* [PATCH v1 01/13] perf trace: Start BPF summary before starting workload
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 02/13] perf trace: Skip internal tracepoint fields in formatting and beauty map Ian Rogers
` (12 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
When using --bpf-summary, trace_start_bpf_summary() sets
skel->bss->enabled = 1. In trace__run(), trace_start_bpf_summary() was
previously invoked after evlist__start_workload().
Because evlist__start_workload() immediately unblocks the child process
by writing to its go_pipe, short-lived workloads (such as `cat /dev/null`)
can execute and complete their initial system calls before
trace_start_bpf_summary() is reached by the parent process. Furthermore,
under high system load, the child process may finish before the BPF
summary tracking is enabled in the kernel at all, causing syscall
summary tests to fail. Additionally, if initial_delay was configured,
the workload was started before sleeping.
Move trace_start_bpf_summary() to be invoked before
evlist__start_workload(), matching evlist__enable(), and ensure it
respects target.initial_delay.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 20fffc24507b..8da0c51ec380 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -4838,17 +4838,19 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
if (!target__none(&trace->opts.target) && !trace->opts.target.initial_delay)
evlist__enable(evlist);
+ if (trace->summary_bpf && !trace->opts.target.initial_delay)
+ trace_start_bpf_summary();
+
if (forks)
evlist__start_workload(evlist);
if (trace->opts.target.initial_delay) {
usleep(trace->opts.target.initial_delay * 1000);
evlist__enable(evlist);
+ if (trace->summary_bpf)
+ trace_start_bpf_summary();
}
- if (trace->summary_bpf)
- trace_start_bpf_summary();
-
trace->multiple_threads = perf_thread_map__pid(evlist__core(evlist)->threads, 0) == -1 ||
perf_thread_map__nr(evlist__core(evlist)->threads) > 1 ||
evlist__first(evlist)->core.attr.inherit;
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 02/13] perf trace: Skip internal tracepoint fields in formatting and beauty map
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
2026-09-17 6:42 ` [PATCH v1 01/13] perf trace: Start BPF summary before starting workload Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 03/13] perf trace: Do not set unaugmented BPF program on sys_exit map Ian Rogers
` (11 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
Linux 6.19+ added __data_loc char[] internal fields for string
arguments in syscalls:sys_enter_<name> tracepoints (e.g.,
__data_loc_oldname in sys_enter_renameat2). While is_internal_field()
was added to detect them, several places did not properly account for
them:
1. In syscall_arg_fmt__init_array(), when an internal field was
skipped, the arg pointer was still incremented, causing the
subsequent argument formatters to be mismatched.
2. In syscall__scnprintf_args(), internal fields were not skipped,
causing spurious trailing arguments like ", 0, 16" to be formatted
and printed.
3. In trace__bpf_sys_enter_beauty_map(), internal fields were not
skipped, offsetting beauty array argument indices and breaking string
and buffer augmentation.
4. In trace__find_usable_bpf_prog_entry(), candidate pointer checks
matched on internal pointer fields, breaking signature compatibility
matching between syscalls for augmenter sharing. Introduce
next_user_arg() and advance both cursors with it, so that the two
argument lists are always compared at a real argument and the walk
ends when one syscall runs out of arguments rather than when one
happens to have trailing internal fields.
5. syscall__augmented_args() computed the augmented payload as
sample->raw_size - sc->args_size for any sys_enter style sample.
sc->args_size deliberately stops at the last non-internal field, so
on 6.19+ a native syscalls:sys_enter_<name> record leaves the
__data_loc words and their string payloads in the remainder. Those
bytes are not a struct augmented_arg, so
syscall_arg__scnprintf_augmented_string() read a bogus length and
walked arg->augmented.args out of bounds. This is reachable from
trace__event_handler(), which calls trace__fprintf_sys_enter() for
any evsel whose tracepoint name starts with "sys_enter_".
6. In syscall__read_info(), syscall__alloc_arg_fmts() was called before
checking and dropping the leading __syscall_nr (or nr) field, using
nr_fields - 1 unconditionally. If a tracepoint format lacks that
leading field, the allocated arg_fmt array is one entry too small and
syscall_arg_fmt__init_array() writes one entry past the end of the
heap buffer. Drop __syscall_nr/nr first and size the allocation from
the remaining fields.
Update these functions to check and skip is_internal_field() so that
arguments are correctly formatted and beauty map entries match the
expected syscall signatures, restrict syscall__augmented_args() to the
__augmented_syscalls__ bpf-output evsel, and size arg_fmt after dropping
the syscall number field.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 153 ++++++++++++++++++++++++++++---------
1 file changed, 115 insertions(+), 38 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 8da0c51ec380..af9696aadaec 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2277,15 +2277,20 @@ syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field
struct tep_format_field *last_field = NULL;
int len;
- for (; field; field = field->next, ++arg) {
- /* assume it's the last argument */
+ for (; field; field = field->next) {
+ /*
+ * Skip internal tracepoint fields (e.g., __data_loc strings in
+ * Linux 6.19+) so they do not advance the syscall arg array index.
+ */
if (is_internal_field(field))
continue;
last_field = field;
- if (arg->scnprintf)
+ if (arg->scnprintf) {
+ ++arg;
continue;
+ }
len = strlen(field->name);
@@ -2342,6 +2347,7 @@ syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field
}
}
}
+ ++arg;
}
return last_field;
@@ -2363,6 +2369,7 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
char tp_name[128];
const char *name;
struct tep_format_field *field;
+ int nr_args;
int err;
if (sc->nonexistent)
@@ -2401,24 +2408,25 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
return err;
}
- /*
- * The tracepoint format contains __syscall_nr field, so it's one more
- * than the actual number of syscall arguments.
- */
- if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
- return -ENOMEM;
-
sc->args = sc->tp_format->format.fields;
+ nr_args = sc->tp_format->format.nr_fields;
/*
* We need to check and discard the first variable '__syscall_nr'
* or 'nr' that mean the syscall number. It is needless here.
* So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
+ *
+ * Do this before allocating, and size the array from what is left, so
+ * that a format without the field does not leave
+ * syscall_arg_fmt__init_array() walking one entry past the end.
*/
if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {
sc->args = sc->args->next;
- --sc->nr_args;
+ --nr_args;
}
+ if (syscall__alloc_arg_fmts(sc, nr_args))
+ return -ENOMEM;
+
field = sc->args;
while (field) {
if (is_internal_field(field))
@@ -2636,11 +2644,17 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
if (sc->args != NULL) {
struct tep_format_field *field;
- for (field = sc->args; field;
- field = field->next, ++arg.idx, bit <<= 1) {
- if (arg.mask & bit)
+ for (field = sc->args; field; field = field->next) {
+ /* Skip internal fields so they are not printed as spurious arguments */
+ if (is_internal_field(field))
continue;
+ if (arg.mask & bit) {
+ ++arg.idx;
+ bit <<= 1;
+ continue;
+ }
+
arg.fmt = &sc->arg_fmt[arg.idx];
val = syscall_arg__val(&arg, arg.idx);
/*
@@ -2658,8 +2672,11 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
*/
if (val == 0 && !trace->show_zeros &&
!(sc->arg_fmt && sc->arg_fmt[arg.idx].show_zero) &&
- !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE))
+ !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE)) {
+ ++arg.idx;
+ bit <<= 1;
continue;
+ }
printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
@@ -2674,12 +2691,16 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
size - printed, val, field->type);
if (btf_printed) {
printed += btf_printed;
+ ++arg.idx;
+ bit <<= 1;
continue;
}
}
printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx],
bf + printed, size - printed, &arg, val);
+ ++arg.idx;
+ bit <<= 1;
}
} else if (IS_ERR(sc->tp_format)) {
/*
@@ -2940,7 +2961,9 @@ static int trace__fprintf_sample(struct trace *trace, struct perf_sample *sample
return printed;
}
-static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size)
+static void *syscall__augmented_args(struct trace *trace, struct syscall *sc,
+ struct perf_sample *sample,
+ int *augmented_args_size, int raw_augmented_args_size)
{
/*
* For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
@@ -2958,6 +2981,24 @@ static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sam
*/
int args_size = raw_augmented_args_size ?: sc->args_size;
+ /*
+ * Augmented arguments are a perf trace specific payload, they are only
+ * ever appended to samples emitted by the BPF __augmented_syscalls__
+ * bpf-output event.
+ *
+ * Native syscalls:sys_enter_NAME tracepoints may also carry trailing
+ * data of their own: since Linux 6.19 they append __data_loc char[]
+ * fields plus the string payloads they point at. Those bytes are not a
+ * struct augmented_arg, so treating them as one would make
+ * syscall_arg__scnprintf_augmented_string() read a bogus length and
+ * walk arg->augmented.args far out of bounds.
+ *
+ * So only look for augmented arguments on the event that can actually
+ * produce them.
+ */
+ if (sample->evsel != trace->syscalls.events.bpf_output)
+ return NULL;
+
*augmented_args_size = sample->raw_size - args_size;
if (*augmented_args_size > 0) {
static uintptr_t argbuf[1024]; /* assuming single-threaded */
@@ -3016,17 +3057,13 @@ static int trace__sys_enter(struct trace *trace,
if (!(trace->duration_filter || trace->summary_only || trace->min_stack))
trace__printf_interrupted_entry(trace);
/*
- * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
- * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
- * this breaks syscall__augmented_args() check for augmented args, as we calculate
- * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
- * so when handling, say the openat syscall, we end up getting 6 args for the
- * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
- * thinking that the extra 2 u64 args are the augmented filename, so just check
- * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
+ * syscall__augmented_args() only returns a payload for the BPF
+ * __augmented_syscalls__ event, so raw_syscalls:sys_enter (which always
+ * carries all 6 possible arguments rather than sc->args_size worth) and
+ * the native syscalls:sys_enter_NAME tracepoints are both handled there.
*/
- if (evsel != trace->syscalls.events.sys_enter)
- augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
+ augmented_args = syscall__augmented_args(trace, sc, sample, &augmented_args_size,
+ trace->raw_augmented_syscalls_args_size);
ttrace->entry_time = sample->time;
ttrace->entry_cpu = sample->cpu;
msg = ttrace->entry_str;
@@ -3071,7 +3108,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sam
struct syscall *sc;
char msg[1024];
void *args, *augmented_args = NULL;
- int augmented_args_size, e_machine;
+ int augmented_args_size = 0, e_machine;
size_t printed = 0;
@@ -3089,7 +3126,8 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sam
goto out_put;
args = perf_evsel__sc_tp_ptr(args, sample);
- augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
+ augmented_args = syscall__augmented_args(trace, sc, sample, &augmented_args_size,
+ trace->raw_augmented_syscalls_args_size);
printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
fprintf(trace->output, "%.*s", (int)printed, msg);
err = 0;
@@ -4121,10 +4159,16 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
if (trace->btf == NULL)
return -1;
- for (i = 0, field = sc->args; field; ++i, field = field->next) {
+ for (i = 0, field = sc->args; field; field = field->next) {
+ /* Skip internal fields to keep beauty array index aligned with syscall arguments */
+ if (is_internal_field(field))
+ continue;
+
// XXX We're only collecting pointer payloads _from_ user space
- if (!sc->arg_fmt[i].from_user)
+ if (!sc->arg_fmt[i].from_user) {
+ ++i;
continue;
+ }
struct_offset = strstr(field->type, "struct ");
if (struct_offset == NULL)
@@ -4143,8 +4187,10 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
name[cnt] = '\0';
/* cache struct's btf_type and type_id */
- if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name))
+ if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name)) {
+ ++i;
continue;
+ }
bt = sc->arg_fmt[i].type;
beauty_array[i] = bt->size;
@@ -4170,7 +4216,9 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
struct tep_format_field *field_tmp;
/* find the size of the buffer that appears in pairs with buf */
- for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) {
+ for (j = 0, field_tmp = sc->args; field_tmp; field_tmp = field_tmp->next) {
+ if (is_internal_field(field_tmp))
+ continue;
if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */
(strstr(field_tmp->name, "count") ||
strstr(field_tmp->name, "siz") || /* size, bufsiz */
@@ -4180,8 +4228,10 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
can_augment = true;
break;
}
+ ++j;
}
}
+ ++i;
}
if (can_augment)
@@ -4190,6 +4240,19 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
return -1;
}
+/*
+ * Advance to the first field that is a real syscall argument, so that callers
+ * walking two argument lists in step never have to reason about internal
+ * fields appearing in one list but not the other.
+ */
+static struct tep_format_field *next_user_arg(struct tep_format_field *field)
+{
+ while (field && is_internal_field(field))
+ field = field->next;
+
+ return field;
+}
+
static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace,
struct syscall *sc)
{
@@ -4197,7 +4260,7 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
/*
* We're only interested in syscalls that have a pointer:
*/
- for (field = sc->args; field; field = field->next) {
+ for (field = next_user_arg(sc->args); field; field = next_user_arg(field->next)) {
if (field->flags & TEP_FIELD_IS_POINTER)
goto try_to_find_pair;
}
@@ -4215,21 +4278,31 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
pair->bpf_prog.sys_enter == unaugmented_prog)
continue;
- for (field = sc->args, candidate_field = pair->args;
- field && candidate_field; field = field->next, candidate_field = candidate_field->next) {
+ /*
+ * Both cursors only ever point at real arguments, so the loop
+ * ends when one of the two syscalls runs out of them, rather
+ * than when one happens to have trailing internal fields.
+ */
+ field = next_user_arg(sc->args);
+ candidate_field = next_user_arg(pair->args);
+ while (field && candidate_field) {
bool is_pointer = field->flags & TEP_FIELD_IS_POINTER,
candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER;
if (is_pointer) {
- if (!candidate_is_pointer) {
+ if (!candidate_is_pointer) {
// The candidate just doesn't copies our pointer arg, might copy other pointers we want.
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
continue;
- }
+ }
} else {
if (candidate_is_pointer) {
// The candidate might copy a pointer we don't have, skip it.
goto next_candidate;
}
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
continue;
}
@@ -4250,6 +4323,8 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
goto next_candidate;
is_candidate = true;
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
}
if (!is_candidate)
@@ -4261,7 +4336,9 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
* more than what is common to the two syscalls.
*/
if (candidate_field) {
- for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next)
+ candidate_field = next_user_arg(candidate_field->next);
+ for (; candidate_field;
+ candidate_field = next_user_arg(candidate_field->next))
if (candidate_field->flags & TEP_FIELD_IS_POINTER)
goto next_candidate;
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 03/13] perf trace: Do not set unaugmented BPF program on sys_exit map
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
2026-09-17 6:42 ` [PATCH v1 01/13] perf trace: Start BPF summary before starting workload Ian Rogers
2026-09-17 6:42 ` [PATCH v1 02/13] perf trace: Skip internal tracepoint fields in formatting and beauty map Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 04/13] perf trace: Filter events in BPF and avoid tracepoint vetoes Ian Rogers
` (10 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
In trace__init_syscalls_bpf_prog_array_maps(), the BPF program array map
for sys_exit (syscalls_sys_exit) was populated with the result of
trace__bpf_prog_sys_exit_fd().
When a syscall had no specific exit augmenter,
trace__find_syscall_bpf_prog() fell back to unaugmented_prog
(syscall_unaugmented). However, syscall_unaugmented is a sys_enter
program that outputs enter arguments to __augmented_syscalls__.
As a consequence, when an unaugmented syscall exited, sys_exit
tail-called syscall_unaugmented, which interpreted the exit arguments as
enter arguments and emitted a duplicate, corrupt sys_enter event into
__augmented_syscalls__ right as the syscall completed.
Fix this by:
1. Returning NULL from trace__find_syscall_bpf_prog() when looking up exit
augmenters and none is found.
2. Returning -1 from trace__bpf_prog_sys_exit_fd() when no exit program
is present.
3. Only updating map_exit_fd when prog_fd >= 0.
4. Clearing err = 0 when trace__bpf_sys_enter_beauty_map() returns
non-zero (indicating the syscall has no augmentable pointer arguments)
before continuing the loop, so a trailing run of such syscalls (e.g.
'perf trace -e close') does not leave err non-zero on return and abort
the session.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index af9696aadaec..a68d34256996 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -4117,7 +4117,12 @@ static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace __ma
pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
prog_name, type, sc->name);
out_unaugmented:
- return unaugmented_prog;
+ /*
+ * Do not set unaugmented_prog for exit: syscall_unaugmented is a
+ * sys_enter program that outputs enter arguments. Exit without a
+ * specialized return augmenter returns 1 directly from sys_exit.
+ */
+ return !strcmp(type, "exit") ? NULL : unaugmented_prog;
}
static void trace__init_syscall_bpf_progs(struct trace *trace, int e_machine, int id)
@@ -4140,7 +4145,7 @@ static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int e_machine, int
static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int e_machine, int id)
{
struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id);
- return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(unaugmented_prog);
+ return sc && sc->bpf_prog.sys_exit ? bpf_program__fd(sc->bpf_prog.sys_exit) : -1;
}
static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, int key, unsigned int *beauty_array)
@@ -4395,16 +4400,27 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace, int e_m
err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
if (err)
break;
+ /* Only update the exit prog array map if an exit augmenter exists */
prog_fd = trace__bpf_prog_sys_exit_fd(trace, e_machine, key);
- err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
- if (err)
- break;
+ if (prog_fd >= 0) {
+ err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
+ if (err)
+ break;
+ }
/* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */
memset(beauty_array, 0, sizeof(beauty_array));
err = trace__bpf_sys_enter_beauty_map(trace, e_machine, key, (unsigned int *)beauty_array);
- if (err)
+ if (err) {
+ /*
+ * Not a failure: the syscall just has no augmentable
+ * arguments. Clear err, or a trailing run of such
+ * syscalls, e.g. all of them for 'perf trace -e close',
+ * would leave it set on return and abort the session.
+ */
+ err = 0;
continue;
+ }
err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY);
if (err)
break;
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 04/13] perf trace: Filter events in BPF and avoid tracepoint vetoes
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (2 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 03/13] perf trace: Do not set unaugmented BPF program on sys_exit map Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 05/13] perf trace: Handle fork and exit directly in BPF filter maps Ian Rogers
` (9 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
The BPF augmented_raw_syscalls sys_enter and sys_exit programs returned
0 for syscalls that were not of interest. Returning 0 from a tracepoint
BPF program vetoes the event for the whole system, so an unrelated
concurrent perf trace, perf record or ftrace session listening to
raw_syscalls would silently lose events. This is a cross-session side
effect and shows up as flaky failures when perf tests run in parallel.
Furthermore, syscall_unaugmented previously returned 1 without writing
anything to the __augmented_syscalls__ ring buffer. This forced
userspace perf trace to listen to both raw_syscalls:sys_enter and
__augmented_syscalls__ in its evlist, requiring userspace event
deduplication.
Address these issues:
1. In augmented_raw_syscalls.bpf.c, never return 0 from tracepoint
handlers: return 1 so non-traced syscalls pass through without
vetoing other concurrent listeners.
2. Introduce pids_to_trace and syscalls_to_trace BPF hash maps to
perform targeted filtering directly in BPF. Unselected syscalls or
PIDs return 1 immediately without writing to the buffer.
3. In syscall_unaugmented, output the unaugmented enter payload into
__augmented_syscalls__ and return 1. Change its section from
SEC("tp/raw_syscalls/sys_enter") to
SEC("tp/syscalls/sys_enter_unaugmented") so libbpf does not attempt
to auto-attach it to raw_syscalls:sys_enter.
4. In bpf_trace_augment.c, add helpers to configure target PIDs and
syscalls in the BPF maps, setting the activation flags
(has_pids_to_trace, has_syscalls_to_trace) only after the maps are
fully populated so already-attached BPF programs do not filter against
a half-filled map. Explicitly attach only sys_enter and sys_exit via
an attach_prog() helper that saves -errno before calling pr_debug()
or bpf_link__destroy().
Destroy the skeleton on every failure path. Leaving a loaded but
unusable skeleton behind is not inert: the setters called later from
trace__run() would program its maps, and a partial attach would leave
a BPF program live on raw_syscalls for a session that never starts.
Since augmented_syscalls__{prepare,create_bpf_output}() failures fall
back to unaugmented tracing rather than aborting, those setters have
to become no-ops, which they only do once skel is NULL again.
errno is used directly here, so include <errno.h> rather than relying
on it arriving via another header, which it does not under musl.
5. In builtin-trace.c, hook trace__set_ev_qualifier_filter() and PID
filtering into the BPF maps. When __augmented_syscalls__ is active,
remove raw_syscalls:sys_enter from trace.evlist since all traced enter
events (both augmented and unaugmented) are now emitted by BPF into
__augmented_syscalls__. Restore tracking on the remaining evsel via
evlist__set_tracking_event() so PERF_RECORD_COMM and tracking events
continue to be recorded. Errors from
augmented_syscalls__set_target_syscalls() are reported and
propagated, the tracepoint filter string is freed on every exit path,
and an allocation failure in trace__set_filter_pids() now returns
-ENOMEM instead of being silently ignored.
Note that in trace__set_filter_pids() the target pids and the filtered
pids are two independent axes and both have to be programmed. Naming
pids to leave out with --filter-pids does not widen -p/-t or a workload
to the whole system, and a BPF tracepoint program is attached system
wide rather than to the target's file descriptors, so pids_to_trace is
the only thing keeping other tasks out.
6. Add --syscall-augment option (defaulting to true) to allow users to
explicitly use --no-syscall-augment to run perf trace in the classic
unaugmented tracepoint mode without BPF. When BPF is unavailable or
disabled, ensure the non-augmented tracepoint path cleanly configures
sys_enter and sys_exit without duplicate entries.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/Documentation/perf-trace.txt | 5 +
tools/perf/builtin-trace.c | 146 +++++++++++++++---
.../bpf_skel/augmented_raw_syscalls.bpf.c | 133 ++++++++++++++--
tools/perf/util/bpf_trace_augment.c | 135 +++++++++++++++-
tools/perf/util/trace_augment.h | 33 ++++
5 files changed, 414 insertions(+), 38 deletions(-)
diff --git a/tools/perf/Documentation/perf-trace.txt b/tools/perf/Documentation/perf-trace.txt
index d20b43ea3d37..4680c69160d7 100644
--- a/tools/perf/Documentation/perf-trace.txt
+++ b/tools/perf/Documentation/perf-trace.txt
@@ -260,6 +260,11 @@ the thread executes on the designated CPUs. Default is to monitor all CPUs.
Maximum number of lines in the summary mode. Note that this applies to
each entry (thread or cgroup).
+--syscall-augment::
+ Augment syscalls with BPF. Enabled by default when BPF support is available.
+ Use --no-syscall-augment to disable BPF augmentation and fall back to the
+ unaugmented tracepoint approach.
+
PAGEFAULTS
----------
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index a68d34256996..e21b2b4a8794 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -200,6 +200,7 @@ struct trace {
int max_summary;
int raw_augmented_syscalls_args_size;
bool raw_augmented_syscalls;
+ bool syscall_augment;
bool fd_path_disabled;
bool sort_events;
bool not_ev_qualifier;
@@ -2054,6 +2055,23 @@ static int trace__process_event(struct trace *trace, struct machine *machine,
"LOST %" PRIu64 " events!\n", (u64)event->lost.lost);
ret = machine__process_lost_event(machine, event, sample);
break;
+ case PERF_RECORD_FORK:
+ if (trace->raw_augmented_syscalls &&
+ (augmented_syscalls__has_target_pid(event->fork.ppid) ||
+ augmented_syscalls__has_target_pid(event->fork.ptid))) {
+ augmented_syscalls__add_target_pid(event->fork.pid);
+ }
+ ret = machine__process_fork_event(machine, event, sample);
+ break;
+ case PERF_RECORD_EXIT:
+ if (trace->raw_augmented_syscalls) {
+ if (event->fork.pid == event->fork.tid)
+ augmented_syscalls__del_target_pid(event->fork.pid);
+ else
+ augmented_syscalls__del_target_pid(event->fork.tid);
+ }
+ ret = machine__process_exit_event(machine, event, sample);
+ break;
default:
ret = machine__process_event(machine, event, sample);
break;
@@ -4043,7 +4061,7 @@ static int trace__add_syscall_newtp(struct trace *trace)
static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
{
- int err = -1;
+ int err = 0;
struct evsel *sys_exit;
char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier,
trace->ev_qualifier_ids.nr,
@@ -4052,10 +4070,17 @@ static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
if (filter == NULL)
goto out_enomem;
- if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
- sys_exit = trace->syscalls.events.sys_exit;
+ /*
+ * With BPF augmentation sys_enter is filtered in BPF and removed from
+ * the evlist, so only apply the tracepoint filter to the events that
+ * are actually present.
+ */
+ if (trace->syscalls.events.sys_enter)
+ err = evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter);
+
+ sys_exit = trace->syscalls.events.sys_exit;
+ if (!err && sys_exit)
err = evsel__append_tp_filter(sys_exit, filter);
- }
free(filter);
out:
@@ -4502,7 +4527,27 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_
static int trace__set_ev_qualifier_filter(struct trace *trace)
{
- if (trace->syscalls.events.sys_enter)
+ /*
+ * Synchronize syscall filter with BPF augmenter map:
+ * Pass trace->not_ev_qualifier to indicate blacklist mode ('!' prefix,
+ * e.g., -e !open,close) vs whitelist mode (-e open,close).
+ *
+ * A failure here would leave the BPF program filtering on a partially
+ * populated map, silently dropping or emitting the wrong syscalls, so
+ * propagate the error rather than continuing.
+ */
+ if (trace->ev_qualifier_ids.nr > 0) {
+ int err = augmented_syscalls__set_target_syscalls(trace->ev_qualifier_ids.nr,
+ trace->ev_qualifier_ids.entries,
+ trace->not_ev_qualifier);
+
+ if (err) {
+ pr_err("Failed to set the syscalls to trace in the BPF map: %d\n", err);
+ return err;
+ }
+ }
+
+ if (trace->syscalls.events.sys_enter || trace->syscalls.events.sys_exit)
return trace__set_ev_qualifier_tp_filter(trace);
return 0;
}
@@ -4543,13 +4588,21 @@ static int trace__set_filter_loop_pids(struct trace *trace)
static int trace__set_filter_pids(struct trace *trace)
{
- int err = 0;
+ struct perf_thread_map *threads = evlist__core(trace->evlist)->threads;
/*
* Better not use !target__has_task() here because we need to cover the
* case where no threads were specified in the command line, but a
* workload was, and in that case we will fill in the thread_map when
* we fork the workload in evlist__prepare_workload.
