /sys/kernel/tracing/events/sched/switch/enable
> + # cat /sys/kernel/tracing/trace
> +
> + # tracer: nop
> + #
> + # entries-in-buffer/entries-written: 2721/2721   #P:8
> + #
> + #                                _-----=> irqs-off/BH-disabled
> + #                               / _----=> need-resched
> + #                              | / _---=> hardirq/softirq
> + #                              || / _--=> preempt-depth
> + #                              ||| / _-=> migrate-disable
> + #                              |||| /     delay
> + #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
> + #              | |         |   |||||     |         |
> +     sshd-session-1082    [004] d..4.  5041.239906: switch: (sched.sched_switch) prev=1082 next=0
> +             bash-1085    [001] d..4.  5041.240198: switch: (sched.sched_switch) prev=1085 next=141
> +    kworker/u34:5-141     [001] d..4.  5041.240259: switch: (sched.sched_switch) prev=141 next=1085
> +           <idle>-0       [004] d..4.  5041.240354: switch: (sched.sched_switch) prev=0 next=1082
> +             bash-1085    [001] d..4.  5041.240385: switch: (sched.sched_switch) prev=1085 next=141
> +    kworker/u34:5-141     [001] d..4.  5041.240410: switch: (sched.sched_switch) prev=141 next=1085
> +             bash-1085    [001] d..4.  5041.240478: switch: (sched.sched_switch) prev=1085 next=0
> +     sshd-session-1082    [004] d..4.  5041.240526: switch: (sched.sched_switch) prev=1082 next=0
> +           <idle>-0       [001] d..4.  5041.247524: switch: (sched.sched_switch) prev=0 next=90
> +           <idle>-0       [002] d..4.  5041.247545: switch: (sched.sched_switch) prev=0 next=16
> +      kworker/1:1-90      [001] d..4.  5041.247580: switch: (sched.sched_switch) prev=90 next=0
> +        rcu_sched-16      [002] d..4.  5041.247591: switch: (sched.sched_switch) prev=16 next=0
> +           <idle>-0       [002] d..4.  5041.257536: switch: (sched.sched_switch) prev=0 next=16
> +        rcu_sched-16      [002] d..4.  5041.257573: switch: (sched.sched_switch) prev=16 next=0
> +
> +Note, without adding the "u32" after the prev_pid and next_pid, the values
> +would default showing in hexadecimal.
> +
> +Example 2
> +---------
> +
> +If a specific system call is to be recorded but the syscalls events are not
> +enabled, the raw_syscalls can still be used (syscalls are system call
> +events are not normal events, but are created from the raw_syscalls events
> +within the kernel). In order to trace the openat system call, one can create
> +an event probe on top of the raw_syscalls event:
> +::
> +
> + # cd /sys/kernel/tracing
> + # cat events/raw_syscalls/sys_enter/format
> + name: sys_enter
> + ID: 395
> + format:
> +	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
> +	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
> +	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
> +	field:int common_pid;	offset:4;	size:4;	signed:1;
> +
> +	field:long id;	offset:8;	size:8;	signed:1;
> +	field:unsigned long args[6];	offset:16;	size:48;	signed:0;
> +
> + print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5]
> +
> +From the source code, the sys_openat() has:
> +::
> +
> + int sys_openat(int dirfd, const char *path, int flags, mode_t mode)
> + {
> +	return my_syscall4(__NR_openat, dirfd, path, flags, mode);
> + }
> +
> +The path is the second parameter, and that is what is wanted.
> +::
> +
> + # echo 'e:openat raw_syscalls.sys_enter nr=$id filename=+8($args):ustring' >> dynamic_events
> +
> +This is being run on x86_64 where the word size is 8 bytes and the openat
> +system call __NR_openat is set at 257.
> +::
> +
> + # echo 'nr == 257' > events/eprobes/openat/filter
> +
> +Now enable the event and look at the trace.
> +::
> +
> + # echo 1 > events/eprobes/openat/enable
> + # cat trace
> +
> + # tracer: nop
> + #
> + # entries-in-buffer/entries-written: 4/4   #P:8
> + #
> + #                                _-----=> irqs-off/BH-disabled
> + #                               / _----=> need-resched
> + #                              | / _---=> hardirq/softirq
> + #                              || / _--=> preempt-depth
> + #                              ||| / _-=> migrate-disable
> + #                              |||| /     delay
