__kprobe_event_add_fields(9)

💅 __kprobe_event_add_fields(9) 💅

okay so bestie, this is a page from the Kernel API Manual (section 9), and it's all about the function __kprobe_event_add_fields ✨ — no cap, it's the helper that adds probe fields to a kprobe command from an arg list. Let's get into it 🫶

---

🌸 NAME 🌸

__kprobe_event_add_fields — add probe fields to a kprobe command from arg list 💖

---

🎀 SYNOPSIS 🎀

int __kprobe_event_add_fields (struct dynevent_cmd *cmd , ... );

---

🦋 ARGUMENTS 🦋

• cmd — a pointer to the dynevent_cmd struct representing the new event. literally the main character of this call 💅
• ... — Variable number of arg (pairs), one pair for each field. yes bestie, pairs — one per field 🎀

---

💅 NOTE 💅

okay so listen 👑 — users normally won't want to call this function directly. Instead, use the kprobe_event_add_fields wrapper, because it automatically adds a NULL to the end of the arg list. easy peasy, no extra manual NULL-ing 🌸

but if you do use this function directly, make sure the last arg in the variable arg list is NULL. not optional, bestie — fr fr 🙈

This function adds probe fields to an existing kprobe command using a variable list of args. Fields are added in the same order they're listed. so the order you write them? that's the order you get. iconic 💖

---

💖 RETURN 💖

0 if successful, error otherwise. that's it, that's the whole vibe check ⭐

---

🌈 SEE ALSO 🌈

• Kernel file ./kernel/trace/trace_kprobe.c — go look at for_each_trace_kprobe(9), kprobe_event_cmd_init(9), __kprobe_event_gen_cmd_start(9), and kprobe_event_delete(9) 🦋

---

mwah 💋 — this cutie comes from ./kernel/trace, dated October 2026, and it's all about __kprobe_event_add_fields(9). slay 🎀