Re: [PATCH] tracing: Have eprobes handle arrays

[Steven Rostedt <rostedt@goodmis.org>]

On Wed, 23 Jul 2025 12:42:02 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

>  [
>    Create an eprobe called "sys" and attach it to sys_enter.
>    Read the id of the system call and the second argument
>  ]
>  # echo 'e:sys raw_syscalls.sys_enter nr=$id:u32 arg2+8($args):u64' >> /sys/kernel/tracing/dynamic_events

The above has a typo. I originally had it as "filename=+8($args):u64"
but decided to change it to "arg2" as its attached to the generic raw
syscall. But in the process, I accidentally deleted the "=". So the
above should be:

 # echo 'e:sys raw_syscalls.sys_enter nr=$id:u32 arg2=+8($args):u64' >> /sys/kernel/tracing/dynamic_events


> 
>  [
>    Create a synthetic event "path" that will hold the address of the
>    sys_openat filename. This is on a 64bit machine, so make it 64 bits
>  ]
>  # echo 's:path u64 file;' >> /sys/kernel/tracing/dynamic_events
> 
>  [
>    Add a histogram to the eprobe/sys which tiggers if the "nr" field is
>    257 (sys_openat), and save the filename in the "file" variable.
>  ]
>  # echo 'hist:keys=common_pid:file=filename if nr == 257' > /sys/kernel/tracing/events/eprobes/sys/trigger

And I forgot to update this, as it's not "filename" any more, but
"arg2". So this needs to be:

 # echo 'hist:keys=common_pid:file=arg2 if nr == 257' > /sys/kernel/tracing/events/eprobes/sys/trigger

-- Steve