> + #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
> + #              | |         |   |||||     |         |
> +              cat-1298    [003] ...2.  2060.875970: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
> +              cat-1298    [003] ...2.  2060.876197: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
> +              cat-1298    [003] ...2.  2060.879126: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
> +              cat-1298    [003] ...2.  2060.879639: openat: (raw_syscalls.sys_enter) nr=0x101 filename=(fault)
> +
> +The filename shows "(fault)". This is likely because the filename has not been
> +pulled into memory yet and currently trace events cannot fault in memory that
> +is not present. When an eprobe tries to read memory that has not been faulted
> +in yet, it will show the "(fault)" text.
> +
> +To get around this, as the kernel will likely pull in this filename and make
> +it present, attaching it to a synthetic event that can pass the address of the
> +filename from the entry of the event to the end of the event, this can be used
> +to show the filename when the system call returns.
> +
> +Remove the old eprobe::
> +
> + # echo 1 > events/eprobes/openat/enable
> + # echo '-:openat' >> dynamic_events
> +
> +This time make an eprobe where the address of the filename is saved::
> +
> + # echo 'e:openat_start raw_syscalls.sys_enter nr=$id filename=+8($args):x64' >> dynamic_events
> +
> +Create a synthetic event that passes the address of the filename to the
> +end of the event::
> +
> + # echo 's:filename u64 file' >> dynamic_events
> + # echo 'hist:keys=common_pid:f=filename if nr == 257' > events/eprobes/openat_start/trigger
> + # echo 'hist:keys=common_pid:file=$f:onmatch(eprobes.openat_start).trace(filename,$file) if id == 257' > events/raw_syscalls/sys_exit/trigger
> +
> +Now that the address of the filename has been passed to the end of the
> +system call, create another eprobe to attach to the exit event to show the
> +string::
> +
> + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events
> + # echo 1 > events/eprobes/openat/enable
> + # cat trace
> +
> + # tracer: nop
> + #
> + # entries-in-buffer/entries-written: 4/4   #P:8
> + #
> + #                                _-----=> irqs-off/BH-disabled
> + #                               / _----=> need-resched
> + #                              | / _---=> hardirq/softirq
> + #                              || / _--=> preempt-depth
> + #                              ||| / _-=> migrate-disable
> + #                              |||| /     delay
> + #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
> + #              | |         |   |||||     |         |
> +              cat-1331    [001] ...5.  2944.787977: openat: (synthetic.filename) filename="/etc/ld.so.cache"
> +              cat-1331    [001] ...5.  2944.788480: openat: (synthetic.filename) filename="/lib/x86_64-linux-gnu/libc.so.6"
> +              cat-1331    [001] ...5.  2944.793426: openat: (synthetic.filename) filename="/usr/lib/locale/locale-archive"
> +              cat-1331    [001] ...5.  2944.831362: openat: (synthetic.filename) filename="trace"
> +
> +Example 3
> +---------
> +
> +If syscall trace events are available, the above would not need the first
> +eprobe, but it would still need the last one::
> +
> + # echo 's:filename u64 file' >> dynamic_events
> + # echo 'hist:keys=common_pid:f=filename' > events/syscalls/sys_enter_openat/trigger
> + # echo 'hist:keys=common_pid:file=$f:onmatch(syscalls.sys_enter_openat).trace(filename,$file)' > events/syscalls/sys_exit_openat/trigger
> + # echo 'e:openat synthetic.filename filename=+0($file):ustring' >> dynamic_events
> + # echo 1 > events/eprobes/openat/enable
> +
> +And this would produce the same result as Example 2.
> diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
> index cc1dc5a087e8..b4a429dc4f7a 100644
> --- a/Documentation/trace/index.rst
> +++ b/Documentation/trace/index.rst
> @@ -36,6 +36,7 @@ the Linux kernel.
>     kprobes
>     kprobetrace
>     fprobetrace
> +   eprobetrace
>     fprobe
>     ring-buffer-design
>  
> -- 
> 2.47.2
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Masami Hiramatsu]

