On Wed, 9 Jul 2025 13:11:07 -0400
Steven Rostedt <rost...@goodmis.org> wrote:
> On Tue, 8 Jul 2025 20:54:49 +0900
> "Masami Hiramatsu (Google)" <mhira...@kernel.org> wrote:
>
> > From: Masami Hiramatsu (Google) <mhira...@kernel.org>
> >
> > With CONFIG_DEBUG_INFO_BTF=y and PAHOLE_HAS_BTF_TAG=y, `__user` is
> > converted to `__attribute__((btf_type_tag("user")))`. In this case,
> > some syscall events have it for __user data, like below;
> >
> > /sys/kernel/tracing # cat events/syscalls/sys_enter_openat/format
> > name: sys_enter_openat
> > ID: 720
> > format:
> > field:unsigned short common_type; offset:0; size:2;
> > signed:0;
> > field:unsigned char common_flags; offset:2; size:1;
> > signed:0;
> > field:unsigned char common_preempt_count; offset:3;
> > size:1; signed:0;
> > field:int common_pid; offset:4; size:4; signed:1;
> >
> > field:int __syscall_nr; offset:8; size:4; signed:1;
> > field:int dfd; offset:16; size:8; signed:0;
> > field:const char __attribute__((btf_type_tag("user"))) * filename;
> > offset:24; size:8; signed:0;
> > field:int flags; offset:32; size:8; signed:0;
> > field:umode_t mode; offset:40; size:8; signed:0;
> >
> > .
> > Then the trace event filter fails to set the string acceptable flag
> > (FILTER_PTR_STRING) to the field and rejects setting string filter;
> >
> > # echo 'filename.ustring ~ "*ftracetest-dir.wbx24v*"' \
> > >> events/syscalls/sys_enter_openat/filter
> > sh: write error: Invalid argument
> > # cat error_log
> > [ 723.743637] event filter parse error: error: Expecting numeric field
> > Command: filename.ustring ~ "*ftracetest-dir.wbx24v*"
> >
> > Since this __attribute__ makes format parsing complicated and not
> > needed, remove the __attribute__(.*) from the type string.
>
> Actually, you can do this in update_event_fields() that already does
> this magic for enums as the field length.
I investigated this but it is not possible to use update_event_fields()
because that function is only used if the
CONFIG_TRACE_EVAL_MAP_FILE=y.
But since update_event_fields() can replace the allocated
field->type, we need a special care for that case too.
E.g. if update_event_fields() finds field->alloc_type set,
it will reuse field->type instead of allocate new string.
Let me fix that. At lease we need to fold these 2 patches
into one.
Thank you,
>
> And it doesn't free after allocation because it only does the
> allocation for events that will never be freed. For modules, it
> registers the allocated string so it will be freed on unload.
>
> -- Steve
--
Masami Hiramatsu (Google) <mhira...@kernel.org>
