Re: [PATCH v11 04/11] tracing: wprobe: Add watchpoint probe event based on hardware breakpoint

On 8/6/2026 8:06 AM, Masami Hiramatsu (Google) wrote:

On Tue, 4 Aug 2026 01:08:40 +0200
Peter Zijlstra [off-list ref] wrote:

quoted

On Tue, Aug 04, 2026 at 08:00:35AM +0900, Masami Hiramatsu wrote:

quoted

On Mon, 3 Aug 2026 09:03:56 +0200
Peter Zijlstra [off-list ref] wrote:

quoted

On Sun, Aug 02, 2026 at 05:19:10PM +0900, Masami Hiramatsu (Google) wrote:

quoted

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Add a new probe event for the hardware breakpoint called wprobe-event.
This wprobe allows user to trace (watch) the memory access at the
specified memory address.

s/the memory/the kernel memory/

Indeed.

quoted

quoted

The new syntax is;

 w[:[GROUP/]EVENT] [r|w|rw]@[ADDR|SYM][:SIZE] [FETCH_ARGs]

User also can use $addr to fetch the accessed address and $value to fetch
the accessed memory value (shorthand for '+0($addr)'). No other variables
are supported.

This seems limited to kernel addresses only? Should not also userspace
addresses be supported?

Hmm, for x86, yes, since it causes a trap after executing (all page fault
are handled). But other architecture like arm64 may not be able to support
it because it needs to enable watchpoint after major page fault.
At this step, I would like to limit it just for kernel memory.

Sure, but suppose you were to add userspace, what would the ABI be?

Ahh, sorry. It was misreading, I mean it should be only for the kernel address,
not for user space. So I don't want to add userspace. (I answered the first one)

Thank you,

Keeping wprobe limited to kernel addresses makes sense to me.
Userspace watchpoints are already supported by the perf hardware-breakpoint API,
and supporting them in wprobe would add unnecessary complexity.

An explicit address check could also make this boundary clear.

quoted

That is, don't paint yourself in a corner etc.