*/
+ bool has_target = perf_thread_map__pid(threads, 0) != -1;
+ int err = 0;
+
+ /*
+ * The exclusion list: --filter-pids names tasks to never report, and
+ * with no target at all we instead exclude perf itself so that tracing
+ * does not feed back into itself.
+ */
if (trace->filter_pids.nr > 0) {
err = evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr,
trace->filter_pids.entries);
@@ -4557,10 +4610,37 @@ static int trace__set_filter_pids(struct trace *trace)
err = augmented_syscalls__set_filter_pids(trace->filter_pids.nr,
trace->filter_pids.entries);
}
- } else if (perf_thread_map__pid(evlist__core(trace->evlist)->threads, 0) == -1) {
+ } else if (!has_target) {
err = trace__set_filter_loop_pids(trace);
}
+ if (err)
+ return err;
+
+ /*
+ * The inclusion list, which is a separate axis from the exclusion list
+ * above and so must be programmed even when --filter-pids was given:
+ * naming tasks to leave out does not widen -p/-t or a workload to the
+ * whole system.
+ *
+ * This matters more than it does on the tracepoint only path. A BPF
+ * tracepoint program is attached system wide rather than to the
+ * target's file descriptors, so pids_to_trace is the only thing
+ * keeping other tasks out.
+ */
+ if (has_target) {
+ int nr = perf_thread_map__nr(threads);
+ pid_t *pids = malloc(nr * sizeof(pid_t));
+
+ if (pids == NULL)
+ return -ENOMEM;
+
+ for (int i = 0; i < nr; i++)
+ pids[i] = perf_thread_map__pid(threads, i);
+ err = augmented_syscalls__set_target_pids(nr, pids);
+ free(pids);
+ }
+
return err;
}
@@ -4787,7 +4867,8 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
}
if (!trace->raw_augmented_syscalls) {
- if (trace->trace_syscalls && trace__add_syscall_newtp(trace))
+ if (trace->trace_syscalls && !trace->syscalls.events.sys_enter &&
+ trace__add_syscall_newtp(trace))
goto out_error_raw_syscalls;
if (trace->trace_syscalls)
@@ -5795,6 +5876,7 @@ int cmd_trace(int argc, const char **argv)
.show_arg_names = true,
.args_alignment = 70,
.trace_syscalls = false,
+ .syscall_augment = true,
.kernel_syscallchains = false,
.max_stack = UINT_MAX,
.max_events = ULONG_MAX,
@@ -5850,6 +5932,8 @@ int cmd_trace(int argc, const char **argv)
OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min",
"Trace pagefaults", parse_pagefaults, "maj"),
OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),
+ OPT_BOOLEAN(0, "syscall-augment", &trace.syscall_augment,
+ "Augment syscalls with BPF"),
OPT_BOOLEAN('f', "force", &trace.force, "don't complain, do it"),
OPT_CALLBACK(0, "call-graph", &trace.opts,
"record_mode[,record_size]", record_callchain_help,
@@ -5972,7 +6056,7 @@ int cmd_trace(int argc, const char **argv)
"cgroup monitoring only available in system-wide mode");
}
- if (!trace.trace_syscalls)
+ if (!trace.trace_syscalls || !trace.syscall_augment)
goto skip_augmentation;
if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) {
@@ -5997,8 +6081,19 @@ int cmd_trace(int argc, const char **argv)
trace__add_syscall_newtp(&trace);
err = augmented_syscalls__create_bpf_output(trace.evlist);
- if (err == 0)
+ if (err == 0) {
trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
+ } else {
+ /*
+ * augmented_syscalls__prepare() already attached sys_enter and
+ * sys_exit, which are system wide. Falling through to
+ * skip_augmentation without undoing that would run a BPF
+ * program for every syscall on the machine, for the whole
+ * session, with nothing consuming the output.
+ */
+ pr_debug("Failed to create the augmented syscalls bpf-output event, disabling augmentation\n");
+ augmented_syscalls__cleanup();
+ }
skip_augmentation:
err = -1;
@@ -6054,7 +6149,9 @@ int cmd_trace(int argc, const char **argv)
* syscall.
*/
if (trace.syscalls.events.bpf_output) {
- evlist__for_each_entry(trace.evlist, evsel) {
+ struct evsel *n;
+
+ evlist__for_each_entry_safe(trace.evlist, n, evsel) {
bool raw_syscalls_sys_exit = evsel__name_is(evsel, "raw_syscalls:sys_exit");
if (raw_syscalls_sys_exit) {
@@ -6069,21 +6166,26 @@ int cmd_trace(int argc, const char **argv)
evsel__init_augmented_syscall_tp_args(augmented))
goto out;
/*
- * Augmented is __augmented_syscalls__ BPF_OUTPUT event
+ * Augmented is __augmented_syscalls__ BPF_OUTPUT event.
* Above we made sure we can get from the payload the tp fields
* that we get from syscalls:sys_enter tracefs format file.
+ * Since BPF outputs all enter events (both augmented and
+ * unaugmented) into __augmented_syscalls__, we remove the raw
+ * sys_enter evsel from evlist so that perf trace only listens
+ * to __augmented_syscalls__, avoiding duplicate events and
+ * avoiding kernel tracepoint vetoes.
+ *
+ * Because evlist__remove() removes the first evsel (which had
+ * tracking=true by default), re-designate the tracking event
+ * so PERF_RECORD_COMM and fork tracking continue to be enabled.
*/
augmented->handler = trace__sys_enter;
- /*
- * Now we do the same for the *syscalls:sys_enter event so that
- * if we handle it directly, i.e. if the BPF prog returns 0 so
- * as not to filter it, then we'll handle it just like we would
- * for the BPF_OUTPUT one:
- */
- if (evsel__init_augmented_syscall_tp(evsel, evsel) ||
- evsel__init_augmented_syscall_tp_args(evsel))
- goto out;
- evsel->handler = trace__sys_enter;
+ evlist__remove(trace.evlist, evsel);
+ evsel__put_and_free_priv(evsel);
+ trace.syscalls.events.sys_enter = NULL;
+ evlist__set_tracking_event(trace.evlist,
+ trace.syscalls.events.sys_exit ?: augmented);
+ continue;
}
if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 3bc9e28a9b8a..6ca9507ecc02 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -114,6 +114,41 @@ struct pids_filtered {
__uint(max_entries, 64);
} pids_filtered SEC(".maps");
+/*
+ * Optional hash map containing specific PIDs/TGIDs to trace (e.g., when
+ * attached to a process with -p or tracing a specific command workload).
+ *
+ * has_pids_to_trace: Set to true if target PID filtering is active.
+ * When false, all processes are eligible for tracing.
+ */
+struct pids_to_trace {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, pid_t);
+ __type(value, bool);
+ __uint(max_entries, 1024);
+} pids_to_trace SEC(".maps");
+
+bool has_pids_to_trace;
+
+/*
+ * Hash map storing syscall IDs for filtering (via 'perf trace -e ...').
+ *
+ * has_syscalls_to_trace: Set to true if any syscall filter is active.
+ * not_syscalls_to_trace: Inverts matching when '!' prefix is used in -e
+ * (e.g., -e !open,close means trace everything EXCEPT
+ * open and close; an exclusion blacklist rather than
+ * an inclusion whitelist).
+ */
+struct syscalls_to_trace {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, int);
+ __type(value, bool);
+ __uint(max_entries, 1024);
+} syscalls_to_trace SEC(".maps");
+
+bool has_syscalls_to_trace;
+bool not_syscalls_to_trace;
+
struct augmented_args_payload {
struct syscall_enter_args args;
struct augmented_arg arg, arg2; // We have to reserve space for two arguments (rename, etc)
@@ -154,8 +189,8 @@ static inline struct augmented_args_payload *augmented_args_payload(void)
static inline int augmented__output(void *ctx, struct augmented_args_payload *args, int len)
{
- /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
- return bpf_perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
+ bpf_perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
+ return 1;
}
static inline int augmented__beauty_output(void *ctx, void *data, int len)
@@ -191,10 +226,21 @@ unsigned int augmented_arg__read_str(struct augmented_arg *augmented_arg, const
return augmented_len;
}
-SEC("tp/raw_syscalls/sys_enter")
+/*
+ * Default sys_enter program for syscalls without pointer argument augmentation.
+ * Writes the raw struct syscall_enter_args payload into __augmented_syscalls__
+ * and returns 1 so the tracepoint is never vetoed in the kernel.
+ */
+SEC("tp/syscalls/sys_enter_unaugmented")
int syscall_unaugmented(struct syscall_enter_args *args)
{
- return 1;
+ struct augmented_args_payload *augmented_args = augmented_args_payload();
+
+ if (augmented_args == NULL)
+ return 1;
+
+ bpf_probe_read_kernel(&augmented_args->args, sizeof(augmented_args->args), args);
+ return augmented__output(args, augmented_args, sizeof(augmented_args->args));
}
/*
@@ -424,11 +470,41 @@ static pid_t getpid(void)
return bpf_get_current_pid_tgid();
}
+/*
+ * Returns true if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ */
static bool pid_filter__has(struct pids_filtered *pids, pid_t pid)
{
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
+/*
+ * Checks if the current task (thread PID or process TGID) is targeted for tracing.
+ * Checks both PID (thread ID) and TGID (process ID) so that all threads of a
+ * target process match.
+ */
+static inline bool pid_to_trace__has(pid_t pid)
+{
+ pid_t tgid = bpf_get_current_pid_tgid() >> 32;
+
+ return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL ||
+ bpf_map_lookup_elem(&pids_to_trace, &tgid) != NULL;
+}
+
+/*
+ * Determines if a syscall should be traced based on the filter map:
+ * - When not_syscalls_to_trace is true: blacklist mode (trace if NOT in map).
+ * - When not_syscalls_to_trace is false: whitelist mode (trace ONLY if IN map).
+ */
+static inline bool syscall_to_trace__enabled(int id)
+{
+ bool in_map = bpf_map_lookup_elem(&syscalls_to_trace, &id) != NULL;
+
+ if (not_syscalls_to_trace)
+ return !in_map;
+ return in_map;
+}
+
u64 ZERO = 0;
/*
@@ -562,6 +638,11 @@ static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
return augmented__beauty_output(ctx, payload, sizeof(struct syscall_enter_args) + output);
}
+/*
+ * Main raw_syscalls:sys_enter tracepoint handler.
+ * Always returns 1 so the tracepoint is never vetoed in the kernel for
+ * other concurrent listeners. Filtered events simply do not output to the ring buffer.
+ */
SEC("tp/raw_syscalls/sys_enter")
int sys_enter(struct syscall_enter_args *args)
{
@@ -576,8 +657,11 @@ int sys_enter(struct syscall_enter_args *args)
* initial, non-augmented raw_syscalls:sys_enter payload.
*/
+ if (has_pids_to_trace && !pid_to_trace__has(getpid()))
+ return 1;
+
if (pid_filter__has(&pids_filtered, getpid()))
- return 0;
+ return 1;
augmented_args = augmented_args_payload();
if (augmented_args == NULL)
@@ -585,25 +669,41 @@ int sys_enter(struct syscall_enter_args *args)
bpf_probe_read_kernel(&augmented_args->args, sizeof(augmented_args->args), args);
+ if (has_syscalls_to_trace && !syscall_to_trace__enabled(augmented_args->args.syscall_nr))
+ return 1;
+
/*
- * Jump to syscall specific augmenter, even if the default one,
- * "!raw_syscalls:unaugmented" that will just return 1 to return the
- * unaugmented tracepoint payload.
+ * Jump to syscall specific augmenter. If augmented, augment_sys_enter()
+ * outputs the payload to __augmented_syscalls__ and returns 0.
+ * Return 1 so we never veto the kernel tracepoint for other listeners.
*/
- if (augment_sys_enter(args, &augmented_args->args))
- bpf_tail_call(args, &syscalls_sys_enter, augmented_args->args.syscall_nr);
+ if (augment_sys_enter(args, &augmented_args->args) == 0)
+ return 1;
- // If not found on the PROG_ARRAY syscalls map, then we're filtering it:
- return 0;
+ bpf_tail_call(args, &syscalls_sys_enter, augmented_args->args.syscall_nr);
+
+ /*
+ * If not found on the PROG_ARRAY syscalls map, return 1 so we
+ * don't veto the tracepoint event system-wide for other concurrent
+ * listeners.
+ */
+ return 1;
}
+/*
+ * Main raw_syscalls:sys_exit tracepoint handler.
+ * Always returns 1 so the tracepoint is never vetoed in the kernel.
+ */
SEC("tp/raw_syscalls/sys_exit")
int sys_exit(struct syscall_exit_args *args)
{
struct syscall_exit_args exit_args;
+ if (has_pids_to_trace && !pid_to_trace__has(getpid()))
+ return 1;
+
if (pid_filter__has(&pids_filtered, getpid()))
- return 0;
+ return 1;
bpf_probe_read_kernel(&exit_args, sizeof(exit_args), args);
/*
@@ -613,9 +713,12 @@ int sys_exit(struct syscall_exit_args *args)
*/
bpf_tail_call(args, &syscalls_sys_exit, exit_args.syscall_nr);
/*
- * If not found on the PROG_ARRAY syscalls map, then we're filtering it:
+ * If not found on the PROG_ARRAY syscalls map, return 1 so we
+ * don't veto the tracepoint event system-wide for other concurrent
+ * listeners. perf trace's own evsel filter will discard non-matching
+ * syscalls.
*/
- return 0;
+ return 1;
}
char _license[] SEC("license") = "GPL";
diff --git a/tools/perf/util/bpf_trace_augment.c b/tools/perf/util/bpf_trace_augment.c
index a9cf2a77ded1..b9d1208e50f2 100644
--- a/tools/perf/util/bpf_trace_augment.c
+++ b/tools/perf/util/bpf_trace_augment.c
@@ -1,4 +1,5 @@
#include <bpf/libbpf.h>
+#include <errno.h>
#include <internal/xyarray.h>
#include "bpf_skel/augmented_raw_syscalls.skel.h"
@@ -10,6 +11,23 @@
static struct augmented_raw_syscalls_bpf *skel;
static struct evsel *bpf_output;
+/* Set by attach_prog() so the first failure is what gets reported. */
+static int attach_err;
+
+static int attach_prog(struct bpf_link **link, struct bpf_program *prog, const char *name)
+{
+ *link = bpf_program__attach(prog);
+ if (*link)
+ return 0;
+ /*
+ * Save errno before pr_debug(), which formats and writes output and so
+ * can overwrite it.
+ */
+ attach_err = -errno;
+ pr_debug("Failed to attach %s BPF program\n", name);
+ return attach_err;
+}
+
int augmented_syscalls__prepare(void)
{
struct bpf_program *prog;
@@ -35,11 +53,35 @@ int augmented_syscalls__prepare(void)
if (err < 0) {
libbpf_strerror(err, buf, sizeof(buf));
pr_debug("Failed to load augmented syscalls BPF skeleton: %s\n", buf);
+ /*
+ * Tear the skeleton down rather than leaving a half initialized
+ * one behind. The caller falls back to unaugmented tracing and
+ * still calls the setters below, which must then do nothing
+ * instead of failing against a skeleton with no maps.
+ */
+ augmented_syscalls__cleanup();
return err;
}
- augmented_raw_syscalls_bpf__attach(skel);
+ /*
+ * Only sys_enter and sys_exit are attached, the remaining programs are
+ * reached by tail calls. Attach them explicitly and, on failure, undo
+ * any partial attachment: leaving sys_enter live on
+ * raw_syscalls:sys_enter would keep running a BPF program for every
+ * syscall on the system for a perf trace session that never starts.
+ */
+ if (attach_prog(&skel->links.sys_enter, skel->progs.sys_enter, "sys_enter"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sys_exit, skel->progs.sys_exit, "sys_exit"))
+ goto out_cleanup;
+
return 0;
+
+out_cleanup:
+ err = attach_err;
+ /* Destroys every link attached above along with the skeleton. */
+ augmented_syscalls__cleanup();
+ return err;
}
int augmented_syscalls__create_bpf_output(struct evlist *evlist)
@@ -98,6 +140,96 @@ int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids)
return err;
}
+/*
+ * Populate target PIDs in the BPF pids_to_trace map (e.g., for -p <PID> or
+ * when tracing a specified command workload).
+ */
+int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids)
+{
+ bool value = true;
+ int err = 0;
+
+ if (skel == NULL || nr == 0)
+ return 0;
+
+ for (size_t i = 0; i < nr; ++i) {
+ err = bpf_map__update_elem(skel->maps.pids_to_trace, &pids[i],
+ sizeof(*pids), &value, sizeof(value),
+ BPF_ANY);
+ if (err)
+ return err;
+ }
+ /*
+ * Set the flag only once every target is in the map. The BPF programs
+ * are attached by this point, so flipping it first would have them
+ * filter against a partially populated map and drop syscalls made by
+ * the targets that had not been added yet.
+ */
+ skel->bss->has_pids_to_trace = true;
+ return 0;
+}
+
+int augmented_syscalls__add_target_pid(pid_t pid)
+{
+ bool value = true;
+
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return 0;
+
+ return bpf_map__update_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
+ &value, sizeof(value), BPF_ANY);
+}
+
+int augmented_syscalls__del_target_pid(pid_t pid)
+{
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return 0;
+
+ return bpf_map__delete_elem(skel->maps.pids_to_trace, &pid, sizeof(pid), 0);
+}
+
+bool augmented_syscalls__has_target_pid(pid_t pid)
+{
+ bool value;
+
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return false;
+
+ return bpf_map__lookup_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
+ &value, sizeof(value), 0) == 0;
+}
+
+/*
+ * Populate syscalls in the BPF syscalls_to_trace map:
+ * - not_syscalls: true if '!' prefix was specified (blacklist mode: trace
+ * all syscalls EXCEPT these).
+ * false if whitelist mode (trace ONLY these syscalls).
+ */
+int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls)
+{
+ bool value = true;
+ int err = 0;
+
+ if (skel == NULL || nr == 0)
+ return 0;
+
+ skel->bss->not_syscalls_to_trace = not_syscalls;
+ for (size_t i = 0; i < nr; ++i) {
+ err = bpf_map__update_elem(skel->maps.syscalls_to_trace, &syscall_ids[i],
+ sizeof(int), &value, sizeof(value),
+ BPF_ANY);
+ if (err)
+ return err;
+ }
+ /*
+ * As for the pid maps, publish the filter only once it is complete:
+ * in whitelist mode a half filled map would drop syscalls that were
+ * asked for but not added yet.
+ */
+ skel->bss->has_syscalls_to_trace = true;
+ return 0;
+}
+
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd)
{
if (skel == NULL)
@@ -140,4 +272,5 @@ struct bpf_program *augmented_syscalls__find_by_title(const char *name)
void augmented_syscalls__cleanup(void)
{
augmented_raw_syscalls_bpf__destroy(skel);
+ skel = NULL;
}
diff --git a/tools/perf/util/trace_augment.h b/tools/perf/util/trace_augment.h
index 4f729bc67753..56f4dbab7d4b 100644
--- a/tools/perf/util/trace_augment.h
+++ b/tools/perf/util/trace_augment.h
@@ -12,6 +12,11 @@ int augmented_syscalls__prepare(void);
int augmented_syscalls__create_bpf_output(struct evlist *evlist);
void augmented_syscalls__setup_bpf_output(void);
int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids);
+int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids);
+int augmented_syscalls__add_target_pid(pid_t pid);
+int augmented_syscalls__del_target_pid(pid_t pid);
+bool augmented_syscalls__has_target_pid(pid_t pid);
+int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls);
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd);
struct bpf_program *augmented_syscalls__find_by_title(const char *name);
struct bpf_program *augmented_syscalls__unaugmented(void);
@@ -39,6 +44,34 @@ static inline int augmented_syscalls__set_filter_pids(unsigned int nr __maybe_un
return 0;
}
+static inline int augmented_syscalls__set_target_pids(unsigned int nr __maybe_unused,
+ pid_t *pids __maybe_unused)
+{
+ return 0;
+}
+
+static inline int augmented_syscalls__add_target_pid(pid_t pid __maybe_unused)
+{
+ return 0;
+}
+
+static inline int augmented_syscalls__del_target_pid(pid_t pid __maybe_unused)
+{
+ return 0;
+}
+
+static inline bool augmented_syscalls__has_target_pid(pid_t pid __maybe_unused)
+{
+ return false;
+}
+
+static inline int augmented_syscalls__set_target_syscalls(unsigned int nr __maybe_unused,
+ int *syscall_ids __maybe_unused,
+ bool not_syscalls __maybe_unused)
+{
+ return 0;
+}
+
static inline int augmented_syscalls__get_map_fds(int *enter_fd __maybe_unused,
int *exit_fd __maybe_unused,
int *beauty_fd __maybe_unused)
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 05/13] perf trace: Handle fork and exit directly in BPF filter maps
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (3 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 04/13] perf trace: Filter events in BPF and avoid tracepoint vetoes Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 06/13] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive Ian Rogers
` (8 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
Updating target or filtered PIDs in userspace upon processing
PERF_RECORD_FORK and PERF_RECORD_EXIT events introduces latency between
event occurrence and userspace BPF map updates. If a newly forked child
executes system calls before userspace processes PERF_RECORD_FORK, those
syscalls may be dropped by BPF PID filtering. Conversely, if userspace
evicts PIDs asynchronously on PERF_RECORD_EXIT, the kernel may recycle a
PID before userspace processes the exit event, causing the late eviction
to silently drop a newly created task that received the recycled PID.
Address this by attaching BTF-typed raw tracepoint BPF programs directly
to the scheduler task lifetime tracepoints:
1. Attach SEC("tp_btf/sched_process_fork") (sched_process_fork), which
runs in copy_process() in the parent's context before
wake_up_new_task() wakes the child. Using tp_btf rather than
SEC("tp/sched/sched_process_fork") receives the stable TP_PROTO
arguments (struct task_struct *parent, struct task_struct *child)
rather than the tracepoint ring-buffer record (TP_STRUCT__entry),
whose layout changed in Linux 6.16 when parent_comm and child_comm
were converted from 16-byte arrays to 4-byte __data_loc strings.
When inherit is enabled and the parent's PID or TGID is in
pids_to_trace or pids_filtered, insert child->pid into the
corresponding map immediately. Because child->pid is task_struct.pid
(the global initial-namespace PID), this works accurately across PID
namespaces without aliasing host PIDs, and covers both new processes
and CLONE_THREAD threads without needing real_parent CO-RE walks or
syscall-return heuristics.
2. Attach SEC("tp_btf/sched_process_exit") (sched_process_exit), which
runs in do_exit() for every task in its own context, including tasks
killed by signals (SIGKILL, SIGSEGV, etc.) and secondary threads torn
down implicitly by exit_group. Delete the dying task's PID from
pids_to_trace and pids_filtered immediately in kernel space,
eliminating both map leaks and any asynchronous userspace eviction
window where PID recycling could occur.
3. Attach SEC("tp_btf/sched_process_exec") (sched_process_exec) to
follow the one case where a live task's pid changes underneath the
maps. When a thread that is not the group leader execs, de_thread()
kills the leader and hands the leader's pid, which is the tgid, to
the exec'ing thread. The leader dies first, so sched_process_exit()
has already dropped exactly the pid the survivor now holds, and the
survivor's old entry would be stranded in the map for good. Move the
entry from old_pid to p->pid. old_pid is sampled in bprm_execve()
before de_thread() runs, so the ordinary group leader exec is a
no-op here.
4. With every live task registered before its first syscall and evicted
in do_exit(), simplify pid_to_trace__has() and pid_filter__has() to
single BPF hash map lookups, and move bpf_probe_read_kernel() in
sys_exit back after the PID filter checks.
5. Pass the inherit flag from userspace to BPF .rodata via
augmented_syscalls__prepare(!trace.opts.no_inherit), and split
attaching out of it into augmented_syscalls__attach(), called from
trace__run() once the pid, syscall and program array maps have all
been programmed. These are system wide programs, so from the instant
they attach they alone decide what is traced: attaching at load time,
as before, left a window in which a target could fork without
sched_process_fork() knowing the parent was a target, and with the
userspace fork handling gone there was nothing left to recover it.
The scheduler programs are attached ahead of sys_enter and sys_exit
for the same reason. Set has_pids_filtered only after populating
pids_filtered.
6. Remove the userspace BPF map updates from PERF_RECORD_FORK and
PERF_RECORD_EXIT in trace__process_event(), and delete the now-unused
augmented_syscalls__{add,del,has}_target_pid() helpers. No coverage
is lost with them: those records only come into being once the ring
buffers are mapped by evlist__do_mmap() and the events are switched
on by evlist__enable(), both of which run after
augmented_syscalls__attach() in trace__run(), and they are then acted
on later still, whenever the poll loop gets round to them. The
scheduler programs therefore go live strictly earlier than the
userspace path could ever have reacted.
7. Gate pid_filter__has() on a has_pids_filtered flag in .bss so the
common case without --filter-pids performs no map lookups, and size
pids_to_trace and pids_filtered at 16384 entries. pids_filtered is
grown from 64 because it is no longer just the handful of pids
userspace names: sched_process_fork() adds every descendant of those,
so a --filter-pids target that forks or is heavily threaded needs the
same headroom as a traced one.
