From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F3A53DE43D for ; Wed, 27 May 2026 08:59:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779872348; cv=none; b=VjiZ9Mh2xSQkoWgxbrr5x0AWk259CuMyCttkwviLzZFw+We+QKH/CNyqrar3CCEPEIFNtuRgkgX3k8SwHAbXKd3W0LYJp4yGuW92CMlH0Mf8iE3Z9npsQd6aQnkeGMJf3XkdeXpqs7U/kQ4yumKyPABSL89sLaw+o/zH4F+vpzA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779872348; c=relaxed/simple; bh=6OBZoCSq1eBzVuZoO5mnx5tqo/HNYIF/juzQ4/NPuwc=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=HUMFK+TsGtNz0nIwz1qOexpyAR7kNZprNxSIDG3PZTSfqD+DHPp6+WwmvsAzFyc7zhEfV5iv4+PDrZF9BXGBuN/jyby97s66e/OvRpkaXfN+VarmYJQSn6SY0ewdQ787O/XL3UwaaNkKbnav0A9AIvXhYEESaoPFZGEcrDcN6so= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=E+KMAX2v; arc=none smtp.client-ip=209.85.221.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="E+KMAX2v" Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-45edc09f51bso260435f8f.0 for ; Wed, 27 May 2026 01:59:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779872345; x=1780477145; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=Ke8JjnRD7ShO76lQpq1z4WWUNsFFn+xm7G1XcSMQ0cw=; b=E+KMAX2v5sKs5cep0V+VuGDCGxBWErurA1gYkP+iL9AqGTkOXtBDB5eNaM4aqh10jf TsMuZThenRv9SJZ0dR25q1C5hw5vWdA29yYXc3km9o12msU13GrTYv3mYvXZIBsfT+QX D3DF9P88ReRHSAmXJMOrpcHx7OWXNvjzsw1TJMMvw5k8ZtI62TdL1cvs4WsZL81bRqCR oYljgZ0bOCN6IEnMfNygmN2d3PUL840zIsFvZHfRxhYgji9JMttXx5tUnoj14+5zxaB5 W4ZVZTpVs3hGutkqEcrFJdUdLNOW3FaGY6ipVKkF1LZ6wHQdPcAVSBtL4j1V0v1WaXvS ri/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779872345; x=1780477145; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Ke8JjnRD7ShO76lQpq1z4WWUNsFFn+xm7G1XcSMQ0cw=; b=S0+cTCnLIaWxLcipLe3qY5/58gsEApKBHwrnayYkp0TQIh0QRLb54rCRYh4EjvWPT8 Uz0BD6JqH1Ql2wMhNXK+ZgF8Vzd52icZE8ntvY/C1RxWICXJeM3VvlRLDRg1Ne+rqCW9 gUArglL7F8BKhH/pec/ZsUAbXOQ+Kv6jKiGRBwxS6ddRubiraFyWAY67EKuImks/pcoP uIYgNpX/Vq3czs22f+06XSPSAcfjBFCFGkU+DOIDwOekvu/YovBozkXS7QDYwIkh5DMq tTiXE6yWjWU6klp4/6sDPpmIE3KDGgDiNoI7BDa+R83XIPXxtFJ+8t7XTVz/BOGTmTUT b7Rg== X-Gm-Message-State: AOJu0YwDlxqkLPGFNAESR4ABUHN0LBif8Qd9dw8DjwYGPGYmgrRn18yV Tk3UFoxlw5KtIBHOHSvlDITQBVrgxsl4/DhJ90dVE88qkvB6pz8mvTwT X-Gm-Gg: Acq92OEzB5pBvVuJavtrUtWJfDpk72u3F5s9CZJzSdYhv2vOxZfO6NRofEArTSUZquX wcSe0rpbp50R4jVG7gyaAb+SMPg7TKM4xRw7gtXH8XspCwzTQRvGTTGh6Iive3/nPnGZ4WiNskL 7rI6gPrNVsDPzvPVHyCuB71QyKfv8pso8aMBQ6R6nQ65DtkBor63Y+/so53+luTZsumFls4lG5n vbylfIDs1M0B8M3sRCsBcqnlnSxVOgyCsNpQ7C6WhXWAQxHipaoVAlPYnZMv5eX34hh0Hhy4/YS Q66z/DCoapnBtNORg0W9KWCSW7YMQuWNPOZzJlCI6mFxmt7BLA53n8Kbgz9u6KWVVFCi5MEQzAx eROSGriQ2V8/k49Z9hjYdLvIxaaZDmzfBSNzM1kXdOYxnjvpm4WzoNmBMV4lKBu7+6IXBkNrjvF tPO2EytudlCPCsWSB5riCCucLzTM2U4wMnASsh X-Received: by 2002:a05:6000:41c9:b0:45d:4a00:b927 with SMTP id ffacd0b85a97d-45eb38a1840mr37164038f8f.31.1779872344742; Wed, 27 May 2026 01:59:04 -0700 (PDT) Received: from krava ([2a02:8308:a00c:e200:b655:ff13:e355:16a3]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45edb5b314dsm4052782f8f.30.2026.05.27.01.59.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 May 2026 01:59:04 -0700 (PDT) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Wed, 27 May 2026 10:59:02 +0200 To: Steven Rostedt Cc: LKML , Linux trace kernel , Masami Hiramatsu , Mathieu Desnoyers , Mark Rutland , Peter Zijlstra , Namhyung Kim , Takaya Saeki , Douglas Raillard , Tom Zanussi , Andrew Morton , Thomas Gleixner , Ian Rogers , Jiri Olsa Subject: Re: [PATCH v6] tracing/eprobes: Allow use of BTF names to dereference pointers Message-ID: References: <20260521225033.56458336@fedora> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260521225033.56458336@fedora> On Thu, May 21, 2026 at 10:50:33PM -0400, Steven Rostedt wrote: > From: Steven Rostedt > > Add syntax