On Tue, 29 Jul 2025 12:18:17 -0400
Steven Rostedt <rostedt@kernel.org> wrote:

> From: Steven Rostedt <rostedt@goodmis.org>
> 
> Eprobes were added in 5.15 and were selected whenever any of the other
> probe events were selected. If kprobe events were enabled (which it is by
> default if kprobes are enabled) it would enable eprobe events as well. The
> same for uprobes and fprobes.
> 
> Have eprobes have its own config and it gets enabled by default if tracing
> is enabled.
> 
> Link: https://lore.kernel.org/all/20250729102636.b7cce553e7cc263722b12365@kernel.org/
> 

Looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

BTW, is it a bugfix or improvement?

Thanks,

> Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> ---
>  kernel/trace/Kconfig  | 13 +++++++++++++
>  kernel/trace/Makefile |  2 +-
>  2 files changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> index 93e8e7fc11c0..b951c027fffb 100644
> --- a/kernel/trace/Kconfig
> +++ b/kernel/trace/Kconfig
> @@ -792,6 +792,19 @@ config UPROBE_EVENTS
>  	  This option is required if you plan to use perf-probe subcommand
>  	  of perf tools on user space applications.
>  
> +config EPROBE_EVENTS
> +	bool "Enable event-based dynamic events"
> +	depends on TRACING
> +	select PROBE_EVENTS
> +	select DYNAMIC_EVENTS
> +	default y
> +	help
> +	  Eprobes are dynamic events that can be placed on other existing
> +	  events. It can be used to limit what fields are recorded in
> +	  an event or even dereference a field of an event. It can
> +	  convert the type of an event field. For example, turn an
> +	  address into a string.
> +
>  config BPF_EVENTS
>  	depends on BPF_SYSCALL
>  	depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS
> diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
> index 057cd975d014..dcb4e02afc5f 100644
> --- a/kernel/trace/Makefile
> +++ b/kernel/trace/Makefile
> @@ -82,7 +82,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_event_perf.o
>  endif
>  obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
>  obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o
> -obj-$(CONFIG_PROBE_EVENTS) += trace_eprobe.o
> +obj-$(CONFIG_EPROBE_EVENTS) += trace_eprobe.o
>  obj-$(CONFIG_TRACE_EVENT_INJECT) += trace_events_inject.o
>  obj-$(CONFIG_SYNTH_EVENTS) += trace_events_synth.o
>  obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o
> -- 
> 2.47.2
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[kernel test robot]

Hi Steven,

kernel test robot noticed the following build errors:

[auto build test ERROR on trace/for-next]
[also build test ERROR on lwn/docs-next akpm-mm/mm-everything linus/master v6.16 next-20250729]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Steven-Rostedt/tracing-Have-eprobes-have-their-own-config-option/20250730-001958
base:   https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace for-next
patch link:    https://lore.kernel.org/r/20250729161912.056641407%40kernel.org
patch subject: [PATCH v2 1/2] tracing: Have eprobes have their own config option
config: xtensa-randconfig-002-20250730 (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/config)
compiler: xtensa-linux-gcc (GCC) 12.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202507301452.JPAcMvT0-lkp@intel.com/

All errors (new ones prefixed by >>):

   kernel/trace/trace_probe.c: In function 'parse_probe_arg':
>> kernel/trace/trace_probe.c:1105:23: error: implicit declaration of function 'regs_query_register_offset'; did you mean 'ftrace_regs_query_register_offset'? [-Werror=implicit-function-declaration]
    1105 |                 ret = regs_query_register_offset(arg + 1);
         |                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
         |                       ftrace_regs_query_register_offset
   cc1: some warnings being treated as errors