A fork or exit is still not seen if it happens before the programs are
attached, that is between evlist__create_maps() scanning /proc for a -p
target and augmented_syscalls__attach(). Such a window is inherent in
programming a system wide filter before switching it on, and as above
the userspace handling did not cover it either. What it costs is small:
a child forked in the window is still traced through the tracepoints its
parent's events were inherited by, only unaugmented, because sys_enter
returns 1 for a pid that is not in the map rather than vetoing the
tracepoint. A workload started by 'perf trace -- cmd' cannot hit it at
all, as evlist__prepare_workload() leaves the child blocked on a pipe
until evlist__start_workload(), well after the attach.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 39 ++--
.../bpf_skel/augmented_raw_syscalls.bpf.c | 178 +++++++++++++++++-
tools/perf/util/bpf_trace_augment.c | 116 +++++++-----
tools/perf/util/trace_augment.h | 28 +--
4 files changed, 262 insertions(+), 99 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index e21b2b4a8794..a30fe273f452 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2055,23 +2055,6 @@ static int trace__process_event(struct trace *trace, struct machine *machine,
"LOST %" PRIu64 " events!\n", (u64)event->lost.lost);
ret = machine__process_lost_event(machine, event, sample);
break;
- case PERF_RECORD_FORK:
- if (trace->raw_augmented_syscalls &&
- (augmented_syscalls__has_target_pid(event->fork.ppid) ||
- augmented_syscalls__has_target_pid(event->fork.ptid))) {
- augmented_syscalls__add_target_pid(event->fork.pid);
- }
- ret = machine__process_fork_event(machine, event, sample);
- break;
- case PERF_RECORD_EXIT:
- if (trace->raw_augmented_syscalls) {
- if (event->fork.pid == event->fork.tid)
- augmented_syscalls__del_target_pid(event->fork.pid);
- else
- augmented_syscalls__del_target_pid(event->fork.tid);
- }
- ret = machine__process_exit_event(machine, event, sample);
- break;
default:
ret = machine__process_event(machine, event, sample);
break;
@@ -4982,6 +4965,16 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
}
}
+ /*
+ * Everything the BPF programs filter on is now in their maps, so it is
+ * safe to let them run. They are attached system wide, so anything
+ * before this point would have been filtered against a map that was
+ * still being built up.
+ */
+ err = augmented_syscalls__attach();
+ if (err < 0)
+ goto out_errno;
+
/*
* If the "close" syscall is not traced, then we will not have the
* opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the
@@ -6074,7 +6067,7 @@ int cmd_trace(int argc, const char **argv)
goto skip_augmentation;
}
- err = augmented_syscalls__prepare();
+ err = augmented_syscalls__prepare(!trace.opts.no_inherit);
if (err < 0)
goto skip_augmentation;
@@ -6085,11 +6078,11 @@ int cmd_trace(int argc, const char **argv)
trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
} else {
/*
- * augmented_syscalls__prepare() already attached sys_enter and
- * sys_exit, which are system wide. Falling through to
- * skip_augmentation without undoing that would run a BPF
- * program for every syscall on the machine, for the whole
- * session, with nothing consuming the output.
+ * Drop the loaded skeleton before falling back to unaugmented
+ * tracing. Otherwise the setters called from trace__run() would
+ * still program its maps, and augmented_syscalls__attach() would
+ * then put system wide BPF programs on raw_syscalls for a
+ * session with nothing consuming their output.
*/
pr_debug("Failed to create the augmented syscalls bpf-output event, disabling augmentation\n");
augmented_syscalls__cleanup();
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 6ca9507ecc02..7124ed3c39c8 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -9,6 +9,7 @@
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
#include <linux/limits.h>
#define PERF_ALIGN(x, a) __PERF_ALIGN_MASK(x, (typeof(x))(a)-1)
@@ -107,25 +108,48 @@ struct augmented_arg {
};
};
+/*
+ * Hash map of PIDs/TGIDs whose events must be discarded, e.g. perf trace's own
+ * pid, so that tracing doesn't feed back on itself.
+ *
+ * has_pids_filtered: set to true only when the map is populated. Checking a
+ * boolean is much cheaper than a map lookup, and sys_enter
+ * runs for every syscall on the system, so the common
+ * "no pids filtered" case must stay on a fast path.
+ *
+ * max_entries matches pids_to_trace: userspace only ever names a handful of
+ * pids here, but sched_process_fork() below adds every descendant of those,
+ * so a --filter-pids target that forks or is heavily threaded needs the same
+ * headroom as a traced one.
+ */
struct pids_filtered {
__uint(type, BPF_MAP_TYPE_HASH);
__type(key, pid_t);
__type(value, bool);
- __uint(max_entries, 64);
+ __uint(max_entries, 16384);
} pids_filtered SEC(".maps");
+bool has_pids_filtered;
+
/*
* Optional hash map containing specific PIDs/TGIDs to trace (e.g., when
* attached to a process with -p or tracing a specific command workload).
*
* has_pids_to_trace: Set to true if target PID filtering is active.
* When false, all processes are eligible for tracing.
+ *
+ * max_entries bounds how many tasks can be tracked at once. sched_process_exit
+ * below evicts a task as it dies, whatever it died of, so the map holds live
+ * tasks rather than growing without bound. It is sized well
+ * above the thread count of realistic traced workloads; should a workload
+ * still exceed it, bpf_map_update_elem() fails with -E2BIG and the extra
+ * tasks are simply not traced rather than anything being corrupted.
*/
struct pids_to_trace {
__uint(type, BPF_MAP_TYPE_HASH);
__type(key, pid_t);
__type(value, bool);
- __uint(max_entries, 1024);
+ __uint(max_entries, 16384);
} pids_to_trace SEC(".maps");
bool has_pids_to_trace;
@@ -149,6 +173,9 @@ struct syscalls_to_trace {
bool has_syscalls_to_trace;
bool not_syscalls_to_trace;
+/* Inherit tracing for child tasks (set to false if --no-inherit is specified) */
+const volatile bool inherit = true;
+
struct augmented_args_payload {
struct syscall_enter_args args;
struct augmented_arg arg, arg2; // We have to reserve space for two arguments (rename, etc)
@@ -471,24 +498,35 @@ static pid_t getpid(void)
}
/*
- * Returns true if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ * Checks if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ *
+ * Children of a filtered task are added to the map by sched_process_fork()
+ * below, so a plain lookup is all that is needed here.
*/
static bool pid_filter__has(struct pids_filtered *pids, pid_t pid)
{
+ /*
+ * Fast path: this runs for every syscall on the system, so when no pid
+ * is filtered do no work at all rather than failing a lookup.
+ */
+ if (!has_pids_filtered)
+ return false;
+
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
/*
- * Checks if the current task (thread PID or process TGID) is targeted for tracing.
- * Checks both PID (thread ID) and TGID (process ID) so that all threads of a
- * target process match.
+ * Checks if the current task is targeted for tracing.
+ *
+ * Every thread that existed when tracing started was named by the target and
+ * inserted from userspace, and every task created since was inserted by
+ * sched_process_fork() below, before it was able to run. So there is nothing
+ * to derive here, and in particular no need to consult the tgid or walk to the
+ * parent: a task is traced if and only if it is in the map.
*/
static inline bool pid_to_trace__has(pid_t pid)
{
- pid_t tgid = bpf_get_current_pid_tgid() >> 32;
-
- return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL ||
- bpf_map_lookup_elem(&pids_to_trace, &tgid) != NULL;
+ return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL;
}
/*
@@ -706,6 +744,7 @@ int sys_exit(struct syscall_exit_args *args)
return 1;
bpf_probe_read_kernel(&exit_args, sizeof(exit_args), args);
+
/*
* Jump to syscall specific return augmenter, even if the default one,
* "!raw_syscalls:unaugmented" that will just return 1 to return the
@@ -721,4 +760,123 @@ int sys_exit(struct syscall_exit_args *args)
return 1;
}
+/*
+ * Propagate tracing to a newly created task.
+ *
+ * tp_btf/sched_process_fork is raised by copy_process(), in the parent's
+ * context and before the child is woken, so the child is in the maps before it
+ * can issue its first syscall. That removes the need to inspect real_parent
+ * when a syscall is seen from an unknown task, which could neither tell a
+ * genuine descendant from a task merely reparented to a traced init, nor keep
+ * following a descendant whose parent had already exited.
+ *
+ * Using tp_btf rather than tp/sched/sched_process_fork avoids depending on the
+ * tracepoint ring-buffer record layout (TP_STRUCT__entry), which changed in
+ * Linux 6.16 when parent_comm and child_comm were converted from fixed 16-byte
+ * arrays to 4-byte __data_loc strings (shrinking the tracepoint context from
+ * 48 to 24 bytes and causing BPF_PROG_TYPE_TRACEPOINT attachment to fail with
+ * -EACCES when accessing higher offsets). Instead, tp_btf receives the stable
+ * TP_PROTO arguments (struct task_struct *parent, struct task_struct *child)
+ * directly.
+ *
+ * child->pid is task_struct.pid, i.e. the pid in the initial namespace, which
+ * is what the maps are keyed by. A clone() return value, in contrast, is the
+ * pid in the caller's namespace and would alias an unrelated host task when a
+ * containerised workload is traced.
+ *
+ * CLONE_THREAD needs no special handling: a new thread arrives here like any
+ * other task and is inserted under its own pid.
+ */
+SEC("tp_btf/sched_process_fork")
+int BPF_PROG(sched_process_fork, struct task_struct *parent, struct task_struct *child)
+{
+ pid_t parent_tgid, parent_pid, child_pid;
+ bool val = true;
+
+ if (!inherit)
+ return 0;
+
+ /*
+ * The parent's own pid and tgid: the thread that called clone() may
+ * itself only be tracked by the pid of its thread group leader.
+ */
+ parent_pid = parent->pid;
+ parent_tgid = parent->tgid;
+ child_pid = child->pid;
+
+ if (has_pids_to_trace &&
+ (bpf_map_lookup_elem(&pids_to_trace, &parent_pid) != NULL ||
+ bpf_map_lookup_elem(&pids_to_trace, &parent_tgid) != NULL))
+ bpf_map_update_elem(&pids_to_trace, &child_pid, &val, BPF_ANY);
+
+ if (has_pids_filtered &&
+ (bpf_map_lookup_elem(&pids_filtered, &parent_pid) != NULL ||
+ bpf_map_lookup_elem(&pids_filtered, &parent_tgid) != NULL))
+ bpf_map_update_elem(&pids_filtered, &child_pid, &val, BPF_ANY);
+
+ return 0;
+}
+
+/*
+ * Drop a dying task from the maps.
+ *
+ * tp_btf/sched_process_exit is raised by do_exit() for every task, in its own
+ * context, so unlike hooking the exit and exit_group syscalls this also covers
+ * tasks killed by a signal and threads torn down implicitly by exit_group.
+ *
+ * Doing it here rather than from the userspace PERF_RECORD_EXIT handler also
+ * means there is no window between the task dying and the map being updated,
+ * during which the kernel could recycle the pid and the late eviction silently
+ * stop tracing whichever new task received it.
+ *
+ * Each thread is reported separately, including the group leader, whose pid is
+ * the thread group's tgid, so one delete per map covers both uses of the key.
+ */
+SEC("tp_btf/sched_process_exit")
+int BPF_PROG(sched_process_exit, struct task_struct *p)
+{
+ pid_t pid = p->pid;
+
+ bpf_map_delete_elem(&pids_to_trace, &pid);
+ bpf_map_delete_elem(&pids_filtered, &pid);
+
+ return 0;
+}
+
+/*
+ * Follow a task whose pid changed under it.
+ *
+ * When a thread that is not the thread group leader execs, de_thread() kills
+ * the rest of the group and then hands the leader's pid, which is the tgid, to
+ * the exec'ing thread. The leader dies first, so sched_process_exit() above
+ * has already dropped that pid from the maps, and the survivor is now keyed by
+ * a pid nothing knows about while its original entry is left behind for good.
+ *
+ * Move the entry across so the task stays tracked and nothing is leaked.
+ * old_pid is sampled in bprm_execve() before de_thread() runs, so for the
+ * common case of the group leader exec'ing it simply equals p->pid and there
+ * is nothing to do.
+ */
+SEC("tp_btf/sched_process_exec")
+int BPF_PROG(sched_process_exec, struct task_struct *p, pid_t old_pid)
+{
+ pid_t pid = p->pid;
+ bool val = true;
+
+ if (pid == old_pid)
+ return 0;
+
+ if (bpf_map_lookup_elem(&pids_to_trace, &old_pid) != NULL) {
+ bpf_map_update_elem(&pids_to_trace, &pid, &val, BPF_ANY);
+ bpf_map_delete_elem(&pids_to_trace, &old_pid);
+ }
+
+ if (bpf_map_lookup_elem(&pids_filtered, &old_pid) != NULL) {
+ bpf_map_update_elem(&pids_filtered, &pid, &val, BPF_ANY);
+ bpf_map_delete_elem(&pids_filtered, &old_pid);
+ }
+
+ return 0;
+}
+
char _license[] SEC("license") = "GPL";
diff --git a/tools/perf/util/bpf_trace_augment.c b/tools/perf/util/bpf_trace_augment.c
index b9d1208e50f2..41a867d60b37 100644
--- a/tools/perf/util/bpf_trace_augment.c
+++ b/tools/perf/util/bpf_trace_augment.c
@@ -28,7 +28,7 @@ static int attach_prog(struct bpf_link **link, struct bpf_program *prog, const c
return attach_err;
}
-int augmented_syscalls__prepare(void)
+int augmented_syscalls__prepare(bool inherit)
{
struct bpf_program *prog;
char buf[128];
@@ -40,12 +40,18 @@ int augmented_syscalls__prepare(void)
return -errno;
}
+ skel->rodata->inherit = inherit;
+
/*
- * Disable attaching the BPF programs except for sys_enter and
- * sys_exit that tail call into this as necessary.
+ * Disable attaching the BPF programs other than those attached
+ * explicitly by augmented_syscalls__attach(), the rest are reached by
+ * tail calls.
*/
bpf_object__for_each_program(prog, skel->obj) {
- if (prog != skel->progs.sys_enter && prog != skel->progs.sys_exit)
+ if (prog != skel->progs.sys_enter && prog != skel->progs.sys_exit &&
+ prog != skel->progs.sched_process_fork &&
+ prog != skel->progs.sched_process_exit &&
+ prog != skel->progs.sched_process_exec)
bpf_program__set_autoattach(prog, /*autoattach=*/false);
}
@@ -63,13 +69,42 @@ int augmented_syscalls__prepare(void)
return err;
}
+ return 0;
+}
+
+int augmented_syscalls__attach(void)
+{
+ int err;
+
+ if (skel == NULL)
+ return 0;
+
/*
- * Only sys_enter and sys_exit are attached, the remaining programs are
- * reached by tail calls. Attach them explicitly and, on failure, undo
- * any partial attachment: leaving sys_enter live on
- * raw_syscalls:sys_enter would keep running a BPF program for every
- * syscall on the system for a perf trace session that never starts.
+ * Attaching is deliberately separate from, and a lot later than,
+ * loading: these are system wide tracepoint programs, so from the
+ * moment they are attached they are the only thing deciding which
+ * tasks and syscalls are traced. Going live before the pid and
+ * syscall maps are populated would mean a target that forked in the
+ * meantime was never picked up by sched_process_fork() below.
+ *
+ * Attach explicitly, so that a failure part way through can undo what
+ * came before it: leaving sys_enter live on raw_syscalls:sys_enter
+ * would keep running a BPF program for every syscall on the system for
+ * a perf trace session that never starts.
+ *
+ * The scheduler programs maintain the pid maps, and are attached first
+ * so that no fork, exit or exec can be missed between sys_enter going
+ * live and the maps being maintained.
*/
+ if (attach_prog(&skel->links.sched_process_fork, skel->progs.sched_process_fork,
+ "sched_process_fork"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sched_process_exit, skel->progs.sched_process_exit,
+ "sched_process_exit"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sched_process_exec, skel->progs.sched_process_exec,
+ "sched_process_exec"))
+ goto out_cleanup;
if (attach_prog(&skel->links.sys_enter, skel->progs.sys_enter, "sys_enter"))
goto out_cleanup;
if (attach_prog(&skel->links.sys_exit, skel->progs.sys_exit, "sys_exit"))
@@ -81,6 +116,13 @@ int augmented_syscalls__prepare(void)
err = attach_err;
/* Destroys every link attached above along with the skeleton. */
augmented_syscalls__cleanup();
+ /*
+ * Tearing the skeleton down closes file descriptors and frees memory,
+ * either of which may overwrite errno. Restore it so that a caller
+ * reporting this with "%m" describes the attach failure rather than
+ * whatever the teardown happened to do last.
+ */
+ errno = -err;
return err;
}
@@ -127,17 +169,29 @@ int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids)
bool value = true;
int err = 0;
- if (skel == NULL)
+ if (skel == NULL || nr == 0)
return 0;
+ /*
+ * Tell the BPF program that the pids_filtered map is in use. Without
+ * this it would have to look up every task in an empty map, on every
+ * syscall on the system, to find out that nothing is filtered.
+ */
for (size_t i = 0; i < nr; ++i) {
err = bpf_map__update_elem(skel->maps.pids_filtered, &pids[i],
sizeof(*pids), &value, sizeof(value),
BPF_ANY);
if (err)
- break;
+ return err;
}
- return err;
+ /*
+ * Publish the filter only now that the map is fully populated.
+ * augmented_syscalls__attach() has not run yet, so nothing is reading
+ * either of them, but keeping the flag and the map consistent means
+ * the ordering stays correct however the callers are rearranged.
+ */
+ skel->bss->has_pids_filtered = true;
+ return 0;
}
/*
@@ -160,45 +214,15 @@ int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids)
return err;
}
/*
- * Set the flag only once every target is in the map. The BPF programs
- * are attached by this point, so flipping it first would have them
- * filter against a partially populated map and drop syscalls made by
- * the targets that had not been added yet.
+ * Set the flag only once every target is in the map, so that the two
+ * are never inconsistent. Publishing it first would, once the
+ * programs are attached, have them filter against a partially
+ * populated map and drop syscalls made by targets not yet added.
*/
skel->bss->has_pids_to_trace = true;
return 0;
}
-int augmented_syscalls__add_target_pid(pid_t pid)
-{
- bool value = true;
-
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return 0;
-
- return bpf_map__update_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
- &value, sizeof(value), BPF_ANY);
-}
-
-int augmented_syscalls__del_target_pid(pid_t pid)
-{
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return 0;
-
- return bpf_map__delete_elem(skel->maps.pids_to_trace, &pid, sizeof(pid), 0);
-}
-
-bool augmented_syscalls__has_target_pid(pid_t pid)
-{
- bool value;
-
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return false;
-
- return bpf_map__lookup_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
- &value, sizeof(value), 0) == 0;
-}
-
/*
* Populate syscalls in the BPF syscalls_to_trace map:
* - not_syscalls: true if '!' prefix was specified (blacklist mode: trace
diff --git a/tools/perf/util/trace_augment.h b/tools/perf/util/trace_augment.h
index 56f4dbab7d4b..f9eecff7efad 100644
--- a/tools/perf/util/trace_augment.h
+++ b/tools/perf/util/trace_augment.h
@@ -8,14 +8,12 @@ struct evlist;
#ifdef HAVE_BPF_SKEL
-int augmented_syscalls__prepare(void);
+int augmented_syscalls__prepare(bool inherit);
+int augmented_syscalls__attach(void);
int augmented_syscalls__create_bpf_output(struct evlist *evlist);
void augmented_syscalls__setup_bpf_output(void);
int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids);
int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids);
-int augmented_syscalls__add_target_pid(pid_t pid);
-int augmented_syscalls__del_target_pid(pid_t pid);
-bool augmented_syscalls__has_target_pid(pid_t pid);
int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls);
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd);
struct bpf_program *augmented_syscalls__find_by_title(const char *name);
@@ -24,11 +22,16 @@ void augmented_syscalls__cleanup(void);
#else /* !HAVE_BPF_SKEL */
-static inline int augmented_syscalls__prepare(void)
+static inline int augmented_syscalls__prepare(bool inherit __maybe_unused)
{
return -1;
}
+static inline int augmented_syscalls__attach(void)
+{
+ return 0;
+}
+
static inline int augmented_syscalls__create_bpf_output(struct evlist *evlist __maybe_unused)
{
return -1;
@@ -50,21 +53,6 @@ static inline int augmented_syscalls__set_target_pids(unsigned int nr __maybe_un
return 0;
}
-static inline int augmented_syscalls__add_target_pid(pid_t pid __maybe_unused)
-{
- return 0;
-}
-
-static inline int augmented_syscalls__del_target_pid(pid_t pid __maybe_unused)
-{
- return 0;
-}
-
-static inline bool augmented_syscalls__has_target_pid(pid_t pid __maybe_unused)
-{
- return false;
-}
-
static inline int augmented_syscalls__set_target_syscalls(unsigned int nr __maybe_unused,
int *syscall_ids __maybe_unused,
bool not_syscalls __maybe_unused)
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 06/13] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (4 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 05/13] perf trace: Handle fork and exit directly in BPF filter maps Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 07/13] perf test common: Do not globally disable tracing events in clear_all_probes Ian Rogers
` (7 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
test_task_analyzer.sh writes perf.data and temporary files directly into
the current working directory, causing collisions when running tests in
parallel.
As a temporary measure until `perf script report` supports an input file
option, resolve perfdir to an absolute path, change directory into $tmpdir
for the test duration, and clean up in the exit trap. Remove the
(exclusive) tag so the test runs in parallel.
perfdir is derived from $0, which may be relative, so it has to be
resolved before the cd into $tmpdir, otherwise both PERF_EXEC_PATH and
the cleanup trap point at paths that no longer exist.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/test_task_analyzer.sh | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/test_task_analyzer.sh b/tools/perf/tests/shell/test_task_analyzer.sh
index 0314412e63b4..6f729d9508f8 100755
--- a/tools/perf/tests/shell/test_task_analyzer.sh
+++ b/tools/perf/tests/shell/test_task_analyzer.sh
@@ -1,8 +1,13 @@
#!/bin/bash
-# perf script task-analyzer tests (exclusive)
+# perf script task-analyzer tests
# SPDX-License-Identifier: GPL-2.0
+# Resolve the source directory before changing the working directory below,
+# $0 may be a relative path and would no longer resolve from $tmpdir.
+perfdir=$(cd "$(dirname "$0")/../.." && pwd)
+
tmpdir=$(mktemp -d /tmp/perf-script-task-analyzer-XXXXX)
+cd "$tmpdir" || exit 1
# TODO: perf script report only supports input from the CWD perf.data file, make
# it support input from any file.
perfdata="perf.data"
@@ -11,7 +16,6 @@ csvsummary="$tmpdir/csvsummary"
err=0
# set PERF_EXEC_PATH to find scripts in the source directory
-perfdir=$(dirname "$0")/../..
if [ -e "$perfdir/scripts/python/Perf-Trace-Util" ]; then
export PERF_EXEC_PATH=$perfdir
fi
@@ -20,8 +24,7 @@ fi
export ASAN_OPTIONS=detect_leaks=0
cleanup() {
- rm -f "${perfdata}"
- rm -f "${perfdata}".old
+ cd "$perfdir" || cd /tmp || exit
rm -rf "$tmpdir"
trap - exit term int
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 07/13] perf test common: Do not globally disable tracing events in clear_all_probes
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (5 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 06/13] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 08/13] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive Ian Rogers
` (6 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
`echo 0 > /sys/kernel/debug/tracing/events/enable` disables tracepoint
events system-wide. When running tests in parallel, this kills active
tracing and recording sessions in concurrent tests (such as perf trace
and perf record).
Remove the global event disable from clear_all_probes().
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/common/init.sh | 1 -
1 file changed, 1 deletion(-)
diff --git a/tools/perf/tests/shell/common/init.sh b/tools/perf/tests/shell/common/init.sh
index cbfc78bec974..d2c7a31e2c6f 100644
--- a/tools/perf/tests/shell/common/init.sh
+++ b/tools/perf/tests/shell/common/init.sh
@@ -132,7 +132,6 @@ check_uprobes_available()
clear_all_probes()
{
- echo 0 > /sys/kernel/debug/tracing/events/enable
check_kprobes_available && echo > /sys/kernel/debug/tracing/kprobe_events
check_uprobes_available && echo > /sys/kernel/debug/tracing/uprobe_events
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 08/13] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (6 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 07/13] perf test common: Do not globally disable tracing events in clear_all_probes Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 09/13] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, " Ian Rogers
` (5 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
The probe name `vfs_getname` was hardcoded, causing collisions when
tests ran concurrently. Furthermore, `cleanup_probe_vfs_getname()` used
`perf probe -d probe:vfs_getname*`, deleting probes registered by other
parallel tests.
Scope the probe name to the pid, and rename it to `getname_flags_$$` so
that it no longer begins with "vfs_getname". perf trace calls
evlist__add_vfs_getname(), which opens every event matching a hardcoded
"probe:vfs_getname*" wildcard, so a perf trace run by any other test
would otherwise pin this probe and make `perf probe -d` fail with
-EBUSY. That also unblocks making the perf trace tests non-exclusive
later in this series.
Enumerate the probes to record and to delete from `perf probe -l`,
matching `^probe:${vfs_getname}(_[[:digit:]]+)?$` exactly, rather than
globbing on `${vfs_getname}*`. perf probe appends _1, _2, ... when
getname_flags is inlined at more than one call site, so the variants do
have to be matched, but since the name now ends in a pid a trailing
wildcard would also match the probes of a test whose pid merely starts
with this one's, e.g. 123 and 1234.
Remove the `(exclusive)` tag from probe_vfs_getname.sh and
record+script_probe_vfs_getname.sh so they run concurrently in pass 1.
trace+probe_vfs_getname.sh has to stay exclusive: it is the one test
that wants to be discovered by that wildcard, so it sets vfs_getname to
a "vfs_getname_$$" name before sourcing the library, and would then pin
its siblings' probes if it ran alongside them. A comment in the test
records this.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../perf/tests/shell/lib/probe_vfs_getname.sh | 34 ++++++++++++++++---
tools/perf/tests/shell/probe_vfs_getname.sh | 3 +-
.../shell/record+script_probe_vfs_getname.sh | 18 +++++++---
.../tests/shell/trace+probe_vfs_getname.sh | 9 +++++
4 files changed, 54 insertions(+), 10 deletions(-)
diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
index 88cd0e26d5f6..89a4b6fa5ea1 100644
--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
@@ -1,12 +1,38 @@
#!/bin/bash
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
-perf probe -l 2>&1 | grep -q probe:vfs_getname
+# The name of the getname_flags probe added and removed below.
+#
+# It is scoped to the pid so that tests running in parallel do not collide,
+# and it deliberately does not start with "vfs_getname": perf trace calls
+# evlist__add_vfs_getname(), which opens everything matching the hardcoded
+# "probe:vfs_getname*" wildcard, so a perf trace running in another test would
+# otherwise pin this probe and make the 'perf probe -d' below fail with -EBUSY.
