arch_is_topdown_slots() requires config1 == 0, so it misidentified
"cpu/slots,metrics_clear=1/" as not being the slots event, and an
additional slots event gets inserted, which fails event scheduling
since the group now needs two fixed counter 3.
$ perf stat -e "{cpu/slots,metrics_clear=1/,cpu/topdown-retiring/}" -- sleep 1
WARNING: events were regrouped to match PMUs
<not counted> slots
<not supported> cpu/slots,metrics_clear=1/
<not counted> cpu/topdown-retiring/
Drop the config1 == 0 check from arch_is_topdown_slots(). This is
safe: config1 has no bearing on the event's identifying config value
(TOPDOWN_SLOTS, 0x0400).
The attr.type == PERF_TYPE_RAW check is what actually matters: only the
core PMU is registered with PERF_TYPE_RAW, and on x86, 0x400 is
guaranteed to be slots event on core CPU.
arch_is_topdown_metrics() keeps its own config1 == 0 check, since
genuine metrics events have no "metrics_clear" and config1 remains 0.
Add a test verifying that an explicit "slots,metrics_clear=1" event in
a group does not trigger an extra slots event injection.
Fixes: 5b546de9cc ("perf topdown: Use attribute to see an event is a topdown metic or slots")
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
[ Add missing stdio.h and string.h as noticed by Sashiko ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
It parses fdinfo with PMU type, comparing with the event which failed to
open, and report the processes causing EBUSY error.
Testing cycles and intel_pt//
$ ./perf stat -e cycles &
[1] 55569
$ ./perf stat -e intel_pt// &
[2] 55683
$ ./perf stat -e intel_pt//
Error:
The PMU intel_pt counters are busy and in use by another process.
Possible processes:
55683 ./perf stat -e intel_pt//
Only perf with intel_pt was reported.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Chun-Tse Shao <ctshao@google.com>
Assisted-by: Gemini:gemini-3.1-pro-preview
[ Added a few missing includes as per Sashiko's review ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The unsigned int type should use the %u format specifier when
printing with printf or related functions.
Signed-off-by: liujing <liujing@cmss.chinamobile.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When processing POLLHUP on a non_perf_event control descriptor,
evlist__finalize_ctlfd() is invoked to finalize the setup, correctly
setting the core evlist's poll array file descriptor to -1. However,
this finalized teardown state is never propagated back to the
individual thread's local replica of the pollfd array.
Consequently, on the next iteration of the main recording loop,
record__update_evlist_pollfd_from_thread() performs a strict
equivalence check between the core evlist's array and the thread's
localized poll array, detecting that the fd values no longer match.
This causes an immediate -EINVAL abort and a premature teardown.
Fix the underlying logic within
record__update_evlist_pollfd_from_thread() to sustainably propagate
the finalized teardown statuses (-1) originating from the core evlist
back to the thread's localized poll structure. This correctly
maintains synchronization and entirely prevents the unhandled
index mismatch crashes.
Additionally, add a unit test that explicitly validates that
fdarray__filter() preserves its invariants regarding
fdarray_flag__nonfilterable items to guard against regressions.
Fixes: fb4751e79c ("perf record: Fix teardown hang on system-wide multi-threaded sessions")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Gemini:gemini-3.1-pro
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The test's only guard matches "failed: no PMU supports the memory
events", but a PMU that has memory events and refuses them per-thread,
such as AMD IBS on kernels without the swfilt filter, falls through:
the script runs under 'set -e' and the bare 'perf mem record' aborts it
through the EXIT trap, reporting a signal that never happened and
turning "this PMU cannot record these events" into a test failure.
Skip when a trivial per-thread 'perf mem record' fails, and put the
record and annotate calls in the condition of an 'if', where 'set -e'
leaves them alone, so the remaining cases report their own failures
instead of the first one aborting the run.
Fixes: f60a5c2296 ("perf tests: Test annotate with data type profiling and rust")
Acked-by: Namhyung Kim <namhyung@kernel.org>
Assisted-by: LLM
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The type histogram maintains sample counts and periods per offset. Use
a hashmap instead of an array to reduce the memory overhead.