vim +1105 kernel/trace/trace_probe.c

a42e3c4de9642d Masami Hiramatsu          2019-06-20  1080  
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1081  /* Recursive argument parser */
533059281ee594 Masami Hiramatsu          2018-04-25  1082  static int
533059281ee594 Masami Hiramatsu          2018-04-25  1083  parse_probe_arg(char *arg, const struct fetch_type *type,
533059281ee594 Masami Hiramatsu          2018-04-25  1084  		struct fetch_insn **pcode, struct fetch_insn *end,
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1085) 		struct traceprobe_parse_context *ctx)
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1086  {
533059281ee594 Masami Hiramatsu          2018-04-25  1087  	struct fetch_insn *code = *pcode;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1088  	unsigned long param;
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1089  	int deref = FETCH_OP_DEREF;
bf173ca92da978 Steven Rostedt (VMware    2018-10-12  1090) 	long offset = 0;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1091  	char *tmp;
34fee3a104cea1 Namhyung Kim              2013-11-26  1092  	int ret = 0;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1093  
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1094  	switch (arg[0]) {
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1095  	case '$':
d157d7694460b9 Masami Hiramatsu (Google  2023-08-23  1096) 		ret = parse_probe_vars(arg, type, pcode, end, ctx);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1097  		break;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1098  
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1099  	case '%':	/* named register */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1100) 		if (ctx->flags & (TPARG_FL_TEVENT | TPARG_FL_FPROBE)) {
334e5519c37570 Masami Hiramatsu (Google  2023-06-06  1101) 			/* eprobe and fprobe do not handle registers */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1102) 			trace_probe_log_err(ctx->offset, BAD_VAR);
2673c60ee67e71 Steven Rostedt (Google    2022-08-20  1103) 			break;
2673c60ee67e71 Steven Rostedt (Google    2022-08-20  1104) 		}
8ab83f56475ec9 Srikar Dronamraju         2012-04-09 @1105  		ret = regs_query_register_offset(arg + 1);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1106  		if (ret >= 0) {
533059281ee594 Masami Hiramatsu          2018-04-25  1107  			code->op = FETCH_OP_REG;
533059281ee594 Masami Hiramatsu          2018-04-25  1108  			code->param = (unsigned int)ret;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1109  			ret = 0;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1110  		} else
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1111) 			trace_probe_log_err(ctx->offset, BAD_REG_NAME);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1112  		break;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1113  
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1114  	case '@':	/* memory, file-offset or symbol */
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1115  		if (isdigit(arg[1])) {
bcd83ea6cbfee5 Daniel Walter             2012-09-26  1116  			ret = kstrtoul(arg + 1, 0, &param);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1117  			if (ret) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1118) 				trace_probe_log_err(ctx->offset, BAD_MEM_ADDR);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1119  				break;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1120  			}
533059281ee594 Masami Hiramatsu          2018-04-25  1121  			/* load address */
533059281ee594 Masami Hiramatsu          2018-04-25  1122  			code->op = FETCH_OP_IMM;
533059281ee594 Masami Hiramatsu          2018-04-25  1123  			code->immediate = param;
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1124  		} else if (arg[1] == '+') {
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1125  			/* kprobes don't support file offsets */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1126) 			if (ctx->flags & TPARG_FL_KERNEL) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1127) 				trace_probe_log_err(ctx->offset, FILE_ON_KPROBE);
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1128  				return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1129  			}
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1130  			ret = kstrtol(arg + 2, 0, &offset);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1131  			if (ret) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1132) 				trace_probe_log_err(ctx->offset, BAD_FILE_OFFS);
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1133  				break;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1134  			}
b7e0bf341f6cfa Namhyung Kim              2013-11-25  1135  
533059281ee594 Masami Hiramatsu          2018-04-25  1136  			code->op = FETCH_OP_FOFFS;
533059281ee594 Masami Hiramatsu          2018-04-25  1137  			code->immediate = (unsigned long)offset;  // imm64?
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1138  		} else {
b079d374fd8463 Namhyung Kim              2013-07-03  1139  			/* uprobes don't support symbols */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1140) 			if (!(ctx->flags & TPARG_FL_KERNEL)) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1141) 				trace_probe_log_err(ctx->offset, SYM_ON_UPROBE);
b079d374fd8463 Namhyung Kim              2013-07-03  1142  				return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1143  			}
a6682814f37124 Masami Hiramatsu          2018-08-29  1144  			/* Preserve symbol for updating */
a6682814f37124 Masami Hiramatsu          2018-08-29  1145  			code->op = FETCH_NOP_SYMBOL;
a6682814f37124 Masami Hiramatsu          2018-08-29  1146  			code->data = kstrdup(arg + 1, GFP_KERNEL);
a6682814f37124 Masami Hiramatsu          2018-08-29  1147  			if (!code->data)
a6682814f37124 Masami Hiramatsu          2018-08-29  1148  				return -ENOMEM;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1149  			if (++code == end) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1150) 				trace_probe_log_err(ctx->offset, TOO_MANY_OPS);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1151  				return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1152  			}
533059281ee594 Masami Hiramatsu          2018-04-25  1153  			code->op = FETCH_OP_IMM;
a6682814f37124 Masami Hiramatsu          2018-08-29  1154  			code->immediate = 0;
533059281ee594 Masami Hiramatsu          2018-04-25  1155  		}
533059281ee594 Masami Hiramatsu          2018-04-25  1156  		/* These are fetching from memory */
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1157  		if (++code == end) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1158) 			trace_probe_log_err(ctx->offset, TOO_MANY_OPS);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1159  			return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1160  		}
533059281ee594 Masami Hiramatsu          2018-04-25  1161  		*pcode = code;
533059281ee594 Masami Hiramatsu          2018-04-25  1162  		code->op = FETCH_OP_DEREF;
533059281ee594 Masami Hiramatsu          2018-04-25  1163  		code->offset = offset;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1164  		break;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1165  
