> From: Masami Hiramatsu (Google) <[email protected]> > > Allow BTF typecast syntax (STRUCT)FETCHARG->MEMBER in wprobe event > fetchargs. Previously, handle_typecast() rejected any probe context > that was not a function entry/return or tracepoint event probe. > > Wprobe events use $addr (the accessed address) and $value (the value > at that address). By enabling BTF typecast, users can now cast these > to a concrete struct type and access its fields directly. For example: > > echo 'w:watch rw@0:8 dflag=(dentry)$addr->d_flags' >> dynamic_events > > With a set_wprobe trigger pointing the watchpoint at a dentry address, > the resulting trace shows d_flags being accessed at that location. > > Note that $addr and $value are restricted to kernel-space memory, > which is consistent with the existing TPARG_FL_KERNEL flag used when > parsing wprobe fetchargs. > > Assisted-by: Antigravity:gemini-3.5-flash > Signed-off-by: Masami Hiramatsu (Google) <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/178739053919.1520941.17662338993878200834.stgit@devnote2?part=11