No functional changes intended.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Reviewed-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Validate that SIMD registers (XMM/YMM/ZMM/OPMASK on x86) can be sampled
correctly with hardware support.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Validate that eGPRs (extended general purpose registers) and SSP
(shadow stack pointer) registers can be sampled correctly on x86
platforms.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Enhance the x86-specific DWARF register handling by adding support for
SIMD and eGPRs registers.
This update is based on the "DWARF Register Number Mapping" table from
the "System V Application Binary Interface AMD64 Architecture Processor
Supplement" (version 1.0).
Modifications include:
- Updating the x86_64_regidx_table[] array to incorporate SIMD and eGPRs
registers.
- Enhancing the __get_dwarf_regnum_for_perf_regnum_x86_64() function to
retrieve the DWARF register index for eGPRs.
Since currently libdw doesn't support SIMD and APX eGPRs registers yet,
still keep the original return value for get_libdw_frame_nregs() helper.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Add support for the newly introduced SIMD register sampling format by
adding the following 5 functions:
uint64_t perf_intr_simd_reg_class_mask(uint16_t e_machine, bool pred);
uint64_t perf_user_simd_reg_class_mask(uint16_t e_machine, bool pred);
uint64_t perf_intr_simd_reg_class_bitmap_qwords(uint16_t e_machine, int reg_c,
uint16_t *qwords, bool pred);
uint64_t perf_user_simd_reg_class_bitmap_qwords(uint16_t e_machine, int reg_c,
uint16_t *qwords, bool pred);
const char *perf_simd_reg_class_name(uint16_t e_machine, int id, bool pred);
The perf_{intr|user}_simd_reg_class_mask() functions retrieve the bitmap
of kernel supported SIMD/PRED register classes on current platform for
intr-regs and user-regs sampling, such as OPMASK/XMM/YMM/ZMM on
x86 platforms.
The perf_{intr|user}_simd_reg_class_bitmap_qwords() functions retrieve
the bitmap and qwords length of a certain class of SIMD/PRED register
on current platform for intr-regs and user-regs sampling. For example,
for the XMM registers on x86 platforms, the returned bitmap is 0xffff
(XMM0 ~ XMM15) and the qwords length is 2 (128 bits for each XMM
register).
The perf_simd_reg_class_name() function gets the register class name for
a certain register class index.
Additionally, the function __parse_regs() is enhanced to support parsing
these newly introduced SIMD/PRED registers. Currently, each class of
register can only be sampled collectively; sampling a specific SIMD
register is not supported. For example, all XMM registers are sampled
together rather than sampling only XMM0.
When multiple overlapping register types, such as XMM and YMM, are
sampled simultaneously, only the superset (YMM registers) is sampled.
With this patch, all supported sampling registers on x86 platforms are
displayed as follows.
$perf record --intr-regs=?
available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10
R11 R12 R13 R14 R15 R16 R17 R18 R19 R20 R21 R22 R23 R24 R25 R26 R27 R28
R29 R30 R31 SSP XMM0-15 YMM0-15 ZMM0-31 OPMASK0-7
$perf record --user-regs=?
available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10
R11 R12 R13 R14 R15 R16 R17 R18 R19 R20 R21 R22 R23 R24 R25 R26 R27 R28
R29 R30 R31 SSP XMM0-15 YMM0-15 ZMM0-31 OPMASK0-7
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Add support for sampling x86 extended GP registers (R16-R31) and the
shadow stack pointer (SSP) register.
The original XMM registers space in sample_regs_user/sample_regs_intr is
reclaimed to represent the eGPRs and SSP when SIMD registers sampling is
supported with the new SIMD sampling fields in the perf_event_attr
structure. This necessitates a way to distinguish which register layout
is used for the sample_regs_user/sample_regs_intr bitmap.
To address this, a new "abi" argument is added to the helpers
perf_intr_reg_mask(), perf_user_reg_mask(), and perf_reg_name(). When
"abi & PERF_SAMPLE_REGS_ABI_SIMD" is true, it indicates the eGPRs and SSP
layout is represented; otherwise, the legacy XMM registers are
represented.