+#
+# trace+probe_vfs_getname.sh is the one test that does want to be found that
+# way, so it sets vfs_getname itself before sourcing this file, and is
+# (exclusive) as a result.
+: "${vfs_getname:=getname_flags_$$}"
+
+# Print the probes add_probe_vfs_getname() created. perf probe appends _1, _2,
+# ... when getname_flags is inlined at more than one call site, so there can be
+# several. Match them exactly rather than with a "${vfs_getname}*" glob: the
+# name ends in a pid, so such a glob would also match the probes of a test
+# whose pid merely starts with this one's, e.g. 123 and 1234.
+probes_vfs_getname() {
+ perf probe -l 2>/dev/null | awk '{print $1}' |
+ grep -E "^probe:${vfs_getname}(_[[:digit:]]+)?$"
+}
+
+[ -n "$(probes_vfs_getname)" ]
had_vfs_getname=$?
cleanup_probe_vfs_getname() {
if [ $had_vfs_getname -eq 1 ] ; then
- perf probe -q -d probe:vfs_getname*
+ local probe
+ for probe in $(probes_vfs_getname); do
+ perf probe -q -d "$probe"
+ done
fi
}
@@ -33,8 +59,8 @@ add_probe_vfs_getname() {
return 2
fi
- perf probe -q "vfs_getname=getname_flags:${line} pathname=result->name:string" || \
- perf probe $add_probe_verbose "vfs_getname=getname_flags:${line} pathname=filename:ustring" || return 1
+ perf probe -q "${vfs_getname}=getname_flags:${line} pathname=result->name:string" || \
+ perf probe $add_probe_verbose "${vfs_getname}=getname_flags:${line} pathname=filename:ustring" || return 1
fi
}
diff --git a/tools/perf/tests/shell/probe_vfs_getname.sh b/tools/perf/tests/shell/probe_vfs_getname.sh
index 5fe5682c28ce..05f1d50732b6 100755
--- a/tools/perf/tests/shell/probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/probe_vfs_getname.sh
@@ -1,6 +1,5 @@
#!/bin/bash
-# Add vfs_getname probe to get syscall args filenames (exclusive)
-
+# Add vfs_getname probe to get syscall args filenames
# SPDX-License-Identifier: GPL-2.0
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
diff --git a/tools/perf/tests/shell/record+script_probe_vfs_getname.sh b/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
index 002f7037f182..1d4fb4a4fbfe 100755
--- a/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Use vfs_getname probe to get syscall args filenames (exclusive)
+# Use vfs_getname probe to get syscall args filenames
# Uses the 'perf test shell' library to add probe:vfs_getname to the system
# then use it with 'perf record' using 'touch' to write to a temp file, then
@@ -17,22 +17,32 @@ skip_if_no_perf_probe || exit 2
# shellcheck source=lib/probe_vfs_getname.sh
. "$(dirname "$0")/lib/probe_vfs_getname.sh"
+# shellcheck disable=SC2154 # vfs_getname is assigned in lib/probe_vfs_getname.sh
record_open_file() {
echo "Recording open file:"
# Check presence of libtraceevent support to run perf record
- skip_no_probe_record_support "probe:vfs_getname*"
+ skip_no_probe_record_support
if [ $? -eq 2 ]; then
echo "WARN: Skipping test record_open_file. No libtraceevent support"
return 2
fi
- perf record -o ${perfdata} -e probe:vfs_getname\* touch $file
+ # Record every probe the inlining of getname_flags produced, naming
+ # them exactly rather than with a "${vfs_getname}*" glob, which would
+ # also match the probes of a test whose pid starts with this one's.
+ local events
+ events=$(probes_vfs_getname | paste -sd, -)
+ if [ -z "${events}" ] ; then
+ echo "FAIL: no ${vfs_getname} probe to record"
+ return 1
+ fi
+ perf record -o ${perfdata} -e "${events}" touch $file
}
perf_script_filenames() {
echo "Looking at perf.data file for vfs_getname records for the file we touched:"
perf script -i ${perfdata} | \
- grep -E " +touch +[0-9]+ +\[[0-9]+\] +[0-9]+\.[0-9]+: +probe:vfs_getname[_0-9]*: +\([[:xdigit:]]+\) +pathname=\"${file}\""
+ grep -E " +touch +[0-9]+ +\[[0-9]+\] +[0-9]+\.[0-9]+: +probe:${vfs_getname}(_[0-9]+)?: +\([[:xdigit:]]+\) +pathname=\"${file}\""
}
add_probe_vfs_getname
diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
index 7a0b1145d0cd..146305f4d549 100755
--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
@@ -10,6 +10,13 @@
# SPDX-License-Identifier: GPL-2.0
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
+# This test must stay exclusive, and is the only one of the probe tests that
+# does: it does not name the event it uses. perf trace discovers it with the
+# hardcoded "probe:vfs_getname*" wildcard in evlist__add_vfs_getname(), so the
+# probe has to carry that prefix, and a parallel run of this test would then
+# also match, and pin, the probes of the other tests. The sibling tests avoid
+# all of this by using a name that the wildcard cannot reach.
+
# shellcheck source=lib/probe.sh
. "$(dirname $0)"/lib/probe.sh
@@ -17,6 +24,8 @@ skip_if_no_perf_probe || exit 2
skip_if_no_perf_trace || exit 2
[ "$(id -u)" = 0 ] || exit 2
+# shellcheck disable=SC2034 # consumed by lib/probe_vfs_getname.sh
+vfs_getname="vfs_getname_$$"
. "$(dirname $0)"/lib/probe_vfs_getname.sh
trace_open_vfs_getname() {
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 09/13] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, and make non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (7 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 08/13] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 10/13] perf test trace_summary: Improve error diagnostics Ian Rogers
` (4 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
The uprobe name was not scoped to PID, and concurrent writes to
`/sys/kernel/debug/tracing/uprobe_events` can occasionally return
`-EBUSY` when another process holds the tracefs inode lock.
Scope the probe event name with `$$` (`inet_pton_$$=inet_pton`) and add
a retry loop with backoff for uprobe addition. Drop the
`(exclusive)` tag so the test can run in parallel during pass 1.
A PID scoped probe is no longer cleaned up by any other test, so add an
EXIT/TERM/INT trap to delete it, otherwise an interrupted run leaks the
uprobe into the system. The trap is installed only after the root and
IPv6 checks that `exit 2` to skip the test, as trap_cleanup() exits 1
and would otherwise turn those skips into failures. Deletion enumerates
the probes from `perf probe -l`, matching
`^probe_libc:inet_pton_$$(_[[:digit:]]+)?$` exactly, rather than reading
$event_name: a signal arriving after perf probe injected the uprobe but
before the assignment completed would leave that variable empty and leak
the probe, and an `inet_pton_$$*` glob would reach the probe of a test
whose pid merely starts with this one's.
While here use mktemp rather than mktemp -u for the temporary files:
this test runs as root in a world writable /tmp, and predicting a name
without creating it allows another user to win the race and plant a
symlink. The perf.data check becomes -s rather than -e as mktemp now
pre-creates an empty file.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../shell/record+probe_libc_inet_pton.sh | 83 ++++++++++++++-----
1 file changed, 63 insertions(+), 20 deletions(-)
diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index eca629ee83f0..3eb51426373b 100755
--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# probe libc's inet_pton & backtrace it with ping (exclusive)
+# probe libc's inet_pton & backtrace it with ping
# Installs a probe on libc's inet_pton function, that will use uprobes,
# then use 'perf trace' on a ping to localhost asking for just one packet
@@ -21,20 +21,30 @@ nm -Dg $libc 2>/dev/null | grep -F -q inet_pton || exit 254
event_pattern='probe_libc:inet_pton(_[[:digit:]]+)?'
add_libc_inet_pton_event() {
+ local attempts=0
+ while [ $attempts -lt 3 ]; do
+ event_name=$(perf probe -f -x $libc -a "inet_pton_$$=inet_pton" 2>&1 | \
+ awk -v ep="$event_pattern" -v l="$libc" '$0 ~ ep && $0 ~ \
+ ("\\(on inet_pton in " l "\\)") {print $1}' | head -n 1)
+
+ if [ -n "$event_name" ]; then
+ return 0
+ fi
+ attempts=$((attempts + 1))
+ sleep 0.1
+ done
- event_name=$(perf probe -f -x $libc -a inet_pton 2>&1 | \
- awk -v ep="$event_pattern" -v l="$libc" '$0 ~ ep && $0 ~ \
- ("\\(on inet_pton in " l "\\)") {print $1}' | head -n 1)
-
- if [ $? -ne 0 ] || [ -z "$event_name" ] ; then
- printf "FAIL: could not add event\n"
- return 1
- fi
+ printf "FAIL: could not add event\n"
+ return 1
}
trace_libc_inet_pton_backtrace() {
- expected=`mktemp -u /tmp/expected.XXX`
+ # Create the files rather than just reserving names with mktemp -u:
+ # this runs as root and /tmp is world writable, so a predictable name
+ # that is written to later can be pre-created as a symlink by an
+ # unprivileged user and used to clobber an arbitrary file.
+ expected=$(mktemp /tmp/expected.XXX)
echo "ping[][0-9 \.:]+$event_name: \([[:xdigit:]]+\)" > $expected
echo ".*inet_pton\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
@@ -50,8 +60,8 @@ trace_libc_inet_pton_backtrace() {
;;
esac
- perf_data=`mktemp -u /tmp/perf.data.XXX`
- perf_script=`mktemp -u /tmp/perf.script.XXX`
+ perf_data=$(mktemp /tmp/perf.data.XXX)
+ perf_script=$(mktemp /tmp/perf.script.XXX)
# Check presence of libtraceevent support to run perf record
skip_no_probe_record_support "$event_name/$eventattr/"
@@ -61,9 +71,10 @@ trace_libc_inet_pton_backtrace() {
fi
perf record -e $event_name/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
- # check if perf data file got created in above step.
- if [ ! -e $perf_data ]; then
- printf "FAIL: perf record failed to create \"%s\" \n" "$perf_data"
+ # Check perf record actually wrote data. mktemp already created the
+ # file, so test that it is non-empty rather than that it exists.
+ if [ ! -s $perf_data ]; then
+ printf "FAIL: perf record failed to write \"%s\" \n" "$perf_data"
return 1
fi
perf script -i $perf_data | tac | grep -m1 ^ping -B9 | tac > $perf_script
@@ -97,21 +108,53 @@ trace_libc_inet_pton_backtrace() {
# even if the perf script output does not match.
}
+# Print the pid scoped uprobes this test may have created. perf probe appends
+# _1, _2, ... when the name is already taken, so match those too, but anchor
+# the match: an "inet_pton_$$*" glob would also match the probe of a test whose
+# pid merely starts with this one's, e.g. 123 and 1234.
+libc_inet_pton_events() {
+ perf probe -l 2>/dev/null | awk '{print $1}' |
+ grep -E "^probe_libc:inet_pton_$$(_[[:digit:]]+)?$"
+}
+
delete_libc_inet_pton_event() {
+ # Ask the kernel what is actually there rather than trusting
+ # $event_name: a signal arriving after perf probe injected the uprobe
+ # but before the assignment to event_name completed would otherwise
+ # leave the variable empty and leak the probe.
+ local probe
+ for probe in $(libc_inet_pton_events); do
+ perf probe -q -d "$probe"
+ done
+}
- if [ -n "$event_name" ] ; then
- perf probe -q -d $event_name
- fi
+cleanup() {
+ rm -f ${perf_data} ${perf_script} ${expected}
+ delete_libc_inet_pton_event
+
+ trap - EXIT TERM INT
+}
+
+trap_cleanup() {
+ cleanup
+ exit 1
}
# Check for IPv6 interface existence
ip a sh lo | grep -F -q inet6 || exit 2
[ "$(id -u)" = 0 ] || exit 2
+# Install the trap only now that the skips above are out of the way: it exits
+# 1, so arming it any earlier would turn an 'exit 2' skip into a failure.
+#
+# The event name is pid scoped, so unlike the old fixed name an orphan left
+# behind by an interrupted run is never overwritten by a later run: it would
+# stay in the kernel forever. Always clean up, including on a signal.
+trap trap_cleanup EXIT TERM INT
+
skip_if_no_perf_probe && \
add_libc_inet_pton_event && \
trace_libc_inet_pton_backtrace
err=$?
-rm -f ${perf_data} ${perf_script} ${expected}
-delete_libc_inet_pton_event
+cleanup
exit $err
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 10/13] perf test trace_summary: Improve error diagnostics
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (8 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 09/13] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, " Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 11/13] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive Ian Rogers
` (3 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
When pattern matching fails in test_perf_trace(), print the command
that failed along with the actual match count, the matching lines
found, and the first 15 lines of output to aid debugging.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_summary.sh | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/trace_summary.sh b/tools/perf/tests/shell/trace_summary.sh
index b80dea77cec6..f975176247b5 100755
--- a/tools/perf/tests/shell/trace_summary.sh
+++ b/tools/perf/tests/shell/trace_summary.sh
@@ -28,10 +28,14 @@ test_perf_trace() {
count=$(grep -E -c -m 3 "${search}" ${OUTPUT})
if [ "${count}" != "3" ]; then
- echo "Error: cannot find enough pattern ${search} in the output"
- cat ${OUTPUT}
- rm -f ${OUTPUT}
- exit 1
+ echo "Error: cannot find enough pattern ${search} (count=${count}) in output of:"
+ echo "Error: perf trace ${args} -- ${workload}"
+ echo "Error: matched lines:"
+ grep -E "${search}" ${OUTPUT} || echo "none"
+ echo "Error: first 15 lines of output:"
+ head -n 15 ${OUTPUT}
+ rm -f ${OUTPUT}
+ exit 1
fi
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 11/13] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (9 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 10/13] perf test trace_summary: Improve error diagnostics Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 12/13] perf test trace_summary: Make non-exclusive Ian Rogers
` (2 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
trace_btf_general.sh used `--max-events=1` with `perf trace` on
commands such as `mv`, `echo`, and `sleep`. When background activity
occurs or tests run in parallel, `perf trace` can capture an event
from an unrelated process and exit prematurely before recording the
target command's syscalls.
Drop `--max-events=1` and let tracing run until the command completes,
checking for the expected output with grep (matching trace_btf_enum.sh).
Remove the (exclusive) tag so the test runs in parallel.
Running perf trace in parallel is only safe now that the probe tests no
longer name their probes "vfs_getname...": perf trace opens everything
matching a hardcoded "probe:vfs_getname*" wildcard, which used to pin
those probes and make their cleanup fail with -EBUSY.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_btf_general.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/trace_btf_general.sh b/tools/perf/tests/shell/trace_btf_general.sh
index 7a94a5743924..4d654b687a4e 100755
--- a/tools/perf/tests/shell/trace_btf_general.sh
+++ b/tools/perf/tests/shell/trace_btf_general.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# perf trace BTF general tests (exclusive)
+# perf trace BTF general tests
# SPDX-License-Identifier: GPL-2.0
err=0
@@ -27,7 +27,7 @@ check_vmlinux() {
trace_test_string() {
echo "Testing perf trace's string augmentation"
- output="$(perf trace --sort-events -e renameat* --max-events=1 -- mv ${file1} ${file2} 2>&1)"
+ output="$(perf trace --sort-events -e renameat* -- mv ${file1} ${file2} 2>&1)"
if ! echo "$output" | grep -q -E "^mv/[0-9]+ renameat(2)?\(.*, \"${file1}\", .*, \"${file2}\", .*\) += +[0-9]+$"
then
printf "String augmentation test failed, output:\n$output\n"
@@ -38,7 +38,7 @@ trace_test_string() {
trace_test_buffer() {
echo "Testing perf trace's buffer augmentation"
# echo will insert a newline (\10) at the end of the buffer
- output="$(perf trace --sort-events -e write --max-events=1 -- echo "${buffer}" 2>&1)"
+ output="$(perf trace --sort-events -e write -- echo "${buffer}" 2>&1)"
if ! echo "$output" | grep -q -E "^echo/[0-9]+ write\([0-9]+, ${buffer}.*, [0-9]+\) += +[0-9]+$"
then
printf "Buffer augmentation test failed, output:\n$output\n"
@@ -48,7 +48,7 @@ trace_test_buffer() {
trace_test_struct_btf() {
echo "Testing perf trace's struct augmentation"
- output="$(perf trace --sort-events -e clock_nanosleep --force-btf --max-events=1 -- sleep 1 2>&1)"
+ output="$(perf trace --sort-events -e clock_nanosleep --force-btf -- sleep 1 2>&1)"
if ! echo "$output" | grep -q -E "^sleep/[0-9]+ clock_nanosleep\(0, 0, \{1,.*\}, 0x[0-9a-f]+\) += +[0-9]+$"
then
printf "BTF struct augmentation test failed, output:\n$output\n"
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 12/13] perf test trace_summary: Make non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (10 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 11/13] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 6:42 ` [PATCH v1 13/13] perf test uprobe_from_different_cu: Scope probe name to PID Ian Rogers
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
trace_summary.sh tests various summary modes of `perf trace`. It already
directs output to a unique temporary file without polluting the current
working directory.
Remove the (exclusive) tag so it can run concurrently in parallel test
runs.
Running perf trace in parallel is only safe now that the probe tests no
longer name their probes "vfs_getname...": perf trace opens everything
matching a hardcoded "probe:vfs_getname*" wildcard, which used to pin
those probes and make their cleanup fail with -EBUSY.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_summary.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/trace_summary.sh b/tools/perf/tests/shell/trace_summary.sh
index f975176247b5..e2834bc4eee6 100755
--- a/tools/perf/tests/shell/trace_summary.sh
+++ b/tools/perf/tests/shell/trace_summary.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# perf trace summary (exclusive)
+# perf trace summary
# SPDX-License-Identifier: GPL-2.0
# Check that perf trace works with various summary mode
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v1 13/13] perf test uprobe_from_different_cu: Scope probe name to PID
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (11 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 12/13] perf test trace_summary: Make non-exclusive Ian Rogers
@ 2026-09-17 6:42 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 6:42 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo, Namhyung Kim
Cc: Peter Zijlstra, Ingo Molnar, Jiri Olsa, Adrian Hunter,
James Clark, linux-perf-users, linux-kernel, Ian Rogers
The test builds a binary in a per-run temporary directory and probes
its foo function. The directory name is unique, but perf probe derives
the event name from the probed function and the group name from the
binary's basename, so every run registers the same probe_testfile:foo
event.
Running the test concurrently with itself, as 'perf test -r3' does,
therefore fails in all but one of the runs with:
Error: event "foo" already exists.
Hint: Remove existing event by 'perf probe -d'
and a losing run's cleanup goes on to delete the winning run's probe
out from under it.
Name the event after the pid, foo_$$, so that parallel runs no longer
collide. This lets the test stay in the parallel pass rather than
having to be marked (exclusive).
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../perf/tests/shell/test_uprobe_from_different_cu.sh | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
index 7adf9755d6de..47c99d93436b 100755
--- a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
+++ b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
@@ -18,12 +18,19 @@ fi
temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX)
+# The name of the uprobe added and removed below. The probe is placed on
+# ${temp_dir}/testfile, but perf probe derives the event name from the probed
+# function and the group name from the binary's basename, so every run would
+# otherwise share one probe_testfile:foo event, and a concurrent run would
+# fail with 'event "foo" already exists'. Scope the event name to the pid.
+probe_name="foo_$$"
+
cleanup()
{
trap - EXIT TERM INT
if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then
echo "--- Cleaning up ---"
- perf probe -x ${temp_dir}/testfile -d foo || true
+ perf probe -x ${temp_dir}/testfile -d ${probe_name} || true
rm -f "${temp_dir}/"*
rmdir "${temp_dir}"
fi
@@ -84,6 +91,6 @@ gcc -g -Og -c ${temp_dir}/testfile-main.c -o ${temp_dir}/testfile-main.o
gcc -g -Og -o ${temp_dir}/testfile ${temp_dir}/testfile-foo.o ${temp_dir}/testfile-main.o
perf probe -x ${temp_dir}/testfile --funcs foo | grep "foo"
-perf probe -x ${temp_dir}/testfile foo
+perf probe -x ${temp_dir}/testfile ${probe_name}=foo
cleanup
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive
2026-09-17 6:42 [PATCH v1 00/13] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (12 preceding siblings ...)
2026-09-17 6:42 ` [PATCH v1 13/13] perf test uprobe_from_different_cu: Scope probe name to PID Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 01/14] perf trace: Include the headers declaring pid_t and strcmp Ian Rogers
` (13 more replies)
13 siblings, 14 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
perf trace's BPF augmentation attaches to raw_syscalls:sys_enter and
raw_syscalls:sys_exit system wide, and used the program return value to
decide whether a syscall was interesting. Returning 0 from a
BPF_PROG_TYPE_TRACEPOINT program makes perf_trace_run_bpf_submit() drop
the event for every listener on that tracepoint, not just for the perf
trace that installed the program. Any concurrent perf trace, perf record
or ftrace session watching raw_syscalls therefore lost events, which is
one of the reasons so many of the perf trace and perf probe shell tests
had to be marked (exclusive) and run on their own.
Patch 1 is an independent build fix for the two files the rest of the
series goes on to rework.
Patches 2 to 6 fix perf trace. They stop the return value being used as
a filter and do the filtering in BPF maps instead, fix argument handling
for the __data_loc internal tracepoint fields that syscalls:sys_enter_*
gained in 6.19, stop the sys_exit program array tail calling a sys_enter
augmenter, and replace the userspace PERF_RECORD_FORK/PERF_RECORD_EXIT
bookkeeping with BTF-typed raw tracepoint programs on
sched_process_{fork,exit,exec}. A task is then registered before its
first syscall and evicted in do_exit(), rather than whenever userspace
next drains the ring buffer.
Patches 7 to 14 deal with the tests. Several collided with each other
through global state rather than through perf trace: fixed probe names,
clear_all_probes() disabling tracing events globally, and perf trace's
hardcoded "probe:vfs_getname*" wildcard pinning probes belonging to
other tests. With those scoped to a pid they can drop (exclusive) and
run in parallel again.
Tested on x86_64. The trace and probe tests pass under 'perf test -r3',
which runs the repeats concurrently. Every patch builds individually,
and the series also builds with BUILD_BPF_SKEL=0.
Changes since v1:
- New patch 1 includes <sys/types.h> and <string.h> for the pid_t and
strcmp() uses that were relying on the include chain happening to
drag them in, which does not hold on libcs such as musl.
- Patch 5 no longer returns success when the event qualifier filter
string fails to allocate. err now defaults to 0 because either
tracepoint may legitimately be absent, so the ENOMEM path has to set
the error itself rather than rely on that default. It also includes
<stdbool.h> for the bool parameters it adds to trace_augment.h.
- Patch 7 removes the temporary directory if the cd into it fails.
That happens before the cleanup trap is installed, so the directory
would otherwise be left behind in /tmp.
Ian Rogers (14):
perf trace: Include the headers declaring pid_t and strcmp
perf trace: Start BPF summary before starting workload
perf trace: Skip internal tracepoint fields in formatting and beauty
map
perf trace: Do not set unaugmented BPF program on sys_exit map
perf trace: Filter events in BPF and avoid tracepoint vetoes
perf trace: Handle fork and exit directly in BPF filter maps
perf test test_task_analyzer: Isolate in temporary directory and make
non-exclusive
perf test common: Do not globally disable tracing events in
clear_all_probes
perf test probe_vfs_getname: Scope probe name to PID and make
non-exclusive
perf test record+probe_libc_inet_pton: Scope event to PID, add
retries, and make non-exclusive
perf test trace_summary: Improve error diagnostics
perf test trace_btf_general: Drop --max-events=1 and make
non-exclusive
perf test trace_summary: Make non-exclusive
perf test uprobe_from_different_cu: Scope probe name to PID
tools/perf/Documentation/perf-trace.txt | 5 +
tools/perf/builtin-trace.c | 335 ++++++++++++++----
tools/perf/tests/shell/common/init.sh | 1 -
.../perf/tests/shell/lib/probe_vfs_getname.sh | 34 +-
tools/perf/tests/shell/probe_vfs_getname.sh | 3 +-
.../shell/record+probe_libc_inet_pton.sh | 83 +++--
.../shell/record+script_probe_vfs_getname.sh | 18 +-
tools/perf/tests/shell/test_task_analyzer.sh | 16 +-
.../shell/test_uprobe_from_different_cu.sh | 11 +-
.../tests/shell/trace+probe_vfs_getname.sh | 9 +
tools/perf/tests/shell/trace_btf_general.sh | 8 +-
tools/perf/tests/shell/trace_summary.sh | 14 +-
.../bpf_skel/augmented_raw_syscalls.bpf.c | 291 ++++++++++++++-
tools/perf/util/bpf_trace_augment.c | 174 ++++++++-
tools/perf/util/trace_augment.h | 27 +-
15 files changed, 888 insertions(+), 141 deletions(-)
base-commit: 91b0782fc9e9d2f0a40b5256146e014802fdbb36
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 01/14] perf trace: Include the headers declaring pid_t and strcmp
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 02/14] perf trace: Start BPF summary before starting workload Ian Rogers
` (12 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
trace_augment.h uses pid_t in the augmented_syscalls__set_filter_pids()
prototype and in the !HAVE_BPF_SKEL stub, and bpf_trace_augment.c calls
strcmp() in augmented_syscalls__find_by_title(), but neither pulls in
the header that declares what it uses. Both happen to build today only
because something else in the include chain drags <sys/types.h> and
<string.h> in first, which is not guaranteed and does not hold on libcs
such as musl that keep the POSIX namespaces strictly separated.