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1166  	case '+':	/* deref memory */
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1167  	case '-':
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1168  		if (arg[1] == 'u') {
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1169  			deref = FETCH_OP_UDEREF;
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1170  			arg[1] = arg[0];
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1171  			arg++;
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1172  		}
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1173  		if (arg[0] == '+')
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1174  			arg++;	/* Skip '+', because kstrtol() rejects it. */
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1175  		tmp = strchr(arg, '(');
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1176  		if (!tmp) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1177) 			trace_probe_log_err(ctx->offset, DEREF_NEED_BRACE);
533059281ee594 Masami Hiramatsu          2018-04-25  1178  			return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1179  		}
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1180  		*tmp = '\0';
bcd83ea6cbfee5 Daniel Walter             2012-09-26  1181  		ret = kstrtol(arg, 0, &offset);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1182  		if (ret) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1183) 			trace_probe_log_err(ctx->offset, BAD_DEREF_OFFS);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1184  			break;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1185  		}
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1186) 		ctx->offset += (tmp + 1 - arg) + (arg[0] != '-' ? 1 : 0);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1187  		arg = tmp + 1;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1188  		tmp = strrchr(arg, ')');
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1189  		if (!tmp) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1190) 			trace_probe_log_err(ctx->offset + strlen(arg),
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1191  					    DEREF_OPEN_BRACE);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1192  			return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1193  		} else {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1194) 			const struct fetch_type *t2 = find_fetch_type(NULL, ctx->flags);
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1195) 			int cur_offs = ctx->offset;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1196  
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1197  			*tmp = '\0';
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1198) 			ret = parse_probe_arg(arg, t2, &code, end, ctx);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1199  			if (ret)
533059281ee594 Masami Hiramatsu          2018-04-25  1200  				break;
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1201) 			ctx->offset = cur_offs;
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1202  			if (code->op == FETCH_OP_COMM ||
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1203  			    code->op == FETCH_OP_DATA) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1204) 				trace_probe_log_err(ctx->offset, COMM_CANT_DEREF);
533059281ee594 Masami Hiramatsu          2018-04-25  1205  				return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1206  			}
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1207  			if (++code == end) {
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1208) 				trace_probe_log_err(ctx->offset, TOO_MANY_OPS);
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1209  				return -EINVAL;
ab105a4fb89496 Masami Hiramatsu          2019-03-31  1210  			}
533059281ee594 Masami Hiramatsu          2018-04-25  1211  			*pcode = code;
533059281ee594 Masami Hiramatsu          2018-04-25  1212  
e65f7ae7f4da56 Masami Hiramatsu          2019-05-15  1213  			code->op = deref;
533059281ee594 Masami Hiramatsu          2018-04-25  1214  			code->offset = offset;
c440adfbe30257 Masami Hiramatsu (Google  2023-08-23  1215) 			/* Reset the last type if used */
c440adfbe30257 Masami Hiramatsu (Google  2023-08-23  1216) 			ctx->last_type = NULL;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1217  		}
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1218  		break;
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1219  	case '\\':	/* Immediate value */
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1220  		if (arg[1] == '"') {	/* Immediate string */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1221) 			ret = __parse_imm_string(arg + 2, &tmp, ctx->offset + 2);
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1222  			if (ret)
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1223  				break;
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1224  			code->op = FETCH_OP_DATA;
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1225  			code->data = tmp;
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1226  		} else {
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1227  			ret = str_to_immediate(arg + 1, &code->immediate);
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1228  			if (ret)
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1229) 				trace_probe_log_err(ctx->offset + 1, BAD_IMM);
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1230  			else
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1231  				code->op = FETCH_OP_IMM;
a42e3c4de9642d Masami Hiramatsu          2019-06-20  1232  		}
6218bf9f4d2942 Masami Hiramatsu          2019-06-20  1233  		break;
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1234) 	default:
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1235) 		if (isalpha(arg[0]) || arg[0] == '_') {	/* BTF variable */
25f00e40ce7953 Masami Hiramatsu (Google  2024-03-04  1236) 			if (!tparg_is_function_entry(ctx->flags) &&
25f00e40ce7953 Masami Hiramatsu (Google  2024-03-04  1237) 			    !tparg_is_function_return(ctx->flags)) {
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1238) 				trace_probe_log_err(ctx->offset, NOSUP_BTFARG);
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1239) 				return -EINVAL;
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1240) 			}
c440adfbe30257 Masami Hiramatsu (Google  2023-08-23  1241) 			ret = parse_btf_arg(arg, pcode, end, ctx);
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1242) 			break;
b576e09701c7d0 Masami Hiramatsu (Google  2023-06-06  1243) 		}
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1244  	}
533059281ee594 Masami Hiramatsu          2018-04-25  1245  	if (!ret && code->op == FETCH_OP_NOP) {
533059281ee594 Masami Hiramatsu          2018-04-25  1246  		/* Parsed, but do not find fetch method */
1b8b0cd754cdbb Masami Hiramatsu (Google  2023-06-06  1247) 		trace_probe_log_err(ctx->offset, BAD_FETCH_ARG);
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1248  		ret = -EINVAL;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1249  	}
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1250  	return ret;
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1251  }
8ab83f56475ec9 Srikar Dronamraju         2012-04-09  1252  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Masami Hiramatsu]

