[PATCH v9 10/10] tracing/wprobe: Support BTF typecast in fetchargs
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Date: 2026-07-17 14:21:33
Also in:
linux-doc, linux-perf-users, lkml
Subsystem:
kernel selftest framework, the rest, tracing · Maintainers:
Shuah Khan, Linus Torvalds, Steven Rostedt, Masami Hiramatsu
From: Masami Hiramatsu (Google) <mhiramat@kernel.org> Allow BTF typecast syntax (STRUCT)FETCHARG->MEMBER in wprobe event fetchargs. Previously, handle_typecast() rejected any probe context that was not a function entry/return or tracepoint event probe. Wprobe events use (the accessed address) and (the value at that address). By enabling BTF typecast, users can now cast these to a concrete struct type and access its fields directly. For example: echo 'w:watch rw@0:8 dflag=(struct dentry)$addr->d_flags' >> dynamic_events With a set_wprobe trigger pointing the watchpoint at a dentry address, the resulting trace shows d_flags being accessed at that location. Note that and are restricted to kernel-space memory, which is consistent with the existing TPARG_FL_KERNEL flag used when parsing wprobe fetchargs. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> --- Changes in v9: - Newly added. --- kernel/trace/trace_probe.c | 3 + kernel/trace/trace_probe.h | 5 + .../test.d/trigger/trigger-wprobe-btf-typecast.tc | 80 ++++++++++++++++++++ 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/trigger-wprobe-btf-typecast.tc
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 5d5e9b477b86..8332ff1bb4ff 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c@@ -967,7 +967,8 @@ static int handle_typecast(char *arg, struct traceprobe_parse_context *ctx) if (!(tparg_is_event_probe(ctx->flags) || tparg_is_function_entry(ctx->flags) || - tparg_is_function_return(ctx->flags))) { + tparg_is_function_return(ctx->flags) || + tparg_is_wprobe(ctx->flags))) { trace_probe_log_err(ctx->offset, NOSUP_BTFARG); return -EOPNOTSUPP; }
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 7380502a85af..0a83b3fb6128 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h@@ -439,6 +439,11 @@ static inline bool tparg_is_event_probe(unsigned int flags) return !!(flags & TPARG_FL_TEVENT); } +static inline bool tparg_is_wprobe(unsigned int flags) +{ + return !!(flags & TPARG_FL_WPROBE); +} + /* Each typecast consumes nested level. So the max number of typecast is 8. */ #define TRACEPROBE_MAX_NESTED_LEVEL 8
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/trigger-wprobe-btf-typecast.tc b/tools/testing/selftests/ftrace/test.d/trigger/trigger-wprobe-btf-typecast.tc
new file mode 100644
index 000000000000..8962c91d8428
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/trigger-wprobe-btf-typecast.tc@@ -0,0 +1,80 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +# description: event trigger - test wprobe trigger with BTF typecast fetchargs +# requires: dynamic_events "w[:[<group>/][<event>]] [r|w|rw]@<addr>[:<len>]":README events/sched/sched_process_fork/trigger "[(structname[,field])]<argname>[->field[->field|.field...]]":README + +echo 0 >> tracing_on + +rm -f $TMPDIR/hoge + +# we will skip this test if fprobe is not supported. +if ! grep -Fq "f[:[<group>/][<event>]] <func-name>[%return] [<args>]" README; then + echo "UNRESOLVED: fprobe is not supported" + exit_unresolved +fi + +# we will skip this test if the target function does not exist. +if ! grep -wq "do_truncate" /proc/kallsyms; then + echo "UNRESOLVED: do_truncate not found" + exit_unresolved +fi +if ! grep -wq "dentry_kill" /proc/kallsyms; then + echo "UNRESOLVED: dentry_kill not found" + exit_unresolved +fi + +:;: "Add a wprobe event with BTF typecast fetchargs" ;: +# $addr is the address being accessed (= dentry pointer when watching dentry) +# (dentry)$addr->d_flags reads d_flags from the dentry struct via BTF typecast +# Note: BTF typecast uses (STRUCT) without the 'struct' keyword, matching +# the fetcharg syntax used in fprobe/tprobe events. +echo 'w:watch rw@0:8 address=$addr dflag=(dentry)$addr->d_flags' >> dynamic_events + +:;: "Check the wprobe event is registered with dflag field" ;: +grep -q "dflag" dynamic_events + +:;: "Add events for triggering wprobe" ;: +echo 'f:truncate do_truncate dentry=$arg2' >> dynamic_events +echo 'f:dentry_kill dentry_kill dentry=$arg1' >> dynamic_events + +:;: "Add wprobe triggers" ;: +echo 'set_wprobe:watch:dentry' >> events/fprobes/truncate/trigger +echo 'clear_wprobe:watch:dentry' >> events/fprobes/dentry_kill/trigger +cat events/fprobes/truncate/trigger | grep ^set_wprobe +cat events/fprobes/dentry_kill/trigger | grep ^clear_wprobe + +:;: "Ensure wprobe is still disabled" ;: +cat events/wprobes/watch/enable | grep 0 + +:;: "Enable events for triggers" ;: +echo 1 >> events/fprobes/truncate/enable +echo 1 >> events/fprobes/dentry_kill/enable + +:;: "Start test workload" ;: +echo 1 >> tracing_on + +echo aaa > $TMPDIR/hoge +sleep 1 +echo bbb > $TMPDIR/hoge +sleep 1 +echo ccc > $TMPDIR/hoge +sleep 1 +rm $TMPDIR/hoge + +:;: "Drop dentry caches (for dentry_kill)" ;: +sync && echo 2 >> /proc/sys/vm/drop_caches + +:;: "Check trace results include BTF typecast field dflag" ;: +cat trace > /tmp/test-trace-typecast.log +cat trace | grep "watch.*dflag=" + +:;: "Ensure wprobe becomes disabled again" ;: +cat events/wprobes/watch/enable | grep 0 + +:;: "Remove wprobe triggers" ;: +echo '!set_wprobe:watch:dentry' >> events/fprobes/truncate/trigger +echo '!clear_wprobe:watch' >> events/fprobes/dentry_kill/trigger +! grep ^set_wprobe events/fprobes/truncate/trigger +! grep ^clear_wprobe events/fprobes/dentry_kill/trigger + +exit 0