Include <sys/types.h> and <string.h> explicitly.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/bpf_trace_augment.c | 1 +
tools/perf/util/trace_augment.h | 1 +
2 files changed, 2 insertions(+)
diff --git a/tools/perf/util/bpf_trace_augment.c b/tools/perf/util/bpf_trace_augment.c
index a9cf2a77ded1..645819d79b6d 100644
--- a/tools/perf/util/bpf_trace_augment.c
+++ b/tools/perf/util/bpf_trace_augment.c
@@ -1,5 +1,6 @@
#include <bpf/libbpf.h>
#include <internal/xyarray.h>
+#include <string.h>
#include "bpf_skel/augmented_raw_syscalls.skel.h"
#include "debug.h"
diff --git a/tools/perf/util/trace_augment.h b/tools/perf/util/trace_augment.h
index 4f729bc67753..a1cd9a5e0213 100644
--- a/tools/perf/util/trace_augment.h
+++ b/tools/perf/util/trace_augment.h
@@ -2,6 +2,7 @@
#define TRACE_AUGMENT_H
#include <linux/compiler.h>
+#include <sys/types.h>
struct bpf_program;
struct evlist;
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 02/14] perf trace: Start BPF summary before starting workload
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
2026-09-17 16:38 ` [PATCH v2 01/14] perf trace: Include the headers declaring pid_t and strcmp Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 03/14] perf trace: Skip internal tracepoint fields in formatting and beauty map Ian Rogers
` (11 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
When using --bpf-summary, trace_start_bpf_summary() sets
skel->bss->enabled = 1. In trace__run(), trace_start_bpf_summary() was
previously invoked after evlist__start_workload().
Because evlist__start_workload() immediately unblocks the child process
by writing to its go_pipe, short-lived workloads (such as `cat /dev/null`)
can execute and complete their initial system calls before
trace_start_bpf_summary() is reached by the parent process. Furthermore,
under high system load, the child process may finish before the BPF
summary tracking is enabled in the kernel at all, causing syscall
summary tests to fail. Additionally, if initial_delay was configured,
the workload was started before sleeping.
Move trace_start_bpf_summary() to be invoked before
evlist__start_workload(), matching evlist__enable(), and ensure it
respects target.initial_delay.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 20fffc24507b..8da0c51ec380 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -4838,17 +4838,19 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
if (!target__none(&trace->opts.target) && !trace->opts.target.initial_delay)
evlist__enable(evlist);
+ if (trace->summary_bpf && !trace->opts.target.initial_delay)
+ trace_start_bpf_summary();
+
if (forks)
evlist__start_workload(evlist);
if (trace->opts.target.initial_delay) {
usleep(trace->opts.target.initial_delay * 1000);
evlist__enable(evlist);
+ if (trace->summary_bpf)
+ trace_start_bpf_summary();
}
- if (trace->summary_bpf)
- trace_start_bpf_summary();
-
trace->multiple_threads = perf_thread_map__pid(evlist__core(evlist)->threads, 0) == -1 ||
perf_thread_map__nr(evlist__core(evlist)->threads) > 1 ||
evlist__first(evlist)->core.attr.inherit;
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 03/14] perf trace: Skip internal tracepoint fields in formatting and beauty map
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
2026-09-17 16:38 ` [PATCH v2 01/14] perf trace: Include the headers declaring pid_t and strcmp Ian Rogers
2026-09-17 16:38 ` [PATCH v2 02/14] perf trace: Start BPF summary before starting workload Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 04/14] perf trace: Do not set unaugmented BPF program on sys_exit map Ian Rogers
` (10 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
Linux 6.19+ added __data_loc char[] internal fields for string
arguments in syscalls:sys_enter_<name> tracepoints (e.g.,
__data_loc_oldname in sys_enter_renameat2). While is_internal_field()
was added to detect them, several places did not properly account for
them:
1. In syscall_arg_fmt__init_array(), when an internal field was
skipped, the arg pointer was still incremented, causing the
subsequent argument formatters to be mismatched.
2. In syscall__scnprintf_args(), internal fields were not skipped,
causing spurious trailing arguments like ", 0, 16" to be formatted
and printed.
3. In trace__bpf_sys_enter_beauty_map(), internal fields were not
skipped, offsetting beauty array argument indices and breaking string
and buffer augmentation.
4. In trace__find_usable_bpf_prog_entry(), candidate pointer checks
matched on internal pointer fields, breaking signature compatibility
matching between syscalls for augmenter sharing. Introduce
next_user_arg() and advance both cursors with it, so that the two
argument lists are always compared at a real argument and the walk
ends when one syscall runs out of arguments rather than when one
happens to have trailing internal fields.
5. syscall__augmented_args() computed the augmented payload as
sample->raw_size - sc->args_size for any sys_enter style sample.
sc->args_size deliberately stops at the last non-internal field, so
on 6.19+ a native syscalls:sys_enter_<name> record leaves the
__data_loc words and their string payloads in the remainder. Those
bytes are not a struct augmented_arg, so
syscall_arg__scnprintf_augmented_string() read a bogus length and
walked arg->augmented.args out of bounds. This is reachable from
trace__event_handler(), which calls trace__fprintf_sys_enter() for
any evsel whose tracepoint name starts with "sys_enter_".
6. In syscall__read_info(), syscall__alloc_arg_fmts() was called before
checking and dropping the leading __syscall_nr (or nr) field, using
nr_fields - 1 unconditionally. If a tracepoint format lacks that
leading field, the allocated arg_fmt array is one entry too small and
syscall_arg_fmt__init_array() writes one entry past the end of the
heap buffer. Drop __syscall_nr/nr first and size the allocation from
the remaining fields.
Update these functions to check and skip is_internal_field() so that
arguments are correctly formatted and beauty map entries match the
expected syscall signatures, restrict syscall__augmented_args() to the
__augmented_syscalls__ bpf-output evsel, and size arg_fmt after dropping
the syscall number field.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 153 ++++++++++++++++++++++++++++---------
1 file changed, 115 insertions(+), 38 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 8da0c51ec380..af9696aadaec 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2277,15 +2277,20 @@ syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field
struct tep_format_field *last_field = NULL;
int len;
- for (; field; field = field->next, ++arg) {
- /* assume it's the last argument */
+ for (; field; field = field->next) {
+ /*
+ * Skip internal tracepoint fields (e.g., __data_loc strings in
+ * Linux 6.19+) so they do not advance the syscall arg array index.
+ */
if (is_internal_field(field))
continue;
last_field = field;
- if (arg->scnprintf)
+ if (arg->scnprintf) {
+ ++arg;
continue;
+ }
len = strlen(field->name);
@@ -2342,6 +2347,7 @@ syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field
}
}
}
+ ++arg;
}
return last_field;
@@ -2363,6 +2369,7 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
char tp_name[128];
const char *name;
struct tep_format_field *field;
+ int nr_args;
int err;
if (sc->nonexistent)
@@ -2401,24 +2408,25 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
return err;
}
- /*
- * The tracepoint format contains __syscall_nr field, so it's one more
- * than the actual number of syscall arguments.
- */
- if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
- return -ENOMEM;
-
sc->args = sc->tp_format->format.fields;
+ nr_args = sc->tp_format->format.nr_fields;
/*
* We need to check and discard the first variable '__syscall_nr'
* or 'nr' that mean the syscall number. It is needless here.
* So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
+ *
+ * Do this before allocating, and size the array from what is left, so
+ * that a format without the field does not leave
+ * syscall_arg_fmt__init_array() walking one entry past the end.
*/
if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {
sc->args = sc->args->next;
- --sc->nr_args;
+ --nr_args;
}
+ if (syscall__alloc_arg_fmts(sc, nr_args))
+ return -ENOMEM;
+
field = sc->args;
while (field) {
if (is_internal_field(field))
@@ -2636,11 +2644,17 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
if (sc->args != NULL) {
struct tep_format_field *field;
- for (field = sc->args; field;
- field = field->next, ++arg.idx, bit <<= 1) {
- if (arg.mask & bit)
+ for (field = sc->args; field; field = field->next) {
+ /* Skip internal fields so they are not printed as spurious arguments */
+ if (is_internal_field(field))
continue;
+ if (arg.mask & bit) {
+ ++arg.idx;
+ bit <<= 1;
+ continue;
+ }
+
arg.fmt = &sc->arg_fmt[arg.idx];
val = syscall_arg__val(&arg, arg.idx);
/*
@@ -2658,8 +2672,11 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
*/
if (val == 0 && !trace->show_zeros &&
!(sc->arg_fmt && sc->arg_fmt[arg.idx].show_zero) &&
- !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE))
+ !(sc->arg_fmt && sc->arg_fmt[arg.idx].strtoul == STUL_BTF_TYPE)) {
+ ++arg.idx;
+ bit <<= 1;
continue;
+ }
printed += scnprintf(bf + printed, size - printed, "%s", printed ? ", " : "");
@@ -2674,12 +2691,16 @@ static size_t syscall__scnprintf_args(struct syscall *sc, char *bf, size_t size,
size - printed, val, field->type);
if (btf_printed) {
printed += btf_printed;
+ ++arg.idx;
+ bit <<= 1;
continue;
}
}
printed += syscall_arg_fmt__scnprintf_val(&sc->arg_fmt[arg.idx],
bf + printed, size - printed, &arg, val);
+ ++arg.idx;
+ bit <<= 1;
}
} else if (IS_ERR(sc->tp_format)) {
/*
@@ -2940,7 +2961,9 @@ static int trace__fprintf_sample(struct trace *trace, struct perf_sample *sample
return printed;
}
-static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sample, int *augmented_args_size, int raw_augmented_args_size)
+static void *syscall__augmented_args(struct trace *trace, struct syscall *sc,
+ struct perf_sample *sample,
+ int *augmented_args_size, int raw_augmented_args_size)
{
/*
* For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
@@ -2958,6 +2981,24 @@ static void *syscall__augmented_args(struct syscall *sc, struct perf_sample *sam
*/
int args_size = raw_augmented_args_size ?: sc->args_size;
+ /*
+ * Augmented arguments are a perf trace specific payload, they are only
+ * ever appended to samples emitted by the BPF __augmented_syscalls__
+ * bpf-output event.
+ *
+ * Native syscalls:sys_enter_NAME tracepoints may also carry trailing
+ * data of their own: since Linux 6.19 they append __data_loc char[]
+ * fields plus the string payloads they point at. Those bytes are not a
+ * struct augmented_arg, so treating them as one would make
+ * syscall_arg__scnprintf_augmented_string() read a bogus length and
+ * walk arg->augmented.args far out of bounds.
+ *
+ * So only look for augmented arguments on the event that can actually
+ * produce them.
+ */
+ if (sample->evsel != trace->syscalls.events.bpf_output)
+ return NULL;
+
*augmented_args_size = sample->raw_size - args_size;
if (*augmented_args_size > 0) {
static uintptr_t argbuf[1024]; /* assuming single-threaded */
@@ -3016,17 +3057,13 @@ static int trace__sys_enter(struct trace *trace,
if (!(trace->duration_filter || trace->summary_only || trace->min_stack))
trace__printf_interrupted_entry(trace);
/*
- * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
- * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
- * this breaks syscall__augmented_args() check for augmented args, as we calculate
- * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
- * so when handling, say the openat syscall, we end up getting 6 args for the
- * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
- * thinking that the extra 2 u64 args are the augmented filename, so just check
- * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
+ * syscall__augmented_args() only returns a payload for the BPF
+ * __augmented_syscalls__ event, so raw_syscalls:sys_enter (which always
+ * carries all 6 possible arguments rather than sc->args_size worth) and
+ * the native syscalls:sys_enter_NAME tracepoints are both handled there.
*/
- if (evsel != trace->syscalls.events.sys_enter)
- augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
+ augmented_args = syscall__augmented_args(trace, sc, sample, &augmented_args_size,
+ trace->raw_augmented_syscalls_args_size);
ttrace->entry_time = sample->time;
ttrace->entry_cpu = sample->cpu;
msg = ttrace->entry_str;
@@ -3071,7 +3108,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sam
struct syscall *sc;
char msg[1024];
void *args, *augmented_args = NULL;
- int augmented_args_size, e_machine;
+ int augmented_args_size = 0, e_machine;
size_t printed = 0;
@@ -3089,7 +3126,8 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct perf_sample *sam
goto out_put;
args = perf_evsel__sc_tp_ptr(args, sample);
- augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
+ augmented_args = syscall__augmented_args(trace, sc, sample, &augmented_args_size,
+ trace->raw_augmented_syscalls_args_size);
printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
fprintf(trace->output, "%.*s", (int)printed, msg);
err = 0;
@@ -4121,10 +4159,16 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
if (trace->btf == NULL)
return -1;
- for (i = 0, field = sc->args; field; ++i, field = field->next) {
+ for (i = 0, field = sc->args; field; field = field->next) {
+ /* Skip internal fields to keep beauty array index aligned with syscall arguments */
+ if (is_internal_field(field))
+ continue;
+
// XXX We're only collecting pointer payloads _from_ user space
- if (!sc->arg_fmt[i].from_user)
+ if (!sc->arg_fmt[i].from_user) {
+ ++i;
continue;
+ }
struct_offset = strstr(field->type, "struct ");
if (struct_offset == NULL)
@@ -4143,8 +4187,10 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
name[cnt] = '\0';
/* cache struct's btf_type and type_id */
- if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name))
+ if (syscall_arg_fmt__cache_btf_struct(&sc->arg_fmt[i], trace->btf, name)) {
+ ++i;
continue;
+ }
bt = sc->arg_fmt[i].type;
beauty_array[i] = bt->size;
@@ -4170,7 +4216,9 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
struct tep_format_field *field_tmp;
/* find the size of the buffer that appears in pairs with buf */
- for (j = 0, field_tmp = sc->args; field_tmp; ++j, field_tmp = field_tmp->next) {
+ for (j = 0, field_tmp = sc->args; field_tmp; field_tmp = field_tmp->next) {
+ if (is_internal_field(field_tmp))
+ continue;
if (!(field_tmp->flags & TEP_FIELD_IS_POINTER) && /* only integers */
(strstr(field_tmp->name, "count") ||
strstr(field_tmp->name, "siz") || /* size, bufsiz */
@@ -4180,8 +4228,10 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
can_augment = true;
break;
}
+ ++j;
}
}
+ ++i;
}
if (can_augment)
@@ -4190,6 +4240,19 @@ static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, i
return -1;
}
+/*
+ * Advance to the first field that is a real syscall argument, so that callers
+ * walking two argument lists in step never have to reason about internal
+ * fields appearing in one list but not the other.
+ */
+static struct tep_format_field *next_user_arg(struct tep_format_field *field)
+{
+ while (field && is_internal_field(field))
+ field = field->next;
+
+ return field;
+}
+
static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace,
struct syscall *sc)
{
@@ -4197,7 +4260,7 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
/*
* We're only interested in syscalls that have a pointer:
*/
- for (field = sc->args; field; field = field->next) {
+ for (field = next_user_arg(sc->args); field; field = next_user_arg(field->next)) {
if (field->flags & TEP_FIELD_IS_POINTER)
goto try_to_find_pair;
}
@@ -4215,21 +4278,31 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
pair->bpf_prog.sys_enter == unaugmented_prog)
continue;
- for (field = sc->args, candidate_field = pair->args;
- field && candidate_field; field = field->next, candidate_field = candidate_field->next) {
+ /*
+ * Both cursors only ever point at real arguments, so the loop
+ * ends when one of the two syscalls runs out of them, rather
+ * than when one happens to have trailing internal fields.
+ */
+ field = next_user_arg(sc->args);
+ candidate_field = next_user_arg(pair->args);
+ while (field && candidate_field) {
bool is_pointer = field->flags & TEP_FIELD_IS_POINTER,
candidate_is_pointer = candidate_field->flags & TEP_FIELD_IS_POINTER;
if (is_pointer) {
- if (!candidate_is_pointer) {
+ if (!candidate_is_pointer) {
// The candidate just doesn't copies our pointer arg, might copy other pointers we want.
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
continue;
- }
+ }
} else {
if (candidate_is_pointer) {
// The candidate might copy a pointer we don't have, skip it.
goto next_candidate;
}
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
continue;
}
@@ -4250,6 +4323,8 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
goto next_candidate;
is_candidate = true;
+ field = next_user_arg(field->next);
+ candidate_field = next_user_arg(candidate_field->next);
}
if (!is_candidate)
@@ -4261,7 +4336,9 @@ static struct bpf_program *trace__find_usable_bpf_prog_entry(struct trace *trace
* more than what is common to the two syscalls.
*/
if (candidate_field) {
- for (candidate_field = candidate_field->next; candidate_field; candidate_field = candidate_field->next)
+ candidate_field = next_user_arg(candidate_field->next);
+ for (; candidate_field;
+ candidate_field = next_user_arg(candidate_field->next))
if (candidate_field->flags & TEP_FIELD_IS_POINTER)
goto next_candidate;
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 04/14] perf trace: Do not set unaugmented BPF program on sys_exit map
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (2 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 03/14] perf trace: Skip internal tracepoint fields in formatting and beauty map Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 05/14] perf trace: Filter events in BPF and avoid tracepoint vetoes Ian Rogers
` (9 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
In trace__init_syscalls_bpf_prog_array_maps(), the BPF program array map
for sys_exit (syscalls_sys_exit) was populated with the result of
trace__bpf_prog_sys_exit_fd().
When a syscall had no specific exit augmenter,
trace__find_syscall_bpf_prog() fell back to unaugmented_prog
(syscall_unaugmented). However, syscall_unaugmented is a sys_enter
program that outputs enter arguments to __augmented_syscalls__.
As a consequence, when an unaugmented syscall exited, sys_exit
tail-called syscall_unaugmented, which interpreted the exit arguments as
enter arguments and emitted a duplicate, corrupt sys_enter event into
__augmented_syscalls__ right as the syscall completed.
Fix this by:
1. Returning NULL from trace__find_syscall_bpf_prog() when looking up exit
augmenters and none is found.
2. Returning -1 from trace__bpf_prog_sys_exit_fd() when no exit program
is present.
3. Only updating map_exit_fd when prog_fd >= 0.
4. Clearing err = 0 when trace__bpf_sys_enter_beauty_map() returns
non-zero (indicating the syscall has no augmentable pointer arguments)
before continuing the loop, so a trailing run of such syscalls (e.g.
'perf trace -e close') does not leave err non-zero on return and abort
the session.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index af9696aadaec..a68d34256996 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -4117,7 +4117,12 @@ static struct bpf_program *trace__find_syscall_bpf_prog(struct trace *trace __ma
pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
prog_name, type, sc->name);
out_unaugmented:
- return unaugmented_prog;
+ /*
+ * Do not set unaugmented_prog for exit: syscall_unaugmented is a
+ * sys_enter program that outputs enter arguments. Exit without a
+ * specialized return augmenter returns 1 directly from sys_exit.
+ */
+ return !strcmp(type, "exit") ? NULL : unaugmented_prog;
}
static void trace__init_syscall_bpf_progs(struct trace *trace, int e_machine, int id)
@@ -4140,7 +4145,7 @@ static int trace__bpf_prog_sys_enter_fd(struct trace *trace, int e_machine, int
static int trace__bpf_prog_sys_exit_fd(struct trace *trace, int e_machine, int id)
{
struct syscall *sc = trace__syscall_info(trace, NULL, e_machine, id);
- return sc ? bpf_program__fd(sc->bpf_prog.sys_exit) : bpf_program__fd(unaugmented_prog);
+ return sc && sc->bpf_prog.sys_exit ? bpf_program__fd(sc->bpf_prog.sys_exit) : -1;
}
static int trace__bpf_sys_enter_beauty_map(struct trace *trace, int e_machine, int key, unsigned int *beauty_array)
@@ -4395,16 +4400,27 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace, int e_m
err = bpf_map_update_elem(map_enter_fd, &key, &prog_fd, BPF_ANY);
if (err)
break;
+ /* Only update the exit prog array map if an exit augmenter exists */
prog_fd = trace__bpf_prog_sys_exit_fd(trace, e_machine, key);
- err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
- if (err)
- break;
+ if (prog_fd >= 0) {
+ err = bpf_map_update_elem(map_exit_fd, &key, &prog_fd, BPF_ANY);
+ if (err)
+ break;
+ }
/* use beauty_map to tell BPF how many bytes to collect, set beauty_map's value here */
memset(beauty_array, 0, sizeof(beauty_array));
err = trace__bpf_sys_enter_beauty_map(trace, e_machine, key, (unsigned int *)beauty_array);
- if (err)
+ if (err) {
+ /*
+ * Not a failure: the syscall just has no augmentable
+ * arguments. Clear err, or a trailing run of such
+ * syscalls, e.g. all of them for 'perf trace -e close',
+ * would leave it set on return and abort the session.
+ */
+ err = 0;
continue;
+ }
err = bpf_map_update_elem(beauty_map_fd, &key, beauty_array, BPF_ANY);
if (err)
break;
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 05/14] perf trace: Filter events in BPF and avoid tracepoint vetoes
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (3 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 04/14] perf trace: Do not set unaugmented BPF program on sys_exit map Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 06/14] perf trace: Handle fork and exit directly in BPF filter maps Ian Rogers
` (8 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
The BPF augmented_raw_syscalls sys_enter and sys_exit programs returned
0 for syscalls that were not of interest. Returning 0 from a tracepoint
BPF program vetoes the event for the whole system, so an unrelated
concurrent perf trace, perf record or ftrace session listening to
raw_syscalls would silently lose events. This is a cross-session side
effect and shows up as flaky failures when perf tests run in parallel.
Furthermore, syscall_unaugmented previously returned 1 without writing
anything to the __augmented_syscalls__ ring buffer. This forced
userspace perf trace to listen to both raw_syscalls:sys_enter and
__augmented_syscalls__ in its evlist, requiring userspace event
deduplication.
Address these issues:
1. In augmented_raw_syscalls.bpf.c, never return 0 from tracepoint
handlers: return 1 so non-traced syscalls pass through without
vetoing other concurrent listeners.
2. Introduce pids_to_trace and syscalls_to_trace BPF hash maps to
perform targeted filtering directly in BPF. Unselected syscalls or
PIDs return 1 immediately without writing to the buffer.
3. In syscall_unaugmented, output the unaugmented enter payload into
__augmented_syscalls__ and return 1. Change its section from
SEC("tp/raw_syscalls/sys_enter") to
SEC("tp/syscalls/sys_enter_unaugmented") so libbpf does not attempt
to auto-attach it to raw_syscalls:sys_enter.
4. In bpf_trace_augment.c, add helpers to configure target PIDs and
syscalls in the BPF maps, setting the activation flags
(has_pids_to_trace, has_syscalls_to_trace) only after the maps are
fully populated so already-attached BPF programs do not filter against
a half-filled map. Explicitly attach only sys_enter and sys_exit via
an attach_prog() helper that saves -errno before calling pr_debug()
or bpf_link__destroy().
Destroy the skeleton on every failure path. Leaving a loaded but
unusable skeleton behind is not inert: the setters called later from
trace__run() would program its maps, and a partial attach would leave
a BPF program live on raw_syscalls for a session that never starts.
Since augmented_syscalls__{prepare,create_bpf_output}() failures fall
back to unaugmented tracing rather than aborting, those setters have
to become no-ops, which they only do once skel is NULL again.
errno is used directly here, so include <errno.h> rather than relying
on it arriving via another header, which it does not under musl.
5. In builtin-trace.c, hook trace__set_ev_qualifier_filter() and PID
filtering into the BPF maps. When __augmented_syscalls__ is active,
remove raw_syscalls:sys_enter from trace.evlist since all traced enter
events (both augmented and unaugmented) are now emitted by BPF into
__augmented_syscalls__. Restore tracking on the remaining evsel via
evlist__set_tracking_event() so PERF_RECORD_COMM and tracking events
continue to be recorded. Errors from
augmented_syscalls__set_target_syscalls() are reported and
propagated, the tracepoint filter string is freed on every exit path,
and an allocation failure in trace__set_filter_pids() now returns
-ENOMEM instead of being silently ignored.
Note that in trace__set_filter_pids() the target pids and the filtered
pids are two independent axes and both have to be programmed. Naming
pids to leave out with --filter-pids does not widen -p/-t or a workload
to the whole system, and a BPF tracepoint program is attached system
wide rather than to the target's file descriptors, so pids_to_trace is
the only thing keeping other tasks out.
6. Add --syscall-augment option (defaulting to true) to allow users to
explicitly use --no-syscall-augment to run perf trace in the classic
unaugmented tracepoint mode without BPF. When BPF is unavailable or
disabled, ensure the non-augmented tracepoint path cleanly configures
sys_enter and sys_exit without duplicate entries.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/Documentation/perf-trace.txt | 5 +
tools/perf/builtin-trace.c | 151 +++++++++++++++---
.../bpf_skel/augmented_raw_syscalls.bpf.c | 133 +++++++++++++--
tools/perf/util/bpf_trace_augment.c | 135 +++++++++++++++-
tools/perf/util/trace_augment.h | 34 ++++
5 files changed, 420 insertions(+), 38 deletions(-)
diff --git a/tools/perf/Documentation/perf-trace.txt b/tools/perf/Documentation/perf-trace.txt
index d20b43ea3d37..4680c69160d7 100644
--- a/tools/perf/Documentation/perf-trace.txt
+++ b/tools/perf/Documentation/perf-trace.txt
@@ -260,6 +260,11 @@ the thread executes on the designated CPUs. Default is to monitor all CPUs.
Maximum number of lines in the summary mode. Note that this applies to
each entry (thread or cgroup).
+--syscall-augment::
+ Augment syscalls with BPF. Enabled by default when BPF support is available.
+ Use --no-syscall-augment to disable BPF augmentation and fall back to the
+ unaugmented tracepoint approach.
