On Wed, 27 May 2026 10:59:02 +0200
Jiri Olsa <[email protected]> wrote:
>
> hi,
> this seems to be supported only for argument (pointer) stored in the trace
> record,
> not the actual arguments to the tracepoint, is that right?
>
> so I can deref worker from sched.sched_kthread_work_queue_work, like:
>
> echo 'e:myprobe sched.sched_kthread_work_queue_work
> (kthread_worker)worker->flags (kthread_work)work->canceling' > dynamic_events
Correct, that is because eprobes "e:" works on the output of a trace event.
>
> but I can't deref sched.sched_process_exec p->pid, like:
>
> # echo 'e:myprobe sched.sched_process_exec (task_struct)p->pid' >
> dynamic_events
> bash: echo: write error: Invalid argument
For function prototypes of a tracepoint, you would use a tprobe "t:"
# echo 't:exec sched_process_exec pid=p->pid' > dynamic_events
# echo 1 > events/tracepoints/exec/enable
# cat trace
# tracer: nop
#
# entries-in-buffer/entries-written: 7/7 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
rtkit-daemon-1935 [005] ..... 105.350235: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1935
rtkit-daemon-1935 [005] ..... 105.376609: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1935
pkla-check-auth-1939 [000] ..... 105.404491: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1939
at-spi-bus-laun-1953 [000] ..... 105.914139: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1953
dbus-daemon-1959 [002] ..... 105.919123: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1959
Xwayland-1961 [006] ..... 106.175491: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1961
<...>-1962 [005] ..... 107.406472: exec:
(__probestub_sched_process_exec+0x4/0x10) pid=1962
No need for typecasting either ;-)
> > + ctx->offset += tmp - arg;
> > + ret = parse_btf_arg(tmp, pcode, end, ctx);
> > + ctx->flags &= ~TPARG_FL_TYPECAST;
> > + ctx->last_struct = NULL;
> > +out_put:
> > + btf_put(ctx->struct_btf);
>
>
> should we zero ctx->struct_btf in case there's more type casts,
> so query_btf_struct would re-init it?
Yeah, I already mentioned that mistake:
https://lore.kernel.org/all/[email protected]/
>> Oops, I forgot to do:
>>
>> ctx->struct_buf = NULL;
>>
>> here.
>>
>> Will fix.
Thanks for the review!
-- Steve