to the parsing of eprobes to be able to typecast a trace event > field that is a pointer to a structure. > > Currently, a dereference must be a number, where the user has to figure > out manually the offset of a member of a structure that they want to > dereference. > > But for event probes that records a field that happens to be a pointer to > a structure, it cannot dereference these values with BTF naming, but > must use numerical offsets. > > For example, to find out what device a sk_buff is pointing to in the > net_dev_xmit trace event, one must first use gdb to find the offsets of the > members of the structures: > > (gdb) p &((struct sk_buff *)0)->dev > $1 = (struct net_device **) 0x10 > (gdb) p &((struct net_device *)0)->name > $2 = (char (*)[16]) 0x118 > > And then use the raw numbers to dereference: > > # echo 'e:xmit net.net_dev_xmit +0x118(+0x10($skbaddr)):string' >> dynamic_events > > If BTF is in the kernel, then instead, the skbaddr can be typecast to > sk_buff and use the normal dereference logic. > > # echo 'e:xmit net.net_dev_xmit (sk_buff)skbaddr->dev->name:string' >> dynamic_events > # echo 1 > events/eprobes/xmit/enable > # cat trace > [..] > sshd-session-1022 [000] b..2. 860.249343: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.250061: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.250142: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.263553: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.283820: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.302716: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.322905: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.342828: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.362268: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.382335: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.400856: xmit: (net.net_dev_xmit) arg1="enp7s0" > sshd-session-1022 [000] b..2. 860.419893: xmit: (net.net_dev_xmit) arg1="enp7s0" > > The syntax is simply: (STRUCT)(FIELD)->MEMBER[->MEMBER..] > > Also add comments around the #else and #endif of #ifdef CONFIG_PROBE_EVENTS_BTF_ARGS > to know what they are for. hi, this seems to be supported only for argument (pointer) stored in the trace record, not the actual arguments to the tracepoint, is that right? so I can deref worker from sched.sched_kthread_work_queue_work, like: echo 'e:myprobe sched.sched_kthread_work_queue_work (kthread_worker)worker->flags (kthread_work)work->canceling' > dynamic_events but I can't deref sched.sched_process_exec p->pid, like: # echo 'e:myprobe sched.sched_process_exec (task_struct)p->pid' > dynamic_events bash: echo: write error: Invalid argument SNIP > +static int handle_typecast(char *arg, struct fetch_insn **pcode, > + struct fetch_insn *end, > + struct traceprobe_parse_context *ctx) > +{ > + char *tmp; > + int ret; > + > + /* Currently this only works for eprobes */ > + if (!(ctx->flags & TPARG_FL_TEVENT)) { > + trace_probe_log_err(ctx->offset, TYPECAST_NOT_EVENT); > + return -EINVAL; > + } > + > + tmp = strchr(arg, ')'); > + if (!tmp) { > + trace_probe_log_err(ctx->offset + strlen(arg), > + DEREF_OPEN_BRACE); > + return -EINVAL; > + } > + *tmp = '\0'; > + ret = query_btf_struct(arg + 1, ctx); > + *tmp = ')'; > + > + if (ret < 0) { > + trace_probe_log_err(ctx->offset + 1, NO_PTR_STRCT); > + ret = -EINVAL; > + goto out_put; > + } > + > + ctx->flags |= TPARG_FL_TYPECAST; > + tmp++; > + > + ctx->offset += tmp - arg; > + ret = parse_btf_arg(tmp, pcode, end, ctx); > + ctx->flags &= ~TPARG_FL_TYPECAST; > + ctx->last_struct = NULL; > +out_put: > + btf_put(ctx->struct_btf); should we zero ctx->struct_btf in case there's more type casts, so query_btf_struct would re-init it? jirka