+
PAGEFAULTS
----------
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index a68d34256996..9bb8316e334c 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -200,6 +200,7 @@ struct trace {
int max_summary;
int raw_augmented_syscalls_args_size;
bool raw_augmented_syscalls;
+ bool syscall_augment;
bool fd_path_disabled;
bool sort_events;
bool not_ev_qualifier;
@@ -2054,6 +2055,23 @@ static int trace__process_event(struct trace *trace, struct machine *machine,
"LOST %" PRIu64 " events!\n", (u64)event->lost.lost);
ret = machine__process_lost_event(machine, event, sample);
break;
+ case PERF_RECORD_FORK:
+ if (trace->raw_augmented_syscalls &&
+ (augmented_syscalls__has_target_pid(event->fork.ppid) ||
+ augmented_syscalls__has_target_pid(event->fork.ptid))) {
+ augmented_syscalls__add_target_pid(event->fork.pid);
+ }
+ ret = machine__process_fork_event(machine, event, sample);
+ break;
+ case PERF_RECORD_EXIT:
+ if (trace->raw_augmented_syscalls) {
+ if (event->fork.pid == event->fork.tid)
+ augmented_syscalls__del_target_pid(event->fork.pid);
+ else
+ augmented_syscalls__del_target_pid(event->fork.tid);
+ }
+ ret = machine__process_exit_event(machine, event, sample);
+ break;
default:
ret = machine__process_event(machine, event, sample);
break;
@@ -4043,7 +4061,7 @@ static int trace__add_syscall_newtp(struct trace *trace)
static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
{
- int err = -1;
+ int err = 0;
struct evsel *sys_exit;
char *filter = asprintf_expr_inout_ints("id", !trace->not_ev_qualifier,
trace->ev_qualifier_ids.nr,
@@ -4052,15 +4070,27 @@ static int trace__set_ev_qualifier_tp_filter(struct trace *trace)
if (filter == NULL)
goto out_enomem;
- if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
- sys_exit = trace->syscalls.events.sys_exit;
+ /*
+ * With BPF augmentation sys_enter is filtered in BPF and removed from
+ * the evlist, so only apply the tracepoint filter to the events that
+ * are actually present.
+ */
+ if (trace->syscalls.events.sys_enter)
+ err = evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter);
+
+ sys_exit = trace->syscalls.events.sys_exit;
+ if (!err && sys_exit)
err = evsel__append_tp_filter(sys_exit, filter);
- }
free(filter);
out:
return err;
out_enomem:
+ /*
+ * err defaults to 0 because either tracepoint may legitimately be
+ * absent, so the error has to be set explicitly here.
+ */
+ err = -ENOMEM;
errno = ENOMEM;
goto out;
}
@@ -4502,7 +4532,27 @@ static int trace__init_syscalls_bpf_prog_array_maps(struct trace *trace __maybe_
static int trace__set_ev_qualifier_filter(struct trace *trace)
{
- if (trace->syscalls.events.sys_enter)
+ /*
+ * Synchronize syscall filter with BPF augmenter map:
+ * Pass trace->not_ev_qualifier to indicate blacklist mode ('!' prefix,
+ * e.g., -e !open,close) vs whitelist mode (-e open,close).
+ *
+ * A failure here would leave the BPF program filtering on a partially
+ * populated map, silently dropping or emitting the wrong syscalls, so
+ * propagate the error rather than continuing.
+ */
+ if (trace->ev_qualifier_ids.nr > 0) {
+ int err = augmented_syscalls__set_target_syscalls(trace->ev_qualifier_ids.nr,
+ trace->ev_qualifier_ids.entries,
+ trace->not_ev_qualifier);
+
+ if (err) {
+ pr_err("Failed to set the syscalls to trace in the BPF map: %d\n", err);
+ return err;
+ }
+ }
+
+ if (trace->syscalls.events.sys_enter || trace->syscalls.events.sys_exit)
return trace__set_ev_qualifier_tp_filter(trace);
return 0;
}
@@ -4543,13 +4593,21 @@ static int trace__set_filter_loop_pids(struct trace *trace)
static int trace__set_filter_pids(struct trace *trace)
{
- int err = 0;
+ struct perf_thread_map *threads = evlist__core(trace->evlist)->threads;
/*
* Better not use !target__has_task() here because we need to cover the
* case where no threads were specified in the command line, but a
* workload was, and in that case we will fill in the thread_map when
* we fork the workload in evlist__prepare_workload.
*/
+ bool has_target = perf_thread_map__pid(threads, 0) != -1;
+ int err = 0;
+
+ /*
+ * The exclusion list: --filter-pids names tasks to never report, and
+ * with no target at all we instead exclude perf itself so that tracing
+ * does not feed back into itself.
+ */
if (trace->filter_pids.nr > 0) {
err = evlist__append_tp_filter_pids(trace->evlist, trace->filter_pids.nr,
trace->filter_pids.entries);
@@ -4557,10 +4615,37 @@ static int trace__set_filter_pids(struct trace *trace)
err = augmented_syscalls__set_filter_pids(trace->filter_pids.nr,
trace->filter_pids.entries);
}
- } else if (perf_thread_map__pid(evlist__core(trace->evlist)->threads, 0) == -1) {
+ } else if (!has_target) {
err = trace__set_filter_loop_pids(trace);
}
+ if (err)
+ return err;
+
+ /*
+ * The inclusion list, which is a separate axis from the exclusion list
+ * above and so must be programmed even when --filter-pids was given:
+ * naming tasks to leave out does not widen -p/-t or a workload to the
+ * whole system.
+ *
+ * This matters more than it does on the tracepoint only path. A BPF
+ * tracepoint program is attached system wide rather than to the
+ * target's file descriptors, so pids_to_trace is the only thing
+ * keeping other tasks out.
+ */
+ if (has_target) {
+ int nr = perf_thread_map__nr(threads);
+ pid_t *pids = malloc(nr * sizeof(pid_t));
+
+ if (pids == NULL)
+ return -ENOMEM;
+
+ for (int i = 0; i < nr; i++)
+ pids[i] = perf_thread_map__pid(threads, i);
+ err = augmented_syscalls__set_target_pids(nr, pids);
+ free(pids);
+ }
+
return err;
}
@@ -4787,7 +4872,8 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
}
if (!trace->raw_augmented_syscalls) {
- if (trace->trace_syscalls && trace__add_syscall_newtp(trace))
+ if (trace->trace_syscalls && !trace->syscalls.events.sys_enter &&
+ trace__add_syscall_newtp(trace))
goto out_error_raw_syscalls;
if (trace->trace_syscalls)
@@ -5795,6 +5881,7 @@ int cmd_trace(int argc, const char **argv)
.show_arg_names = true,
.args_alignment = 70,
.trace_syscalls = false,
+ .syscall_augment = true,
.kernel_syscallchains = false,
.max_stack = UINT_MAX,
.max_events = ULONG_MAX,
@@ -5850,6 +5937,8 @@ int cmd_trace(int argc, const char **argv)
OPT_CALLBACK_DEFAULT('F', "pf", &trace.trace_pgfaults, "all|maj|min",
"Trace pagefaults", parse_pagefaults, "maj"),
OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),
+ OPT_BOOLEAN(0, "syscall-augment", &trace.syscall_augment,
+ "Augment syscalls with BPF"),
OPT_BOOLEAN('f', "force", &trace.force, "don't complain, do it"),
OPT_CALLBACK(0, "call-graph", &trace.opts,
"record_mode[,record_size]", record_callchain_help,
@@ -5972,7 +6061,7 @@ int cmd_trace(int argc, const char **argv)
"cgroup monitoring only available in system-wide mode");
}
- if (!trace.trace_syscalls)
+ if (!trace.trace_syscalls || !trace.syscall_augment)
goto skip_augmentation;
if ((argc >= 1) && (strcmp(argv[0], "record") == 0)) {
@@ -5997,8 +6086,19 @@ int cmd_trace(int argc, const char **argv)
trace__add_syscall_newtp(&trace);
err = augmented_syscalls__create_bpf_output(trace.evlist);
- if (err == 0)
+ if (err == 0) {
trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
+ } else {
+ /*
+ * augmented_syscalls__prepare() already attached sys_enter and
+ * sys_exit, which are system wide. Falling through to
+ * skip_augmentation without undoing that would run a BPF
+ * program for every syscall on the machine, for the whole
+ * session, with nothing consuming the output.
+ */
+ pr_debug("Failed to create the augmented syscalls bpf-output event, disabling augmentation\n");
+ augmented_syscalls__cleanup();
+ }
skip_augmentation:
err = -1;
@@ -6054,7 +6154,9 @@ int cmd_trace(int argc, const char **argv)
* syscall.
*/
if (trace.syscalls.events.bpf_output) {
- evlist__for_each_entry(trace.evlist, evsel) {
+ struct evsel *n;
+
+ evlist__for_each_entry_safe(trace.evlist, n, evsel) {
bool raw_syscalls_sys_exit = evsel__name_is(evsel, "raw_syscalls:sys_exit");
if (raw_syscalls_sys_exit) {
@@ -6069,21 +6171,26 @@ int cmd_trace(int argc, const char **argv)
evsel__init_augmented_syscall_tp_args(augmented))
goto out;
/*
- * Augmented is __augmented_syscalls__ BPF_OUTPUT event
+ * Augmented is __augmented_syscalls__ BPF_OUTPUT event.
* Above we made sure we can get from the payload the tp fields
* that we get from syscalls:sys_enter tracefs format file.
+ * Since BPF outputs all enter events (both augmented and
+ * unaugmented) into __augmented_syscalls__, we remove the raw
+ * sys_enter evsel from evlist so that perf trace only listens
+ * to __augmented_syscalls__, avoiding duplicate events and
+ * avoiding kernel tracepoint vetoes.
+ *
+ * Because evlist__remove() removes the first evsel (which had
+ * tracking=true by default), re-designate the tracking event
+ * so PERF_RECORD_COMM and fork tracking continue to be enabled.
*/
augmented->handler = trace__sys_enter;
- /*
- * Now we do the same for the *syscalls:sys_enter event so that
- * if we handle it directly, i.e. if the BPF prog returns 0 so
- * as not to filter it, then we'll handle it just like we would
- * for the BPF_OUTPUT one:
- */
- if (evsel__init_augmented_syscall_tp(evsel, evsel) ||
- evsel__init_augmented_syscall_tp_args(evsel))
- goto out;
- evsel->handler = trace__sys_enter;
+ evlist__remove(trace.evlist, evsel);
+ evsel__put_and_free_priv(evsel);
+ trace.syscalls.events.sys_enter = NULL;
+ evlist__set_tracking_event(trace.evlist,
+ trace.syscalls.events.sys_exit ?: augmented);
+ continue;
}
if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 3bc9e28a9b8a..6ca9507ecc02 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -114,6 +114,41 @@ struct pids_filtered {
__uint(max_entries, 64);
} pids_filtered SEC(".maps");
+/*
+ * Optional hash map containing specific PIDs/TGIDs to trace (e.g., when
+ * attached to a process with -p or tracing a specific command workload).
+ *
+ * has_pids_to_trace: Set to true if target PID filtering is active.
+ * When false, all processes are eligible for tracing.
+ */
+struct pids_to_trace {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, pid_t);
+ __type(value, bool);
+ __uint(max_entries, 1024);
+} pids_to_trace SEC(".maps");
+
+bool has_pids_to_trace;
+
+/*
+ * Hash map storing syscall IDs for filtering (via 'perf trace -e ...').
+ *
+ * has_syscalls_to_trace: Set to true if any syscall filter is active.
+ * not_syscalls_to_trace: Inverts matching when '!' prefix is used in -e
+ * (e.g., -e !open,close means trace everything EXCEPT
+ * open and close; an exclusion blacklist rather than
+ * an inclusion whitelist).
+ */
+struct syscalls_to_trace {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, int);
+ __type(value, bool);
+ __uint(max_entries, 1024);
+} syscalls_to_trace SEC(".maps");
+
+bool has_syscalls_to_trace;
+bool not_syscalls_to_trace;
+
struct augmented_args_payload {
struct syscall_enter_args args;
struct augmented_arg arg, arg2; // We have to reserve space for two arguments (rename, etc)
@@ -154,8 +189,8 @@ static inline struct augmented_args_payload *augmented_args_payload(void)
static inline int augmented__output(void *ctx, struct augmented_args_payload *args, int len)
{
- /* If perf_event_output fails, return non-zero so that it gets recorded unaugmented */
- return bpf_perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
+ bpf_perf_event_output(ctx, &__augmented_syscalls__, BPF_F_CURRENT_CPU, args, len);
+ return 1;
}
static inline int augmented__beauty_output(void *ctx, void *data, int len)
@@ -191,10 +226,21 @@ unsigned int augmented_arg__read_str(struct augmented_arg *augmented_arg, const
return augmented_len;
}
-SEC("tp/raw_syscalls/sys_enter")
+/*
+ * Default sys_enter program for syscalls without pointer argument augmentation.
+ * Writes the raw struct syscall_enter_args payload into __augmented_syscalls__
+ * and returns 1 so the tracepoint is never vetoed in the kernel.
+ */
+SEC("tp/syscalls/sys_enter_unaugmented")
int syscall_unaugmented(struct syscall_enter_args *args)
{
- return 1;
+ struct augmented_args_payload *augmented_args = augmented_args_payload();
+
+ if (augmented_args == NULL)
+ return 1;
+
+ bpf_probe_read_kernel(&augmented_args->args, sizeof(augmented_args->args), args);
+ return augmented__output(args, augmented_args, sizeof(augmented_args->args));
}
/*
@@ -424,11 +470,41 @@ static pid_t getpid(void)
return bpf_get_current_pid_tgid();
}
+/*
+ * Returns true if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ */
static bool pid_filter__has(struct pids_filtered *pids, pid_t pid)
{
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
+/*
+ * Checks if the current task (thread PID or process TGID) is targeted for tracing.
+ * Checks both PID (thread ID) and TGID (process ID) so that all threads of a
+ * target process match.
+ */
+static inline bool pid_to_trace__has(pid_t pid)
+{
+ pid_t tgid = bpf_get_current_pid_tgid() >> 32;
+
+ return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL ||
+ bpf_map_lookup_elem(&pids_to_trace, &tgid) != NULL;
+}
+
+/*
+ * Determines if a syscall should be traced based on the filter map:
+ * - When not_syscalls_to_trace is true: blacklist mode (trace if NOT in map).
+ * - When not_syscalls_to_trace is false: whitelist mode (trace ONLY if IN map).
+ */
+static inline bool syscall_to_trace__enabled(int id)
+{
+ bool in_map = bpf_map_lookup_elem(&syscalls_to_trace, &id) != NULL;
+
+ if (not_syscalls_to_trace)
+ return !in_map;
+ return in_map;
+}
+
u64 ZERO = 0;
/*
@@ -562,6 +638,11 @@ static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
return augmented__beauty_output(ctx, payload, sizeof(struct syscall_enter_args) + output);
}
+/*
+ * Main raw_syscalls:sys_enter tracepoint handler.
+ * Always returns 1 so the tracepoint is never vetoed in the kernel for
+ * other concurrent listeners. Filtered events simply do not output to the ring buffer.
+ */
SEC("tp/raw_syscalls/sys_enter")
int sys_enter(struct syscall_enter_args *args)
{
@@ -576,8 +657,11 @@ int sys_enter(struct syscall_enter_args *args)
* initial, non-augmented raw_syscalls:sys_enter payload.
*/
+ if (has_pids_to_trace && !pid_to_trace__has(getpid()))
+ return 1;
+
if (pid_filter__has(&pids_filtered, getpid()))
- return 0;
+ return 1;
augmented_args = augmented_args_payload();
if (augmented_args == NULL)
@@ -585,25 +669,41 @@ int sys_enter(struct syscall_enter_args *args)
bpf_probe_read_kernel(&augmented_args->args, sizeof(augmented_args->args), args);
+ if (has_syscalls_to_trace && !syscall_to_trace__enabled(augmented_args->args.syscall_nr))
+ return 1;
+
/*
- * Jump to syscall specific augmenter, even if the default one,
- * "!raw_syscalls:unaugmented" that will just return 1 to return the
- * unaugmented tracepoint payload.
+ * Jump to syscall specific augmenter. If augmented, augment_sys_enter()
+ * outputs the payload to __augmented_syscalls__ and returns 0.
+ * Return 1 so we never veto the kernel tracepoint for other listeners.
*/
- if (augment_sys_enter(args, &augmented_args->args))
- bpf_tail_call(args, &syscalls_sys_enter, augmented_args->args.syscall_nr);
+ if (augment_sys_enter(args, &augmented_args->args) == 0)
+ return 1;
- // If not found on the PROG_ARRAY syscalls map, then we're filtering it:
- return 0;
+ bpf_tail_call(args, &syscalls_sys_enter, augmented_args->args.syscall_nr);
+
+ /*
+ * If not found on the PROG_ARRAY syscalls map, return 1 so we
+ * don't veto the tracepoint event system-wide for other concurrent
+ * listeners.
+ */
+ return 1;
}
+/*
+ * Main raw_syscalls:sys_exit tracepoint handler.
+ * Always returns 1 so the tracepoint is never vetoed in the kernel.
+ */
SEC("tp/raw_syscalls/sys_exit")
int sys_exit(struct syscall_exit_args *args)
{
struct syscall_exit_args exit_args;
+ if (has_pids_to_trace && !pid_to_trace__has(getpid()))
+ return 1;
+
if (pid_filter__has(&pids_filtered, getpid()))
- return 0;
+ return 1;
bpf_probe_read_kernel(&exit_args, sizeof(exit_args), args);
/*
@@ -613,9 +713,12 @@ int sys_exit(struct syscall_exit_args *args)
*/
bpf_tail_call(args, &syscalls_sys_exit, exit_args.syscall_nr);
/*
- * If not found on the PROG_ARRAY syscalls map, then we're filtering it:
+ * If not found on the PROG_ARRAY syscalls map, return 1 so we
+ * don't veto the tracepoint event system-wide for other concurrent
+ * listeners. perf trace's own evsel filter will discard non-matching
+ * syscalls.
*/
- return 0;
+ return 1;
}
char _license[] SEC("license") = "GPL";
diff --git a/tools/perf/util/bpf_trace_augment.c b/tools/perf/util/bpf_trace_augment.c
index 645819d79b6d..b47f11d40dd8 100644
--- a/tools/perf/util/bpf_trace_augment.c
+++ b/tools/perf/util/bpf_trace_augment.c
@@ -1,4 +1,5 @@
#include <bpf/libbpf.h>
+#include <errno.h>
#include <internal/xyarray.h>
#include <string.h>
@@ -11,6 +12,23 @@
static struct augmented_raw_syscalls_bpf *skel;
static struct evsel *bpf_output;
+/* Set by attach_prog() so the first failure is what gets reported. */
+static int attach_err;
+
+static int attach_prog(struct bpf_link **link, struct bpf_program *prog, const char *name)
+{
+ *link = bpf_program__attach(prog);
+ if (*link)
+ return 0;
+ /*
+ * Save errno before pr_debug(), which formats and writes output and so
+ * can overwrite it.
+ */
+ attach_err = -errno;
+ pr_debug("Failed to attach %s BPF program\n", name);
+ return attach_err;
+}
+
int augmented_syscalls__prepare(void)
{
struct bpf_program *prog;
@@ -36,11 +54,35 @@ int augmented_syscalls__prepare(void)
if (err < 0) {
libbpf_strerror(err, buf, sizeof(buf));
pr_debug("Failed to load augmented syscalls BPF skeleton: %s\n", buf);
+ /*
+ * Tear the skeleton down rather than leaving a half initialized
+ * one behind. The caller falls back to unaugmented tracing and
+ * still calls the setters below, which must then do nothing
+ * instead of failing against a skeleton with no maps.
+ */
+ augmented_syscalls__cleanup();
return err;
}
- augmented_raw_syscalls_bpf__attach(skel);
+ /*
+ * Only sys_enter and sys_exit are attached, the remaining programs are
+ * reached by tail calls. Attach them explicitly and, on failure, undo
+ * any partial attachment: leaving sys_enter live on
+ * raw_syscalls:sys_enter would keep running a BPF program for every
+ * syscall on the system for a perf trace session that never starts.
+ */
+ if (attach_prog(&skel->links.sys_enter, skel->progs.sys_enter, "sys_enter"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sys_exit, skel->progs.sys_exit, "sys_exit"))
+ goto out_cleanup;
+
return 0;
+
+out_cleanup:
+ err = attach_err;
+ /* Destroys every link attached above along with the skeleton. */
+ augmented_syscalls__cleanup();
+ return err;
}
int augmented_syscalls__create_bpf_output(struct evlist *evlist)
@@ -99,6 +141,96 @@ int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids)
return err;
}
+/*
+ * Populate target PIDs in the BPF pids_to_trace map (e.g., for -p <PID> or
+ * when tracing a specified command workload).
+ */
+int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids)
+{
+ bool value = true;
+ int err = 0;
+
+ if (skel == NULL || nr == 0)
+ return 0;
+
+ for (size_t i = 0; i < nr; ++i) {
+ err = bpf_map__update_elem(skel->maps.pids_to_trace, &pids[i],
+ sizeof(*pids), &value, sizeof(value),
+ BPF_ANY);
+ if (err)
+ return err;
+ }
+ /*
+ * Set the flag only once every target is in the map. The BPF programs
+ * are attached by this point, so flipping it first would have them
+ * filter against a partially populated map and drop syscalls made by
+ * the targets that had not been added yet.
+ */
+ skel->bss->has_pids_to_trace = true;
+ return 0;
+}
+
+int augmented_syscalls__add_target_pid(pid_t pid)
+{
+ bool value = true;
+
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return 0;
+
+ return bpf_map__update_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
+ &value, sizeof(value), BPF_ANY);
+}
+
+int augmented_syscalls__del_target_pid(pid_t pid)
+{
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return 0;
+
+ return bpf_map__delete_elem(skel->maps.pids_to_trace, &pid, sizeof(pid), 0);
+}
+
+bool augmented_syscalls__has_target_pid(pid_t pid)
+{
+ bool value;
+
+ if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
+ return false;
+
+ return bpf_map__lookup_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
+ &value, sizeof(value), 0) == 0;
+}
+
+/*
+ * Populate syscalls in the BPF syscalls_to_trace map:
+ * - not_syscalls: true if '!' prefix was specified (blacklist mode: trace
+ * all syscalls EXCEPT these).
+ * false if whitelist mode (trace ONLY these syscalls).
+ */
+int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls)
+{
+ bool value = true;
+ int err = 0;
+
+ if (skel == NULL || nr == 0)
+ return 0;
+
+ skel->bss->not_syscalls_to_trace = not_syscalls;
+ for (size_t i = 0; i < nr; ++i) {
+ err = bpf_map__update_elem(skel->maps.syscalls_to_trace, &syscall_ids[i],
+ sizeof(int), &value, sizeof(value),
+ BPF_ANY);
+ if (err)
+ return err;
+ }
+ /*
+ * As for the pid maps, publish the filter only once it is complete:
+ * in whitelist mode a half filled map would drop syscalls that were
+ * asked for but not added yet.
+ */
+ skel->bss->has_syscalls_to_trace = true;
+ return 0;
+}
+
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd)
{
if (skel == NULL)
@@ -141,4 +273,5 @@ struct bpf_program *augmented_syscalls__find_by_title(const char *name)
void augmented_syscalls__cleanup(void)
{
augmented_raw_syscalls_bpf__destroy(skel);
+ skel = NULL;
}
diff --git a/tools/perf/util/trace_augment.h b/tools/perf/util/trace_augment.h
index a1cd9a5e0213..5702eda3b469 100644
--- a/tools/perf/util/trace_augment.h
+++ b/tools/perf/util/trace_augment.h
@@ -2,6 +2,7 @@
#define TRACE_AUGMENT_H
#include <linux/compiler.h>
+#include <stdbool.h>
#include <sys/types.h>
struct bpf_program;
@@ -13,6 +14,11 @@ int augmented_syscalls__prepare(void);
int augmented_syscalls__create_bpf_output(struct evlist *evlist);
void augmented_syscalls__setup_bpf_output(void);
int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids);
+int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids);
+int augmented_syscalls__add_target_pid(pid_t pid);
+int augmented_syscalls__del_target_pid(pid_t pid);
+bool augmented_syscalls__has_target_pid(pid_t pid);
+int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls);
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd);
struct bpf_program *augmented_syscalls__find_by_title(const char *name);
struct bpf_program *augmented_syscalls__unaugmented(void);
@@ -40,6 +46,34 @@ static inline int augmented_syscalls__set_filter_pids(unsigned int nr __maybe_un
return 0;
}
+static inline int augmented_syscalls__set_target_pids(unsigned int nr __maybe_unused,
+ pid_t *pids __maybe_unused)
+{
+ return 0;
+}
+
+static inline int augmented_syscalls__add_target_pid(pid_t pid __maybe_unused)
+{
+ return 0;
+}
+
+static inline int augmented_syscalls__del_target_pid(pid_t pid __maybe_unused)
+{
+ return 0;
+}
+
+static inline bool augmented_syscalls__has_target_pid(pid_t pid __maybe_unused)
+{
+ return false;
+}
+
+static inline int augmented_syscalls__set_target_syscalls(unsigned int nr __maybe_unused,
+ int *syscall_ids __maybe_unused,
+ bool not_syscalls __maybe_unused)
+{
+ return 0;
+}
+
static inline int augmented_syscalls__get_map_fds(int *enter_fd __maybe_unused,
int *exit_fd __maybe_unused,
int *beauty_fd __maybe_unused)
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 06/14] perf trace: Handle fork and exit directly in BPF filter maps
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (4 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 05/14] perf trace: Filter events in BPF and avoid tracepoint vetoes Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 07/14] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive Ian Rogers
` (7 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
Updating target or filtered PIDs in userspace upon processing
PERF_RECORD_FORK and PERF_RECORD_EXIT events introduces latency between
event occurrence and userspace BPF map updates. If a newly forked child
executes system calls before userspace processes PERF_RECORD_FORK, those
syscalls may be dropped by BPF PID filtering. Conversely, if userspace
evicts PIDs asynchronously on PERF_RECORD_EXIT, the kernel may recycle a
PID before userspace processes the exit event, causing the late eviction
to silently drop a newly created task that received the recycled PID.
Address this by attaching BTF-typed raw tracepoint BPF programs directly
to the scheduler task lifetime tracepoints:
1. Attach SEC("tp_btf/sched_process_fork") (sched_process_fork), which
runs in copy_process() in the parent's context before
wake_up_new_task() wakes the child. Using tp_btf rather than
SEC("tp/sched/sched_process_fork") receives the stable TP_PROTO
arguments (struct task_struct *parent, struct task_struct *child)
rather than the tracepoint ring-buffer record (TP_STRUCT__entry),
whose layout changed in Linux 6.16 when parent_comm and child_comm
were converted from 16-byte arrays to 4-byte __data_loc strings.
When inherit is enabled and the parent's PID or TGID is in
pids_to_trace or pids_filtered, insert child->pid into the
corresponding map immediately. Because child->pid is task_struct.pid
(the global initial-namespace PID), this works accurately across PID
namespaces without aliasing host PIDs, and covers both new processes
and CLONE_THREAD threads without needing real_parent CO-RE walks or
syscall-return heuristics.
