On 9/14/25 7:10 AM, Masami Hiramatsu (Google) wrote:
> From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
>
> Add wprobe event trigger to set and clear the watch event dynamically.
> This allows us to set an watchpoint on a given local variables and
> a slab object instead of static objects.
>
> The trigger syntax is below;
below:
(just a nit :)
>
> - set_wprobe:WPROBE:FIELD[+OFFSET] [if FILTER]
> - clear_wprobe:WPROBE[:FIELD[+OFFSET]] [if FILTER]
>
> set_wprobe sets the address pointed by FIELD[+offset] to the WPROBE
> event. The FIELD is the field name of trigger event.
> clear_wprobe clears the watch address of WPROBE event. If the FIELD
> option is specified, it clears only if the current watch address is
> same as the given FIELD[+OFFSET] value.
>
> The set_wprobe trigger do not change type and length. That should be
does should be done
?
> set when a new wprobe is created.
>
> Also, the WPROBE event must be disabled when setting the new trigger
> and it will be busy afterwards. Recommended usage is to add a new
> wprobe at NULL address and keep disabled.
>
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
> ---
> Changes in v3:
> - Add FIELD option support for clear_wprobe and update document.
> - Fix to unregister/free event_trigger_data on file correctly.
> - Fix syntax comments.
> Changes in v2:
> - Getting local cpu perf_event from trace_wprobe directly.
> - Remove trace_wprobe_local_perf() because it is conditionally unused.
> - Make CONFIG_WPROBE_TRIGGERS a hidden config.
> ---
> Documentation/trace/wprobetrace.rst | 88 +++++++
> include/linux/trace_events.h | 1
> kernel/trace/Kconfig | 10 +
> kernel/trace/trace_wprobe.c | 430 +++++++++++++++++++++++++++++++++++
> 4 files changed, 529 insertions(+)
>
> diff --git a/Documentation/trace/wprobetrace.rst b/Documentation/trace/wprobetrace.rst
> index 9774f57e2947..a1812a8ac491 100644
> --- a/Documentation/trace/wprobetrace.rst
> +++ b/Documentation/trace/wprobetrace.rst
> @@ -67,3 +67,91 @@ Here is an example to add a wprobe event on a variable `jiffies`.
> <idle>-0 [000] d.Z1. 717.026373: my_jiffies: (tick_do_update_jiffies64+0xbe/0x130)
>
> You can see the code which writes to `jiffies` is `do_timer()`.
> +
> +Combination with trigger action
> +-------------------------------
> +The event trigger action can extend the utilization of this wprobe.
> +
> +- set_wprobe:WPEVENT:FIELD[+|-ADJUST]
> +- clear_wprobe:WPEVENT[:FIELD[+|-]ADJUST]
> +
> +Set these triggers to the target event, then the WPROBE event will be
> +setup to trace the memory access at FIELD[+|-ADJUST] address.
> +When clear_wprobe is hit, if FIELD is NOT specified, the WPEVENT is
> +forcibly cleared. If FIELD[[+|-]ADJUST] is set, it clears WPEVENT only
> +if its watching address is the same as the FIELD[[+|-]ADJUST] value.
> +
> +Notes:
> +The set_wprobe trigger do not change type and length. That should be
does not should be done
> +set when a new wprobe is created.
> +
> +The WPROBE event must be disabled when setting the new trigger
> +and it will be busy afterwards. Recommended usage is to add a new
> +wprobe at NULL address and keep disabled.
> +
> +
> +For example, trace the first 8 byte of the dentry data structure passed
bytes
> +to do_truncate() until it is deleted by __dentry_kill().
> +(Note: all tracefs setup uses '>>' so that it does not kick do_truncate())
> +
> + # echo 'w:watch rw@0:8 address=$addr value=+0($addr)' > dynamic_events
Just using '>' here is OK?
> +
> + # echo 'f:truncate do_truncate dentry=$arg2' >> dynamic_events
> + # echo 'set_wprobe:watch:dentry' >> events/fprobes/truncate/trigger
> +
> + # echo 'f:dentry_kill __dentry_kill dentry=$arg1' >> dynamic_events
> + # echo 'clear_wprobe:watch:dentry' >> events/fprobes/dentry_kill/trigger
> +
> + # echo 1 >> events/fprobes/truncate/enable
> + # echo 1 >> events/fprobes/dentry_kill/enable
> +
> + # echo aaa > /tmp/hoge
> + # echo bbb > /tmp/hoge
> + # echo ccc > /tmp/hoge
> + # rm /tmp/hoge
> +
> +Then, the trace data will show;
Usually that should be: show:
but in .rst it might need to be show::
I don't know. Haven't tested it.
--
~Randy
