Hi, Here is version 3 series of patches to support accessing function entry data from function *return* probes (including kretprobe and fprobe-exit event). The previous version is here; https://lore.kernel.org/all/170891987362.609861.6767830614537418260.stgit@devnote2/ In this version, [1/8] is a bugfix patch (but note that this is already pushed to probes-fixes-v6.8-rc5, just for reference), updated [4/8] changelog and build error, fixes selftests error [6/8], update document[8/8] and added Steve's reviewed-by. This allows us to access the results of some functions, which returns the error code and its results are passed via function parameter, such as an structure-initialization function. For example, vfs_open() will link the file structure to the inode and update mode. Thus we can trace that changes. # echo 'f vfs_open mode=file->f_mode:x32 inode=file->f_inode:x64' >> dynamic_events # echo 'f vfs_open%return mode=file->f_mode:x32 inode=file->f_inode:x64' >> dynamic_events # echo 1 > events/fprobes/enable # cat trace sh-131 [006] ...1. 1945.714346: vfs_open__entry: (vfs_open+0x4/0x40) mode=0x2 inode=0x0 sh-131 [006] ...1. 1945.714358: vfs_open__exit: (do_open+0x274/0x3d0 <- vfs_open) mode=0x4d801e inode=0xffff888008470168 cat-143 [007] ...1. 1945.717949: vfs_open__entry: (vfs_open+0x4/0x40) mode=0x1 inode=0x0 cat-143 [007] ...1. 1945.717956: vfs_open__exit: (do_open+0x274/0x3d0 <- vfs_open) mode=0x4a801d inode=0xffff888005f78d28 cat-143 [007] ...1. 1945.720616: vfs_open__entry: (vfs_open+0x4/0x40) mode=0x1 inode=0x0 cat-143 [007] ...1. 1945.728263: vfs_open__exit: (do_open+0x274/0x3d0 <- vfs_open) mode=0xa800d inode=0xffff888004ada8d8 So as you can see those fields are initialized at exit. This series is based on v6.8-rc5 kernel or you can checkout from https://git.kernel.org/pub/scm/linux/kernel/git/mhiramat/linux.git/log/?h=topic/entry-data Thank you, --- Masami Hiramatsu (Google) (8): fprobe: Fix to allocate entry_data_size buffer with rethook instances tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event tracing/probes: Cleanup probe argument parser tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init tracing: Remove redundant #else block for BTF args from README tracing/probes: Support $argN in return probe (kprobe and fprobe) selftests/ftrace: Add test cases for entry args at function exit Documentation: tracing: Add entry argument access at function exit Documentation/trace/fprobetrace.rst | 31 + Documentation/trace/kprobetrace.rst | 9 kernel/trace/fprobe.c | 14 - kernel/trace/trace.c | 5 kernel/trace/trace_eprobe.c | 8 kernel/trace/trace_fprobe.c | 59 ++- kernel/trace/trace_kprobe.c | 58 ++- kernel/trace/trace_probe.c | 417 ++++++++++++++------ kernel/trace/trace_probe.h | 30 + kernel/trace/trace_probe_tmpl.h | 10 kernel/trace/trace_uprobe.c | 14 - .../ftrace/test.d/dynevent/fprobe_entry_arg.tc | 18 + .../ftrace/test.d/dynevent/fprobe_syntax_errors.tc | 4 .../ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 2 .../ftrace/test.d/kprobe/kretprobe_entry_arg.tc | 18 + 15 files changed, 521 insertions(+), 176 deletions(-) create mode 100644 tools/testing/selftests/ftrace/test.d/dynevent/fprobe_entry_arg.tc create mode 100644 tools/testing/selftests/ftrace/test.d/kprobe/kretprobe_entry_arg.tc -- Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