2. Attach SEC("tp_btf/sched_process_exit") (sched_process_exit), which
runs in do_exit() for every task in its own context, including tasks
killed by signals (SIGKILL, SIGSEGV, etc.) and secondary threads torn
down implicitly by exit_group. Delete the dying task's PID from
pids_to_trace and pids_filtered immediately in kernel space,
eliminating both map leaks and any asynchronous userspace eviction
window where PID recycling could occur.
3. Attach SEC("tp_btf/sched_process_exec") (sched_process_exec) to
follow the one case where a live task's pid changes underneath the
maps. When a thread that is not the group leader execs, de_thread()
kills the leader and hands the leader's pid, which is the tgid, to
the exec'ing thread. The leader dies first, so sched_process_exit()
has already dropped exactly the pid the survivor now holds, and the
survivor's old entry would be stranded in the map for good. Move the
entry from old_pid to p->pid. old_pid is sampled in bprm_execve()
before de_thread() runs, so the ordinary group leader exec is a
no-op here.
4. With every live task registered before its first syscall and evicted
in do_exit(), simplify pid_to_trace__has() and pid_filter__has() to
single BPF hash map lookups, and move bpf_probe_read_kernel() in
sys_exit back after the PID filter checks.
5. Pass the inherit flag from userspace to BPF .rodata via
augmented_syscalls__prepare(!trace.opts.no_inherit), and split
attaching out of it into augmented_syscalls__attach(), called from
trace__run() once the pid, syscall and program array maps have all
been programmed. These are system wide programs, so from the instant
they attach they alone decide what is traced: attaching at load time,
as before, left a window in which a target could fork without
sched_process_fork() knowing the parent was a target, and with the
userspace fork handling gone there was nothing left to recover it.
The scheduler programs are attached ahead of sys_enter and sys_exit
for the same reason. Set has_pids_filtered only after populating
pids_filtered.
6. Remove the userspace BPF map updates from PERF_RECORD_FORK and
PERF_RECORD_EXIT in trace__process_event(), and delete the now-unused
augmented_syscalls__{add,del,has}_target_pid() helpers. No coverage
is lost with them: those records only come into being once the ring
buffers are mapped by evlist__do_mmap() and the events are switched
on by evlist__enable(), both of which run after
augmented_syscalls__attach() in trace__run(), and they are then acted
on later still, whenever the poll loop gets round to them. The
scheduler programs therefore go live strictly earlier than the
userspace path could ever have reacted.
7. Gate pid_filter__has() on a has_pids_filtered flag in .bss so the
common case without --filter-pids performs no map lookups, and size
pids_to_trace and pids_filtered at 16384 entries. pids_filtered is
grown from 64 because it is no longer just the handful of pids
userspace names: sched_process_fork() adds every descendant of those,
so a --filter-pids target that forks or is heavily threaded needs the
same headroom as a traced one.
A fork or exit is still not seen if it happens before the programs are
attached, that is between evlist__create_maps() scanning /proc for a -p
target and augmented_syscalls__attach(). Such a window is inherent in
programming a system wide filter before switching it on, and as above
the userspace handling did not cover it either. What it costs is small:
a child forked in the window is still traced through the tracepoints its
parent's events were inherited by, only unaugmented, because sys_enter
returns 1 for a pid that is not in the map rather than vetoing the
tracepoint. A workload started by 'perf trace -- cmd' cannot hit it at
all, as evlist__prepare_workload() leaves the child blocked on a pipe
until evlist__start_workload(), well after the attach.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-trace.c | 39 ++--
.../bpf_skel/augmented_raw_syscalls.bpf.c | 178 +++++++++++++++++-
tools/perf/util/bpf_trace_augment.c | 116 +++++++-----
tools/perf/util/trace_augment.h | 28 +--
4 files changed, 262 insertions(+), 99 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 9bb8316e334c..f876f0df06a5 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2055,23 +2055,6 @@ static int trace__process_event(struct trace *trace, struct machine *machine,
"LOST %" PRIu64 " events!\n", (u64)event->lost.lost);
ret = machine__process_lost_event(machine, event, sample);
break;
- case PERF_RECORD_FORK:
- if (trace->raw_augmented_syscalls &&
- (augmented_syscalls__has_target_pid(event->fork.ppid) ||
- augmented_syscalls__has_target_pid(event->fork.ptid))) {
- augmented_syscalls__add_target_pid(event->fork.pid);
- }
- ret = machine__process_fork_event(machine, event, sample);
- break;
- case PERF_RECORD_EXIT:
- if (trace->raw_augmented_syscalls) {
- if (event->fork.pid == event->fork.tid)
- augmented_syscalls__del_target_pid(event->fork.pid);
- else
- augmented_syscalls__del_target_pid(event->fork.tid);
- }
- ret = machine__process_exit_event(machine, event, sample);
- break;
default:
ret = machine__process_event(machine, event, sample);
break;
@@ -4987,6 +4970,16 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
}
}
+ /*
+ * Everything the BPF programs filter on is now in their maps, so it is
+ * safe to let them run. They are attached system wide, so anything
+ * before this point would have been filtered against a map that was
+ * still being built up.
+ */
+ err = augmented_syscalls__attach();
+ if (err < 0)
+ goto out_errno;
+
/*
* If the "close" syscall is not traced, then we will not have the
* opportunity to, in syscall_arg__scnprintf_close_fd() invalidate the
@@ -6079,7 +6072,7 @@ int cmd_trace(int argc, const char **argv)
goto skip_augmentation;
}
- err = augmented_syscalls__prepare();
+ err = augmented_syscalls__prepare(!trace.opts.no_inherit);
if (err < 0)
goto skip_augmentation;
@@ -6090,11 +6083,11 @@ int cmd_trace(int argc, const char **argv)
trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
} else {
/*
- * augmented_syscalls__prepare() already attached sys_enter and
- * sys_exit, which are system wide. Falling through to
- * skip_augmentation without undoing that would run a BPF
- * program for every syscall on the machine, for the whole
- * session, with nothing consuming the output.
+ * Drop the loaded skeleton before falling back to unaugmented
+ * tracing. Otherwise the setters called from trace__run() would
+ * still program its maps, and augmented_syscalls__attach() would
+ * then put system wide BPF programs on raw_syscalls for a
+ * session with nothing consuming their output.
*/
pr_debug("Failed to create the augmented syscalls bpf-output event, disabling augmentation\n");
augmented_syscalls__cleanup();
diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 6ca9507ecc02..7124ed3c39c8 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -9,6 +9,7 @@
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
#include <linux/limits.h>
#define PERF_ALIGN(x, a) __PERF_ALIGN_MASK(x, (typeof(x))(a)-1)
@@ -107,25 +108,48 @@ struct augmented_arg {
};
};
+/*
+ * Hash map of PIDs/TGIDs whose events must be discarded, e.g. perf trace's own
+ * pid, so that tracing doesn't feed back on itself.
+ *
+ * has_pids_filtered: set to true only when the map is populated. Checking a
+ * boolean is much cheaper than a map lookup, and sys_enter
+ * runs for every syscall on the system, so the common
+ * "no pids filtered" case must stay on a fast path.
+ *
+ * max_entries matches pids_to_trace: userspace only ever names a handful of
+ * pids here, but sched_process_fork() below adds every descendant of those,
+ * so a --filter-pids target that forks or is heavily threaded needs the same
+ * headroom as a traced one.
+ */
struct pids_filtered {
__uint(type, BPF_MAP_TYPE_HASH);
__type(key, pid_t);
__type(value, bool);
- __uint(max_entries, 64);
+ __uint(max_entries, 16384);
} pids_filtered SEC(".maps");
+bool has_pids_filtered;
+
/*
* Optional hash map containing specific PIDs/TGIDs to trace (e.g., when
* attached to a process with -p or tracing a specific command workload).
*
* has_pids_to_trace: Set to true if target PID filtering is active.
* When false, all processes are eligible for tracing.
+ *
+ * max_entries bounds how many tasks can be tracked at once. sched_process_exit
+ * below evicts a task as it dies, whatever it died of, so the map holds live
+ * tasks rather than growing without bound. It is sized well
+ * above the thread count of realistic traced workloads; should a workload
+ * still exceed it, bpf_map_update_elem() fails with -E2BIG and the extra
+ * tasks are simply not traced rather than anything being corrupted.
*/
struct pids_to_trace {
__uint(type, BPF_MAP_TYPE_HASH);
__type(key, pid_t);
__type(value, bool);
- __uint(max_entries, 1024);
+ __uint(max_entries, 16384);
} pids_to_trace SEC(".maps");
bool has_pids_to_trace;
@@ -149,6 +173,9 @@ struct syscalls_to_trace {
bool has_syscalls_to_trace;
bool not_syscalls_to_trace;
+/* Inherit tracing for child tasks (set to false if --no-inherit is specified) */
+const volatile bool inherit = true;
+
struct augmented_args_payload {
struct syscall_enter_args args;
struct augmented_arg arg, arg2; // We have to reserve space for two arguments (rename, etc)
@@ -471,24 +498,35 @@ static pid_t getpid(void)
}
/*
- * Returns true if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ * Checks if a PID is explicitly excluded/filtered out (e.g., via --filter-pids).
+ *
+ * Children of a filtered task are added to the map by sched_process_fork()
+ * below, so a plain lookup is all that is needed here.
*/
static bool pid_filter__has(struct pids_filtered *pids, pid_t pid)
{
+ /*
+ * Fast path: this runs for every syscall on the system, so when no pid
+ * is filtered do no work at all rather than failing a lookup.
+ */
+ if (!has_pids_filtered)
+ return false;
+
return bpf_map_lookup_elem(pids, &pid) != NULL;
}
/*
- * Checks if the current task (thread PID or process TGID) is targeted for tracing.
- * Checks both PID (thread ID) and TGID (process ID) so that all threads of a
- * target process match.
+ * Checks if the current task is targeted for tracing.
+ *
+ * Every thread that existed when tracing started was named by the target and
+ * inserted from userspace, and every task created since was inserted by
+ * sched_process_fork() below, before it was able to run. So there is nothing
+ * to derive here, and in particular no need to consult the tgid or walk to the
+ * parent: a task is traced if and only if it is in the map.
*/
static inline bool pid_to_trace__has(pid_t pid)
{
- pid_t tgid = bpf_get_current_pid_tgid() >> 32;
-
- return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL ||
- bpf_map_lookup_elem(&pids_to_trace, &tgid) != NULL;
+ return bpf_map_lookup_elem(&pids_to_trace, &pid) != NULL;
}
/*
@@ -706,6 +744,7 @@ int sys_exit(struct syscall_exit_args *args)
return 1;
bpf_probe_read_kernel(&exit_args, sizeof(exit_args), args);
+
/*
* Jump to syscall specific return augmenter, even if the default one,
* "!raw_syscalls:unaugmented" that will just return 1 to return the
@@ -721,4 +760,123 @@ int sys_exit(struct syscall_exit_args *args)
return 1;
}
+/*
+ * Propagate tracing to a newly created task.
+ *
+ * tp_btf/sched_process_fork is raised by copy_process(), in the parent's
+ * context and before the child is woken, so the child is in the maps before it
+ * can issue its first syscall. That removes the need to inspect real_parent
+ * when a syscall is seen from an unknown task, which could neither tell a
+ * genuine descendant from a task merely reparented to a traced init, nor keep
+ * following a descendant whose parent had already exited.
+ *
+ * Using tp_btf rather than tp/sched/sched_process_fork avoids depending on the
+ * tracepoint ring-buffer record layout (TP_STRUCT__entry), which changed in
+ * Linux 6.16 when parent_comm and child_comm were converted from fixed 16-byte
+ * arrays to 4-byte __data_loc strings (shrinking the tracepoint context from
+ * 48 to 24 bytes and causing BPF_PROG_TYPE_TRACEPOINT attachment to fail with
+ * -EACCES when accessing higher offsets). Instead, tp_btf receives the stable
+ * TP_PROTO arguments (struct task_struct *parent, struct task_struct *child)
+ * directly.
+ *
+ * child->pid is task_struct.pid, i.e. the pid in the initial namespace, which
+ * is what the maps are keyed by. A clone() return value, in contrast, is the
+ * pid in the caller's namespace and would alias an unrelated host task when a
+ * containerised workload is traced.
+ *
+ * CLONE_THREAD needs no special handling: a new thread arrives here like any
+ * other task and is inserted under its own pid.
+ */
+SEC("tp_btf/sched_process_fork")
+int BPF_PROG(sched_process_fork, struct task_struct *parent, struct task_struct *child)
+{
+ pid_t parent_tgid, parent_pid, child_pid;
+ bool val = true;
+
+ if (!inherit)
+ return 0;
+
+ /*
+ * The parent's own pid and tgid: the thread that called clone() may
+ * itself only be tracked by the pid of its thread group leader.
+ */
+ parent_pid = parent->pid;
+ parent_tgid = parent->tgid;
+ child_pid = child->pid;
+
+ if (has_pids_to_trace &&
+ (bpf_map_lookup_elem(&pids_to_trace, &parent_pid) != NULL ||
+ bpf_map_lookup_elem(&pids_to_trace, &parent_tgid) != NULL))
+ bpf_map_update_elem(&pids_to_trace, &child_pid, &val, BPF_ANY);
+
+ if (has_pids_filtered &&
+ (bpf_map_lookup_elem(&pids_filtered, &parent_pid) != NULL ||
+ bpf_map_lookup_elem(&pids_filtered, &parent_tgid) != NULL))
+ bpf_map_update_elem(&pids_filtered, &child_pid, &val, BPF_ANY);
+
+ return 0;
+}
+
+/*
+ * Drop a dying task from the maps.
+ *
+ * tp_btf/sched_process_exit is raised by do_exit() for every task, in its own
+ * context, so unlike hooking the exit and exit_group syscalls this also covers
+ * tasks killed by a signal and threads torn down implicitly by exit_group.
+ *
+ * Doing it here rather than from the userspace PERF_RECORD_EXIT handler also
+ * means there is no window between the task dying and the map being updated,
+ * during which the kernel could recycle the pid and the late eviction silently
+ * stop tracing whichever new task received it.
+ *
+ * Each thread is reported separately, including the group leader, whose pid is
+ * the thread group's tgid, so one delete per map covers both uses of the key.
+ */
+SEC("tp_btf/sched_process_exit")
+int BPF_PROG(sched_process_exit, struct task_struct *p)
+{
+ pid_t pid = p->pid;
+
+ bpf_map_delete_elem(&pids_to_trace, &pid);
+ bpf_map_delete_elem(&pids_filtered, &pid);
+
+ return 0;
+}
+
+/*
+ * Follow a task whose pid changed under it.
+ *
+ * When a thread that is not the thread group leader execs, de_thread() kills
+ * the rest of the group and then hands the leader's pid, which is the tgid, to
+ * the exec'ing thread. The leader dies first, so sched_process_exit() above
+ * has already dropped that pid from the maps, and the survivor is now keyed by
+ * a pid nothing knows about while its original entry is left behind for good.
+ *
+ * Move the entry across so the task stays tracked and nothing is leaked.
+ * old_pid is sampled in bprm_execve() before de_thread() runs, so for the
+ * common case of the group leader exec'ing it simply equals p->pid and there
+ * is nothing to do.
+ */
+SEC("tp_btf/sched_process_exec")
+int BPF_PROG(sched_process_exec, struct task_struct *p, pid_t old_pid)
+{
+ pid_t pid = p->pid;
+ bool val = true;
+
+ if (pid == old_pid)
+ return 0;
+
+ if (bpf_map_lookup_elem(&pids_to_trace, &old_pid) != NULL) {
+ bpf_map_update_elem(&pids_to_trace, &pid, &val, BPF_ANY);
+ bpf_map_delete_elem(&pids_to_trace, &old_pid);
+ }
+
+ if (bpf_map_lookup_elem(&pids_filtered, &old_pid) != NULL) {
+ bpf_map_update_elem(&pids_filtered, &pid, &val, BPF_ANY);
+ bpf_map_delete_elem(&pids_filtered, &old_pid);
+ }
+
+ return 0;
+}
+
char _license[] SEC("license") = "GPL";
diff --git a/tools/perf/util/bpf_trace_augment.c b/tools/perf/util/bpf_trace_augment.c
index b47f11d40dd8..c1b1baf90eb2 100644
--- a/tools/perf/util/bpf_trace_augment.c
+++ b/tools/perf/util/bpf_trace_augment.c
@@ -29,7 +29,7 @@ static int attach_prog(struct bpf_link **link, struct bpf_program *prog, const c
return attach_err;
}
-int augmented_syscalls__prepare(void)
+int augmented_syscalls__prepare(bool inherit)
{
struct bpf_program *prog;
char buf[128];
@@ -41,12 +41,18 @@ int augmented_syscalls__prepare(void)
return -errno;
}
+ skel->rodata->inherit = inherit;
+
/*
- * Disable attaching the BPF programs except for sys_enter and
- * sys_exit that tail call into this as necessary.
+ * Disable attaching the BPF programs other than those attached
+ * explicitly by augmented_syscalls__attach(), the rest are reached by
+ * tail calls.
*/
bpf_object__for_each_program(prog, skel->obj) {
- if (prog != skel->progs.sys_enter && prog != skel->progs.sys_exit)
+ if (prog != skel->progs.sys_enter && prog != skel->progs.sys_exit &&
+ prog != skel->progs.sched_process_fork &&
+ prog != skel->progs.sched_process_exit &&
+ prog != skel->progs.sched_process_exec)
bpf_program__set_autoattach(prog, /*autoattach=*/false);
}
@@ -64,13 +70,42 @@ int augmented_syscalls__prepare(void)
return err;
}
+ return 0;
+}
+
+int augmented_syscalls__attach(void)
+{
+ int err;
+
+ if (skel == NULL)
+ return 0;
+
/*
- * Only sys_enter and sys_exit are attached, the remaining programs are
- * reached by tail calls. Attach them explicitly and, on failure, undo
- * any partial attachment: leaving sys_enter live on
- * raw_syscalls:sys_enter would keep running a BPF program for every
- * syscall on the system for a perf trace session that never starts.
+ * Attaching is deliberately separate from, and a lot later than,
+ * loading: these are system wide tracepoint programs, so from the
+ * moment they are attached they are the only thing deciding which
+ * tasks and syscalls are traced. Going live before the pid and
+ * syscall maps are populated would mean a target that forked in the
+ * meantime was never picked up by sched_process_fork() below.
+ *
+ * Attach explicitly, so that a failure part way through can undo what
+ * came before it: leaving sys_enter live on raw_syscalls:sys_enter
+ * would keep running a BPF program for every syscall on the system for
+ * a perf trace session that never starts.
+ *
+ * The scheduler programs maintain the pid maps, and are attached first
+ * so that no fork, exit or exec can be missed between sys_enter going
+ * live and the maps being maintained.
*/
+ if (attach_prog(&skel->links.sched_process_fork, skel->progs.sched_process_fork,
+ "sched_process_fork"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sched_process_exit, skel->progs.sched_process_exit,
+ "sched_process_exit"))
+ goto out_cleanup;
+ if (attach_prog(&skel->links.sched_process_exec, skel->progs.sched_process_exec,
+ "sched_process_exec"))
+ goto out_cleanup;
if (attach_prog(&skel->links.sys_enter, skel->progs.sys_enter, "sys_enter"))
goto out_cleanup;
if (attach_prog(&skel->links.sys_exit, skel->progs.sys_exit, "sys_exit"))
@@ -82,6 +117,13 @@ int augmented_syscalls__prepare(void)
err = attach_err;
/* Destroys every link attached above along with the skeleton. */
augmented_syscalls__cleanup();
+ /*
+ * Tearing the skeleton down closes file descriptors and frees memory,
+ * either of which may overwrite errno. Restore it so that a caller
+ * reporting this with "%m" describes the attach failure rather than
+ * whatever the teardown happened to do last.
+ */
+ errno = -err;
return err;
}
@@ -128,17 +170,29 @@ int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids)
bool value = true;
int err = 0;
- if (skel == NULL)
+ if (skel == NULL || nr == 0)
return 0;
+ /*
+ * Tell the BPF program that the pids_filtered map is in use. Without
+ * this it would have to look up every task in an empty map, on every
+ * syscall on the system, to find out that nothing is filtered.
+ */
for (size_t i = 0; i < nr; ++i) {
err = bpf_map__update_elem(skel->maps.pids_filtered, &pids[i],
sizeof(*pids), &value, sizeof(value),
BPF_ANY);
if (err)
- break;
+ return err;
}
- return err;
+ /*
+ * Publish the filter only now that the map is fully populated.
+ * augmented_syscalls__attach() has not run yet, so nothing is reading
+ * either of them, but keeping the flag and the map consistent means
+ * the ordering stays correct however the callers are rearranged.
+ */
+ skel->bss->has_pids_filtered = true;
+ return 0;
}
/*
@@ -161,45 +215,15 @@ int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids)
return err;
}
/*
- * Set the flag only once every target is in the map. The BPF programs
- * are attached by this point, so flipping it first would have them
- * filter against a partially populated map and drop syscalls made by
- * the targets that had not been added yet.
+ * Set the flag only once every target is in the map, so that the two
+ * are never inconsistent. Publishing it first would, once the
+ * programs are attached, have them filter against a partially
+ * populated map and drop syscalls made by targets not yet added.
*/
skel->bss->has_pids_to_trace = true;
return 0;
}
-int augmented_syscalls__add_target_pid(pid_t pid)
-{
- bool value = true;
-
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return 0;
-
- return bpf_map__update_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
- &value, sizeof(value), BPF_ANY);
-}
-
-int augmented_syscalls__del_target_pid(pid_t pid)
-{
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return 0;
-
- return bpf_map__delete_elem(skel->maps.pids_to_trace, &pid, sizeof(pid), 0);
-}
-
-bool augmented_syscalls__has_target_pid(pid_t pid)
-{
- bool value;
-
- if (skel == NULL || !skel->bss->has_pids_to_trace || skel->maps.pids_to_trace == NULL)
- return false;
-
- return bpf_map__lookup_elem(skel->maps.pids_to_trace, &pid, sizeof(pid),
- &value, sizeof(value), 0) == 0;
-}
-
/*
* Populate syscalls in the BPF syscalls_to_trace map:
* - not_syscalls: true if '!' prefix was specified (blacklist mode: trace
diff --git a/tools/perf/util/trace_augment.h b/tools/perf/util/trace_augment.h
index 5702eda3b469..ad992f5fa726 100644
--- a/tools/perf/util/trace_augment.h
+++ b/tools/perf/util/trace_augment.h
@@ -10,14 +10,12 @@ struct evlist;
#ifdef HAVE_BPF_SKEL
-int augmented_syscalls__prepare(void);
+int augmented_syscalls__prepare(bool inherit);
+int augmented_syscalls__attach(void);
int augmented_syscalls__create_bpf_output(struct evlist *evlist);
void augmented_syscalls__setup_bpf_output(void);
int augmented_syscalls__set_filter_pids(unsigned int nr, pid_t *pids);
int augmented_syscalls__set_target_pids(unsigned int nr, pid_t *pids);
-int augmented_syscalls__add_target_pid(pid_t pid);
-int augmented_syscalls__del_target_pid(pid_t pid);
-bool augmented_syscalls__has_target_pid(pid_t pid);
int augmented_syscalls__set_target_syscalls(unsigned int nr, int *syscall_ids, bool not_syscalls);
int augmented_syscalls__get_map_fds(int *enter_fd, int *exit_fd, int *beauty_fd);
struct bpf_program *augmented_syscalls__find_by_title(const char *name);
@@ -26,11 +24,16 @@ void augmented_syscalls__cleanup(void);
#else /* !HAVE_BPF_SKEL */
-static inline int augmented_syscalls__prepare(void)
+static inline int augmented_syscalls__prepare(bool inherit __maybe_unused)
{
return -1;
}
+static inline int augmented_syscalls__attach(void)
+{
+ return 0;
+}
+
static inline int augmented_syscalls__create_bpf_output(struct evlist *evlist __maybe_unused)
{
return -1;
@@ -52,21 +55,6 @@ static inline int augmented_syscalls__set_target_pids(unsigned int nr __maybe_un
return 0;
}
-static inline int augmented_syscalls__add_target_pid(pid_t pid __maybe_unused)
-{
- return 0;
-}
-
-static inline int augmented_syscalls__del_target_pid(pid_t pid __maybe_unused)
-{
- return 0;
-}
-
-static inline bool augmented_syscalls__has_target_pid(pid_t pid __maybe_unused)
-{
- return false;
-}
-
static inline int augmented_syscalls__set_target_syscalls(unsigned int nr __maybe_unused,
int *syscall_ids __maybe_unused,
bool not_syscalls __maybe_unused)
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 07/14] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (5 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 06/14] perf trace: Handle fork and exit directly in BPF filter maps Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 08/14] perf test common: Do not globally disable tracing events in clear_all_probes Ian Rogers
` (6 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
test_task_analyzer.sh writes perf.data and temporary files directly into
the current working directory, causing collisions when running tests in
parallel.
As a temporary measure until `perf script report` supports an input file
option, resolve perfdir to an absolute path, change directory into $tmpdir
for the test duration, and clean up in the exit trap. Remove the
(exclusive) tag so the test runs in parallel.
perfdir is derived from $0, which may be relative, so it has to be
resolved before the cd into $tmpdir, otherwise both PERF_EXEC_PATH and
the cleanup trap point at paths that no longer exist.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/test_task_analyzer.sh | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/test_task_analyzer.sh b/tools/perf/tests/shell/test_task_analyzer.sh
index 0314412e63b4..76df8af3312d 100755
--- a/tools/perf/tests/shell/test_task_analyzer.sh
+++ b/tools/perf/tests/shell/test_task_analyzer.sh
@@ -1,8 +1,18 @@
#!/bin/bash
-# perf script task-analyzer tests (exclusive)
+# perf script task-analyzer tests
# SPDX-License-Identifier: GPL-2.0
+# Resolve the source directory before changing the working directory below,
+# $0 may be a relative path and would no longer resolve from $tmpdir.
+perfdir=$(cd "$(dirname "$0")/../.." && pwd)
+
tmpdir=$(mktemp -d /tmp/perf-script-task-analyzer-XXXXX)
+# The cleanup trap is only installed further down, once the functions it
+# calls have been defined, so tidy up by hand if this cd fails.