On Wed, 30 Jul 2025 14:27:08 +0800
kernel test robot <lkp@intel.com> wrote:

> Hi Steven,
> 
> kernel test robot noticed the following build errors:
> 
> [auto build test ERROR on trace/for-next]
> [also build test ERROR on lwn/docs-next akpm-mm/mm-everything linus/master v6.16 next-20250729]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Steven-Rostedt/tracing-Have-eprobes-have-their-own-config-option/20250730-001958
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace for-next
> patch link:    https://lore.kernel.org/r/20250729161912.056641407%40kernel.org
> patch subject: [PATCH v2 1/2] tracing: Have eprobes have their own config option
> config: xtensa-randconfig-002-20250730 (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/config)
> compiler: xtensa-linux-gcc (GCC) 12.5.0
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250730/202507301452.JPAcMvT0-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202507301452.JPAcMvT0-lkp@intel.com/
> 
> All errors (new ones prefixed by >>):
> 
>    kernel/trace/trace_probe.c: In function 'parse_probe_arg':
> >> kernel/trace/trace_probe.c:1105:23: error: implicit declaration of function 'regs_query_register_offset'; did you mean 'ftrace_regs_query_register_offset'? [-Werror=implicit-function-declaration]
>     1105 |                 ret = regs_query_register_offset(arg + 1);
>          |                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
>          |                       ftrace_regs_query_register_offset
>    cc1: some warnings being treated as errors