Please note that PERF_SAMPLE_REGS_ABI_SIMD is set by default on platforms
that support SIMD register sampling, even when no eGPR or SSP register is
requested (for example, -Iax). As a result, sample_regs_intr and
sample_regs_usr always use the new GPR layout on platforms with SIMD
register sampling support.
The patch only supports eGPRs and SSP sampling, the complete SIMD
registers sampling would be supported in the next patch.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Sync the UAPI header changes of supporting SIMD/eGPRs/SSP sampling into
corresponding tools UAPI headers.
Additionally, support the new introduced perf_event_attr fields in the
perf_event_attr__fprintf and perf_event__attr_swap() helpers, and add
sanity check for the new introduced __reserved_4 field in
perf_attr_check().
Co-developed-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Some new introduced perf_event_attr fields, like config3 and config4,
are forgotten to add into perf_event_attr__fprintf() and
perf_event__attr_swap() helpers. Add these missed fields into these 2
helpers.
The aux_action is an exception. aux_action aliases bitfields
(e.g. aux_start_paused) in a union. Bitfields and plain u32 fields
follow different endian rules, so both views cannot be swapped
correctly at the same time. Leave aux_action unswapped until the ABI
is represented in a byte-order-safe form.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Tighten bounds validation in __get_dwarf_regnum_for_perf_regnum_xxx()
helpers by changing perf_regnum > ARRAY_SIZE() to
perf_regnum >= ARRAY_SIZE().
This fixes an off-by-one condition where perf_regnum == ARRAY_SIZE()
could pass validation and cause out-of-bounds access for
dwarf_xxx_regnums[].
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Extend the mesh bandwidth saturation's list of events to include events
from clearwaterforest, emeraldrapids, grandridge, graniterapids,
sapphirerapids and sierraforest. This makes the lpm_mem_sat metric
available for those CPU models.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The %S conversion in fix_escape_fprintf() calls strlen(s) in the loop
condition while escaping each character. GCC 14.2.0 retains this call
inside the loop in a normal DEBUG=0 (-O3) perf build, repeatedly
scanning the whole string.
Test the current character for NUL instead. This processes the same
bytes without rescanning the string. Escaping and buffer growth are
unchanged.
Full-command wall-clock measurements on an Apple M5 Pro host running an
aarch64 Linux container with GCC 14.2.0 and glibc 2.41 gave these
medians:
perf list --json metrics Before (ms) After (ms)
Default catalog 0.5969 0.5855
PERF_CPUID=0x00000000410fd830 0.7818 0.7033
Each workload used 50 randomized before/after pairs. Each sample
averages the time per invocation across five fresh processes, with
stdout sent to /dev/null and no single-CPU pinning. PERF_CPUID selects
the shipped V3 catalog on the same host; these are not measurements on
V3 hardware. The measurements include process startup and do not
establish a gain on other machines or perf commands.
These observations come from one short run. Relinking also changes code
layout: .text grows from 2,013,172 to 2,017,236 bytes in this build. The
timings do not isolate scan removal from the changed layout.
The existing list shell test passes for both binaries. Source-extracted
functions linked to perf's strbuf implementation pass 906 equivalence
cases with ASan and UBSan. Full-command outputs are byte-identical.
Codex assisted with identifying the redundant scan, preparing the change,
and running the comparisons.
Assisted-by: LLM
Signed-off-by: Qerogram <qerogram@naver.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the
use of WARN macros to explicit tests and then using pr_warning from
debug.h.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
strim() may advance the pointer assigned to cache->size which causes
later frees to crash.
Fix by performing the strim and then memmove-ing the potentially shifted
string back over the original string.
The bug was introduced by the transition from rtrim() to strim(), as
rtrim() wouldn't move on the left.
Fixes: 13c230ab6e ("perf tools: Ditch rtrim(), use strim() from tools/lib")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Updates Tree type hints to correctly use TreeNode[TreeValue]
across all assignments preventing mypy strictness mismatches.