+cd "$tmpdir" || {
+ rmdir "$tmpdir"
+ exit 1
+}
# TODO: perf script report only supports input from the CWD perf.data file, make
# it support input from any file.
perfdata="perf.data"
@@ -11,7 +21,6 @@ csvsummary="$tmpdir/csvsummary"
err=0
# set PERF_EXEC_PATH to find scripts in the source directory
-perfdir=$(dirname "$0")/../..
if [ -e "$perfdir/scripts/python/Perf-Trace-Util" ]; then
export PERF_EXEC_PATH=$perfdir
fi
@@ -20,8 +29,7 @@ fi
export ASAN_OPTIONS=detect_leaks=0
cleanup() {
- rm -f "${perfdata}"
- rm -f "${perfdata}".old
+ cd "$perfdir" || cd /tmp || exit
rm -rf "$tmpdir"
trap - exit term int
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 08/14] perf test common: Do not globally disable tracing events in clear_all_probes
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (6 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 07/14] perf test test_task_analyzer: Isolate in temporary directory and make non-exclusive Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 09/14] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive Ian Rogers
` (5 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
`echo 0 > /sys/kernel/debug/tracing/events/enable` disables tracepoint
events system-wide. When running tests in parallel, this kills active
tracing and recording sessions in concurrent tests (such as perf trace
and perf record).
Remove the global event disable from clear_all_probes().
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/common/init.sh | 1 -
1 file changed, 1 deletion(-)
diff --git a/tools/perf/tests/shell/common/init.sh b/tools/perf/tests/shell/common/init.sh
index cbfc78bec974..d2c7a31e2c6f 100644
--- a/tools/perf/tests/shell/common/init.sh
+++ b/tools/perf/tests/shell/common/init.sh
@@ -132,7 +132,6 @@ check_uprobes_available()
clear_all_probes()
{
- echo 0 > /sys/kernel/debug/tracing/events/enable
check_kprobes_available && echo > /sys/kernel/debug/tracing/kprobe_events
check_uprobes_available && echo > /sys/kernel/debug/tracing/uprobe_events
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 09/14] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (7 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 08/14] perf test common: Do not globally disable tracing events in clear_all_probes Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 10/14] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, " Ian Rogers
` (4 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
The probe name `vfs_getname` was hardcoded, causing collisions when
tests ran concurrently. Furthermore, `cleanup_probe_vfs_getname()` used
`perf probe -d probe:vfs_getname*`, deleting probes registered by other
parallel tests.
Scope the probe name to the pid, and rename it to `getname_flags_$$` so
that it no longer begins with "vfs_getname". perf trace calls
evlist__add_vfs_getname(), which opens every event matching a hardcoded
"probe:vfs_getname*" wildcard, so a perf trace run by any other test
would otherwise pin this probe and make `perf probe -d` fail with
-EBUSY. That also unblocks making the perf trace tests non-exclusive
later in this series.
Enumerate the probes to record and to delete from `perf probe -l`,
matching `^probe:${vfs_getname}(_[[:digit:]]+)?$` exactly, rather than
globbing on `${vfs_getname}*`. perf probe appends _1, _2, ... when
getname_flags is inlined at more than one call site, so the variants do
have to be matched, but since the name now ends in a pid a trailing
wildcard would also match the probes of a test whose pid merely starts
with this one's, e.g. 123 and 1234.
Remove the `(exclusive)` tag from probe_vfs_getname.sh and
record+script_probe_vfs_getname.sh so they run concurrently in pass 1.
trace+probe_vfs_getname.sh has to stay exclusive: it is the one test
that wants to be discovered by that wildcard, so it sets vfs_getname to
a "vfs_getname_$$" name before sourcing the library, and would then pin
its siblings' probes if it ran alongside them. A comment in the test
records this.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../perf/tests/shell/lib/probe_vfs_getname.sh | 34 ++++++++++++++++---
tools/perf/tests/shell/probe_vfs_getname.sh | 3 +-
.../shell/record+script_probe_vfs_getname.sh | 18 +++++++---
.../tests/shell/trace+probe_vfs_getname.sh | 9 +++++
4 files changed, 54 insertions(+), 10 deletions(-)
diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
index 88cd0e26d5f6..89a4b6fa5ea1 100644
--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
@@ -1,12 +1,38 @@
#!/bin/bash
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
-perf probe -l 2>&1 | grep -q probe:vfs_getname
+# The name of the getname_flags probe added and removed below.
+#
+# It is scoped to the pid so that tests running in parallel do not collide,
+# and it deliberately does not start with "vfs_getname": perf trace calls
+# evlist__add_vfs_getname(), which opens everything matching the hardcoded
+# "probe:vfs_getname*" wildcard, so a perf trace running in another test would
+# otherwise pin this probe and make the 'perf probe -d' below fail with -EBUSY.
+#
+# trace+probe_vfs_getname.sh is the one test that does want to be found that
+# way, so it sets vfs_getname itself before sourcing this file, and is
+# (exclusive) as a result.
+: "${vfs_getname:=getname_flags_$$}"
+
+# Print the probes add_probe_vfs_getname() created. perf probe appends _1, _2,
+# ... when getname_flags is inlined at more than one call site, so there can be
+# several. Match them exactly rather than with a "${vfs_getname}*" glob: the
+# name ends in a pid, so such a glob would also match the probes of a test
+# whose pid merely starts with this one's, e.g. 123 and 1234.
+probes_vfs_getname() {
+ perf probe -l 2>/dev/null | awk '{print $1}' |
+ grep -E "^probe:${vfs_getname}(_[[:digit:]]+)?$"
+}
+
+[ -n "$(probes_vfs_getname)" ]
had_vfs_getname=$?
cleanup_probe_vfs_getname() {
if [ $had_vfs_getname -eq 1 ] ; then
- perf probe -q -d probe:vfs_getname*
+ local probe
+ for probe in $(probes_vfs_getname); do
+ perf probe -q -d "$probe"
+ done
fi
}
@@ -33,8 +59,8 @@ add_probe_vfs_getname() {
return 2
fi
- perf probe -q "vfs_getname=getname_flags:${line} pathname=result->name:string" || \
- perf probe $add_probe_verbose "vfs_getname=getname_flags:${line} pathname=filename:ustring" || return 1
+ perf probe -q "${vfs_getname}=getname_flags:${line} pathname=result->name:string" || \
+ perf probe $add_probe_verbose "${vfs_getname}=getname_flags:${line} pathname=filename:ustring" || return 1
fi
}
diff --git a/tools/perf/tests/shell/probe_vfs_getname.sh b/tools/perf/tests/shell/probe_vfs_getname.sh
index 5fe5682c28ce..05f1d50732b6 100755
--- a/tools/perf/tests/shell/probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/probe_vfs_getname.sh
@@ -1,6 +1,5 @@
#!/bin/bash
-# Add vfs_getname probe to get syscall args filenames (exclusive)
-
+# Add vfs_getname probe to get syscall args filenames
# SPDX-License-Identifier: GPL-2.0
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
diff --git a/tools/perf/tests/shell/record+script_probe_vfs_getname.sh b/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
index 002f7037f182..1d4fb4a4fbfe 100755
--- a/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/record+script_probe_vfs_getname.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Use vfs_getname probe to get syscall args filenames (exclusive)
+# Use vfs_getname probe to get syscall args filenames
# Uses the 'perf test shell' library to add probe:vfs_getname to the system
# then use it with 'perf record' using 'touch' to write to a temp file, then
@@ -17,22 +17,32 @@ skip_if_no_perf_probe || exit 2
# shellcheck source=lib/probe_vfs_getname.sh
. "$(dirname "$0")/lib/probe_vfs_getname.sh"
+# shellcheck disable=SC2154 # vfs_getname is assigned in lib/probe_vfs_getname.sh
record_open_file() {
echo "Recording open file:"
# Check presence of libtraceevent support to run perf record
- skip_no_probe_record_support "probe:vfs_getname*"
+ skip_no_probe_record_support
if [ $? -eq 2 ]; then
echo "WARN: Skipping test record_open_file. No libtraceevent support"
return 2
fi
- perf record -o ${perfdata} -e probe:vfs_getname\* touch $file
+ # Record every probe the inlining of getname_flags produced, naming
+ # them exactly rather than with a "${vfs_getname}*" glob, which would
+ # also match the probes of a test whose pid starts with this one's.
+ local events
+ events=$(probes_vfs_getname | paste -sd, -)
+ if [ -z "${events}" ] ; then
+ echo "FAIL: no ${vfs_getname} probe to record"
+ return 1
+ fi
+ perf record -o ${perfdata} -e "${events}" touch $file
}
perf_script_filenames() {
echo "Looking at perf.data file for vfs_getname records for the file we touched:"
perf script -i ${perfdata} | \
- grep -E " +touch +[0-9]+ +\[[0-9]+\] +[0-9]+\.[0-9]+: +probe:vfs_getname[_0-9]*: +\([[:xdigit:]]+\) +pathname=\"${file}\""
+ grep -E " +touch +[0-9]+ +\[[0-9]+\] +[0-9]+\.[0-9]+: +probe:${vfs_getname}(_[0-9]+)?: +\([[:xdigit:]]+\) +pathname=\"${file}\""
}
add_probe_vfs_getname
diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
index 7a0b1145d0cd..146305f4d549 100755
--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
@@ -10,6 +10,13 @@
# SPDX-License-Identifier: GPL-2.0
# Arnaldo Carvalho de Melo <acme@kernel.org>, 2017
+# This test must stay exclusive, and is the only one of the probe tests that
+# does: it does not name the event it uses. perf trace discovers it with the
+# hardcoded "probe:vfs_getname*" wildcard in evlist__add_vfs_getname(), so the
+# probe has to carry that prefix, and a parallel run of this test would then
+# also match, and pin, the probes of the other tests. The sibling tests avoid
+# all of this by using a name that the wildcard cannot reach.
+
# shellcheck source=lib/probe.sh
. "$(dirname $0)"/lib/probe.sh
@@ -17,6 +24,8 @@ skip_if_no_perf_probe || exit 2
skip_if_no_perf_trace || exit 2
[ "$(id -u)" = 0 ] || exit 2
+# shellcheck disable=SC2034 # consumed by lib/probe_vfs_getname.sh
+vfs_getname="vfs_getname_$$"
. "$(dirname $0)"/lib/probe_vfs_getname.sh
trace_open_vfs_getname() {
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 10/14] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, and make non-exclusive
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (8 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 09/14] perf test probe_vfs_getname: Scope probe name to PID and make non-exclusive Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:38 ` [PATCH v2 11/14] perf test trace_summary: Improve error diagnostics Ian Rogers
` (3 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
The uprobe name was not scoped to PID, and concurrent writes to
`/sys/kernel/debug/tracing/uprobe_events` can occasionally return
`-EBUSY` when another process holds the tracefs inode lock.
Scope the probe event name with `$$` (`inet_pton_$$=inet_pton`) and add
a retry loop with backoff for uprobe addition. Drop the
`(exclusive)` tag so the test can run in parallel during pass 1.
A PID scoped probe is no longer cleaned up by any other test, so add an
EXIT/TERM/INT trap to delete it, otherwise an interrupted run leaks the
uprobe into the system. The trap is installed only after the root and
IPv6 checks that `exit 2` to skip the test, as trap_cleanup() exits 1
and would otherwise turn those skips into failures. Deletion enumerates
the probes from `perf probe -l`, matching
`^probe_libc:inet_pton_$$(_[[:digit:]]+)?$` exactly, rather than reading
$event_name: a signal arriving after perf probe injected the uprobe but
before the assignment completed would leave that variable empty and leak
the probe, and an `inet_pton_$$*` glob would reach the probe of a test
whose pid merely starts with this one's.
While here use mktemp rather than mktemp -u for the temporary files:
this test runs as root in a world writable /tmp, and predicting a name
without creating it allows another user to win the race and plant a
symlink. The perf.data check becomes -s rather than -e as mktemp now
pre-creates an empty file.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../shell/record+probe_libc_inet_pton.sh | 83 ++++++++++++++-----
1 file changed, 63 insertions(+), 20 deletions(-)
diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index eca629ee83f0..3eb51426373b 100755
--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# probe libc's inet_pton & backtrace it with ping (exclusive)
+# probe libc's inet_pton & backtrace it with ping
# Installs a probe on libc's inet_pton function, that will use uprobes,
# then use 'perf trace' on a ping to localhost asking for just one packet
@@ -21,20 +21,30 @@ nm -Dg $libc 2>/dev/null | grep -F -q inet_pton || exit 254
event_pattern='probe_libc:inet_pton(_[[:digit:]]+)?'
add_libc_inet_pton_event() {
+ local attempts=0
+ while [ $attempts -lt 3 ]; do
+ event_name=$(perf probe -f -x $libc -a "inet_pton_$$=inet_pton" 2>&1 | \
+ awk -v ep="$event_pattern" -v l="$libc" '$0 ~ ep && $0 ~ \
+ ("\\(on inet_pton in " l "\\)") {print $1}' | head -n 1)
+
+ if [ -n "$event_name" ]; then
+ return 0
+ fi
+ attempts=$((attempts + 1))
+ sleep 0.1
+ done
- event_name=$(perf probe -f -x $libc -a inet_pton 2>&1 | \
- awk -v ep="$event_pattern" -v l="$libc" '$0 ~ ep && $0 ~ \
- ("\\(on inet_pton in " l "\\)") {print $1}' | head -n 1)
-
- if [ $? -ne 0 ] || [ -z "$event_name" ] ; then
- printf "FAIL: could not add event\n"
- return 1
- fi
+ printf "FAIL: could not add event\n"
+ return 1
}
trace_libc_inet_pton_backtrace() {
- expected=`mktemp -u /tmp/expected.XXX`
+ # Create the files rather than just reserving names with mktemp -u:
+ # this runs as root and /tmp is world writable, so a predictable name
+ # that is written to later can be pre-created as a symlink by an
+ # unprivileged user and used to clobber an arbitrary file.
+ expected=$(mktemp /tmp/expected.XXX)
echo "ping[][0-9 \.:]+$event_name: \([[:xdigit:]]+\)" > $expected
echo ".*inet_pton\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected
@@ -50,8 +60,8 @@ trace_libc_inet_pton_backtrace() {
;;
esac
- perf_data=`mktemp -u /tmp/perf.data.XXX`
- perf_script=`mktemp -u /tmp/perf.script.XXX`
+ perf_data=$(mktemp /tmp/perf.data.XXX)
+ perf_script=$(mktemp /tmp/perf.script.XXX)
# Check presence of libtraceevent support to run perf record
skip_no_probe_record_support "$event_name/$eventattr/"
@@ -61,9 +71,10 @@ trace_libc_inet_pton_backtrace() {
fi
perf record -e $event_name/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1
- # check if perf data file got created in above step.
- if [ ! -e $perf_data ]; then
- printf "FAIL: perf record failed to create \"%s\" \n" "$perf_data"
+ # Check perf record actually wrote data. mktemp already created the
+ # file, so test that it is non-empty rather than that it exists.
+ if [ ! -s $perf_data ]; then
+ printf "FAIL: perf record failed to write \"%s\" \n" "$perf_data"
return 1
fi
perf script -i $perf_data | tac | grep -m1 ^ping -B9 | tac > $perf_script
@@ -97,21 +108,53 @@ trace_libc_inet_pton_backtrace() {
# even if the perf script output does not match.
}
+# Print the pid scoped uprobes this test may have created. perf probe appends
+# _1, _2, ... when the name is already taken, so match those too, but anchor
+# the match: an "inet_pton_$$*" glob would also match the probe of a test whose
+# pid merely starts with this one's, e.g. 123 and 1234.
+libc_inet_pton_events() {
+ perf probe -l 2>/dev/null | awk '{print $1}' |
+ grep -E "^probe_libc:inet_pton_$$(_[[:digit:]]+)?$"
+}
+
delete_libc_inet_pton_event() {
+ # Ask the kernel what is actually there rather than trusting
+ # $event_name: a signal arriving after perf probe injected the uprobe
+ # but before the assignment to event_name completed would otherwise
+ # leave the variable empty and leak the probe.
+ local probe
+ for probe in $(libc_inet_pton_events); do
+ perf probe -q -d "$probe"
+ done
+}
- if [ -n "$event_name" ] ; then
- perf probe -q -d $event_name
- fi
+cleanup() {
+ rm -f ${perf_data} ${perf_script} ${expected}
+ delete_libc_inet_pton_event
+
+ trap - EXIT TERM INT
+}
+
+trap_cleanup() {
+ cleanup
+ exit 1
}
# Check for IPv6 interface existence
ip a sh lo | grep -F -q inet6 || exit 2
[ "$(id -u)" = 0 ] || exit 2
+# Install the trap only now that the skips above are out of the way: it exits
+# 1, so arming it any earlier would turn an 'exit 2' skip into a failure.
+#
+# The event name is pid scoped, so unlike the old fixed name an orphan left
+# behind by an interrupted run is never overwritten by a later run: it would
+# stay in the kernel forever. Always clean up, including on a signal.
+trap trap_cleanup EXIT TERM INT
+
skip_if_no_perf_probe && \
add_libc_inet_pton_event && \
trace_libc_inet_pton_backtrace
err=$?
-rm -f ${perf_data} ${perf_script} ${expected}
-delete_libc_inet_pton_event
+cleanup
exit $err
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 11/14] perf test trace_summary: Improve error diagnostics
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (9 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 10/14] perf test record+probe_libc_inet_pton: Scope event to PID, add retries, " Ian Rogers
@ 2026-09-17 16:38 ` Ian Rogers
2026-09-17 16:39 ` [PATCH v2 12/14] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive Ian Rogers
` (2 subsequent siblings)
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:38 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
When pattern matching fails in test_perf_trace(), print the command
that failed along with the actual match count, the matching lines
found, and the first 15 lines of output to aid debugging.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_summary.sh | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/trace_summary.sh b/tools/perf/tests/shell/trace_summary.sh
index b80dea77cec6..f975176247b5 100755
--- a/tools/perf/tests/shell/trace_summary.sh
+++ b/tools/perf/tests/shell/trace_summary.sh
@@ -28,10 +28,14 @@ test_perf_trace() {
count=$(grep -E -c -m 3 "${search}" ${OUTPUT})
if [ "${count}" != "3" ]; then
- echo "Error: cannot find enough pattern ${search} in the output"
- cat ${OUTPUT}
- rm -f ${OUTPUT}
- exit 1
+ echo "Error: cannot find enough pattern ${search} (count=${count}) in output of:"
+ echo "Error: perf trace ${args} -- ${workload}"
+ echo "Error: matched lines:"
+ grep -E "${search}" ${OUTPUT} || echo "none"
+ echo "Error: first 15 lines of output:"
+ head -n 15 ${OUTPUT}
+ rm -f ${OUTPUT}
+ exit 1
fi
}
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 12/14] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (10 preceding siblings ...)
2026-09-17 16:38 ` [PATCH v2 11/14] perf test trace_summary: Improve error diagnostics Ian Rogers
@ 2026-09-17 16:39 ` Ian Rogers
2026-09-17 16:39 ` [PATCH v2 13/14] perf test trace_summary: Make non-exclusive Ian Rogers
2026-09-17 16:39 ` [PATCH v2 14/14] perf test uprobe_from_different_cu: Scope probe name to PID Ian Rogers
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:39 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
trace_btf_general.sh used `--max-events=1` with `perf trace` on
commands such as `mv`, `echo`, and `sleep`. When background activity
occurs or tests run in parallel, `perf trace` can capture an event
from an unrelated process and exit prematurely before recording the
target command's syscalls.
Drop `--max-events=1` and let tracing run until the command completes,
checking for the expected output with grep (matching trace_btf_enum.sh).
Remove the (exclusive) tag so the test runs in parallel.
Running perf trace in parallel is only safe now that the probe tests no
longer name their probes "vfs_getname...": perf trace opens everything
matching a hardcoded "probe:vfs_getname*" wildcard, which used to pin
those probes and make their cleanup fail with -EBUSY.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_btf_general.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/perf/tests/shell/trace_btf_general.sh b/tools/perf/tests/shell/trace_btf_general.sh
index 7a94a5743924..4d654b687a4e 100755
--- a/tools/perf/tests/shell/trace_btf_general.sh
+++ b/tools/perf/tests/shell/trace_btf_general.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# perf trace BTF general tests (exclusive)
+# perf trace BTF general tests
# SPDX-License-Identifier: GPL-2.0
err=0
@@ -27,7 +27,7 @@ check_vmlinux() {
trace_test_string() {
echo "Testing perf trace's string augmentation"
- output="$(perf trace --sort-events -e renameat* --max-events=1 -- mv ${file1} ${file2} 2>&1)"
+ output="$(perf trace --sort-events -e renameat* -- mv ${file1} ${file2} 2>&1)"
if ! echo "$output" | grep -q -E "^mv/[0-9]+ renameat(2)?\(.*, \"${file1}\", .*, \"${file2}\", .*\) += +[0-9]+$"
then
printf "String augmentation test failed, output:\n$output\n"
@@ -38,7 +38,7 @@ trace_test_string() {
trace_test_buffer() {
echo "Testing perf trace's buffer augmentation"
# echo will insert a newline (\10) at the end of the buffer
- output="$(perf trace --sort-events -e write --max-events=1 -- echo "${buffer}" 2>&1)"
+ output="$(perf trace --sort-events -e write -- echo "${buffer}" 2>&1)"
if ! echo "$output" | grep -q -E "^echo/[0-9]+ write\([0-9]+, ${buffer}.*, [0-9]+\) += +[0-9]+$"
then
printf "Buffer augmentation test failed, output:\n$output\n"
@@ -48,7 +48,7 @@ trace_test_buffer() {
trace_test_struct_btf() {
echo "Testing perf trace's struct augmentation"
- output="$(perf trace --sort-events -e clock_nanosleep --force-btf --max-events=1 -- sleep 1 2>&1)"
+ output="$(perf trace --sort-events -e clock_nanosleep --force-btf -- sleep 1 2>&1)"
if ! echo "$output" | grep -q -E "^sleep/[0-9]+ clock_nanosleep\(0, 0, \{1,.*\}, 0x[0-9a-f]+\) += +[0-9]+$"
then
printf "BTF struct augmentation test failed, output:\n$output\n"
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 13/14] perf test trace_summary: Make non-exclusive
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (11 preceding siblings ...)
2026-09-17 16:39 ` [PATCH v2 12/14] perf test trace_btf_general: Drop --max-events=1 and make non-exclusive Ian Rogers
@ 2026-09-17 16:39 ` Ian Rogers
2026-09-17 16:39 ` [PATCH v2 14/14] perf test uprobe_from_different_cu: Scope probe name to PID Ian Rogers
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:39 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
trace_summary.sh tests various summary modes of `perf trace`. It already
directs output to a unique temporary file without polluting the current
working directory.
Remove the (exclusive) tag so it can run concurrently in parallel test
runs.
Running perf trace in parallel is only safe now that the probe tests no
longer name their probes "vfs_getname...": perf trace opens everything
matching a hardcoded "probe:vfs_getname*" wildcard, which used to pin
those probes and make their cleanup fail with -EBUSY.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/shell/trace_summary.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/trace_summary.sh b/tools/perf/tests/shell/trace_summary.sh
index f975176247b5..e2834bc4eee6 100755
--- a/tools/perf/tests/shell/trace_summary.sh
+++ b/tools/perf/tests/shell/trace_summary.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# perf trace summary (exclusive)
+# perf trace summary
# SPDX-License-Identifier: GPL-2.0
# Check that perf trace works with various summary mode
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v2 14/14] perf test uprobe_from_different_cu: Scope probe name to PID
2026-09-17 16:38 ` [PATCH v2 00/14] perf trace: Fix BPF filtering and make tracing tests non-exclusive Ian Rogers
` (12 preceding siblings ...)
2026-09-17 16:39 ` [PATCH v2 13/14] perf test trace_summary: Make non-exclusive Ian Rogers
@ 2026-09-17 16:39 ` Ian Rogers
13 siblings, 0 replies; 29+ messages in thread
From: Ian Rogers @ 2026-09-17 16:39 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, james.clark, jolsa, linux-kernel,
linux-perf-users, mingo, peterz
The test builds a binary in a per-run temporary directory and probes
its foo function. The directory name is unique, but perf probe derives
the event name from the probed function and the group name from the
binary's basename, so every run registers the same probe_testfile:foo
event.
Running the test concurrently with itself, as 'perf test -r3' does,
therefore fails in all but one of the runs with:
Error: event "foo" already exists.
Hint: Remove existing event by 'perf probe -d'
and a losing run's cleanup goes on to delete the winning run's probe
out from under it.
Name the event after the pid, foo_$$, so that parallel runs no longer
collide. This lets the test stay in the parallel pass rather than
having to be marked (exclusive).
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
.../perf/tests/shell/test_uprobe_from_different_cu.sh | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
index 7adf9755d6de..47c99d93436b 100755
--- a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
+++ b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
@@ -18,12 +18,19 @@ fi
temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX)
+# The name of the uprobe added and removed below. The probe is placed on
+# ${temp_dir}/testfile, but perf probe derives the event name from the probed
+# function and the group name from the binary's basename, so every run would
+# otherwise share one probe_testfile:foo event, and a concurrent run would
+# fail with 'event "foo" already exists'. Scope the event name to the pid.
+probe_name="foo_$$"
+
cleanup()
{
trap - EXIT TERM INT
if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then
echo "--- Cleaning up ---"
- perf probe -x ${temp_dir}/testfile -d foo || true
+ perf probe -x ${temp_dir}/testfile -d ${probe_name} || true
rm -f "${temp_dir}/"*
rmdir "${temp_dir}"
fi
@@ -84,6 +91,6 @@ gcc -g -Og -c ${temp_dir}/testfile-main.c -o ${temp_dir}/testfile-main.o
gcc -g -Og -o ${temp_dir}/testfile ${temp_dir}/testfile-foo.o ${temp_dir}/testfile-main.o
perf probe -x ${temp_dir}/testfile --funcs foo | grep "foo"
-perf probe -x ${temp_dir}/testfile foo
+perf probe -x ${temp_dir}/testfile ${probe_name}=foo
cleanup
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 29+ messages in thread