Interesting, this find another issue. Since this is provided by
CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending
on HAVE_REGS_AND_STACK_ACCESS_API.

diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index a3f35c7d83b6..cd239240b0ef 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -792,6 +792,7 @@ config DYNAMIC_EVENTS
        def_bool n
 
 config PROBE_EVENTS
+       depends on HAVE_REGS_AND_STACK_ACCESS_API
        def_bool n
 
 config BPF_KPROBE_OVERRIDE

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Steven Rostedt]

On Wed, 30 Jul 2025 19:11:01 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:

> Interesting, this find another issue. Since this is provided by
> CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending
> on HAVE_REGS_AND_STACK_ACCESS_API.
> 
> diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> index a3f35c7d83b6..cd239240b0ef 100644
> --- a/kernel/trace/Kconfig
> +++ b/kernel/trace/Kconfig
> @@ -792,6 +792,7 @@ config DYNAMIC_EVENTS
>         def_bool n
>  
>  config PROBE_EVENTS
> +       depends on HAVE_REGS_AND_STACK_ACCESS_API
>         def_bool n
>  
>  config BPF_KPROBE_OVERRIDE

OK, I'll send a v2.

Did you want to take this in the tracing pull request?

I see you already did the probe pull request.

-- Steve

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Masami Hiramatsu]

On Wed, 30 Jul 2025 09:17:27 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Wed, 30 Jul 2025 19:11:01 +0900
> Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:
> 
> > Interesting, this find another issue. Since this is provided by
> > CONFIG_PROBE_EVENTS, we need to fix CONFIG_PROBE_EVENTS depending
> > on HAVE_REGS_AND_STACK_ACCESS_API.
> > 
> > diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> > index a3f35c7d83b6..cd239240b0ef 100644
> > --- a/kernel/trace/Kconfig
> > +++ b/kernel/trace/Kconfig
> > @@ -792,6 +792,7 @@ config DYNAMIC_EVENTS
> >         def_bool n
> >  
> >  config PROBE_EVENTS
> > +       depends on HAVE_REGS_AND_STACK_ACCESS_API
> >         def_bool n
> >  
> >  config BPF_KPROBE_OVERRIDE
> 
> OK, I'll send a v2.
> 
> Did you want to take this in the tracing pull request?
> 
> I see you already did the probe pull request.

Ah, I thought this was for the next one... (but I think it is a kind of bugfix?)

Thank you,

> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Steven Rostedt]

On Wed, 30 Jul 2025 22:57:22 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:

> > I see you already did the probe pull request.  
> 
> Ah, I thought this was for the next one... (but I think it is a kind of bugfix?)

Yeah, as its not adding eprobes, but just making it configurable.

But you haven't answered my question ;-)

Do you want to push it to Linus or should I?

I still have the trace/for-next to push (I've finished testing your last
"attribute" patch and now I'm just letting it simmer in linux-next before
doing the pull request). I can still add this to that one if you want.

-- Steve

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Masami Hiramatsu]

On Wed, 30 Jul 2025 10:01:55 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Wed, 30 Jul 2025 22:57:22 +0900
> Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:
> 
> > > I see you already did the probe pull request.  
> > 
> > Ah, I thought this was for the next one... (but I think it is a kind of bugfix?)
> 
> Yeah, as its not adding eprobes, but just making it configurable.
> 
> But you haven't answered my question ;-)
> 
> Do you want to push it to Linus or should I?
> 
> I still have the trace/for-next to push (I've finished testing your last
> "attribute" patch and now I'm just letting it simmer in linux-next before
> doing the pull request). I can still add this to that one if you want.
> 

OK, could you push this to Linus?

Thanks,

> -- Steve
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 1/2] tracing: Have eprobes have their own config option

[Steven Rostedt]

On Thu, 31 Jul 2025 07:08:36 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:

> > I still have the trace/for-next to push (I've finished testing your last
> > "attribute" patch and now I'm just letting it simmer in linux-next before
> > doing the pull request). I can still add this to that one if you want.
> >   
> 
> OK, could you push this to Linus?

Will do later today.

Thanks,

-- Steve