Address some other minor stylistic issues reported by mypy, pylint and
Sashiko.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Clang's uninitialized-const-pointer warning causes a feature test to
fail when building perf with clang. This disables support for 'perf
kvm stat live'. Add default initialization to new_value as a
workaround.
test-timerfd.c:15:30: error: variable 'new_value' is uninitialized when passed
as a const pointer argument here
[-Werror,-Wuninitialized-const-pointer]
15 | if (timerfd_settime(fd, 0, &new_value, NULL) != 0)
| ^~~~~~~~~
1 error generated.
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/r/20260910213907.3206529-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
__msan_unpoison may need the sanitizer header including for its
definition.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Implement a flamegraph widget that recursively walks down a tree
splitting line segments based on their value (summed up periods across
call chains). A visitor pattern is used so that the same logic can
both draw the line segments and locate which segment had a mouse
click.
Add a tab for the flame graph widget.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Co-developed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Alice Rogers <alice.mei.rogers@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
A textual app that displays the results of processing samples similar
to perf report. The app displays a tree of first processes and then
functions which drop down to show more detail on the functions they
call. The functions with the largest number of samples are sorted
first, after each function the percentage of time spent within it is
highlighted. If more than one event is recorded then each event
appears first, with the processes and functions sorted for that event
beneath it.
The app is written in python and requires the textual framework. Using
the textual framework means that in most modern terminals the mouse is
supported, the color scheme can be configured, and screenshots made.
With perf report:
```
$ perf record -e cycles:u -g perf test -w brstack
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.008 MB perf.data (57 samples) ]
$ perf report
...
Samples: 57 of event 'cycles:u', Event count (approx.): 15907831
Children Self Command Shared Object Symbol
- 88.86% 0.00% perf libc.so.6 [.] 0x000079b17df69ca8
0x79b17df69ca8
main
handle_internal_command
cmd_test
- brstack
- 84.27% brstack_bench
- 40.69% brstack_foo
brstack_bar
3.32% brstack_bar
3.31% brstack_bar
1.27% brstack_foo
+ 88.86% 0.00% perf perf [.] main
+ 88.86% 0.00% perf perf [.] handle_internal_command
+ 88.86% 0.00% perf perf [.] cmd_test
+ 88.86% 0.00% perf perf [.] brstack
+ 84.27% 40.26% perf perf [.] brstack_bench
+ 41.96% 30.71% perf perf [.] brstack_foo
+ 17.89% 17.89% perf perf [.] brstack_bar
```
With the treport script:
```
$ perf record -e cycles:u -g perf test -w brstack
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.008 MB perf.data (57 samples) ]
$ tools/perf/python/treport.py
O ReportApp
Report
╸━━━━━━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
▼ Profile
└── ▼ cycles:u 100%
└── ▼ perf (32963) 100%
├── ▼ /usr/lib/x86_64-linux-gnu/libc.so.6 0x79b17df6
│ └── ▼ main 56.1%
│ └── ▼ handle_internal_command 56.1%
│ └── ▼ cmd_test 56.1%
│ └── ▼ brstack 56.1% ▁▁
│ ├── ▼ brstack_bench 52.6%
│ │ ├── ▶ brstack_foo 24.6%
│ │ └── brstack_bar 1.75%
│ ├── brstack_foo 1.75%
│ └── brstack_bar 1.75%
├── ▶ /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
▌
^q Quit ▏^p palette
```
Committer testing:
One needs to install 'python-textual' to have this working.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Co-developed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Alice Rogers <alice.mei.rogers@gmail.com>
Link: https://lore.kernel.org/r/20260809051820.2436530-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Configure clang-format to ensure structs within arrays maintain left
alignment inside tools/perf/.clang-format. This prevents standard
formatting runs from arbitrarily squashing tabbed initialization pillars.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Replace hardcoded 'make' calls with '$(MAKE)' within tests/make
to ensure GNU Make jobserver file descriptors are properly inherited
by nested builds.
Additionally, remove the notorious 'unexport MAKEFLAGS' from
tools/perf/Makefile. This hack was originally added to prevent
the wrapper's internal '-j$(JOBS)' override from crashing when parent
jobserver tokens were present. Instead, use proper GNU Make conditionals
to check for '-j' or 'jobserver' strings within MAKEFLAGS. If a jobserver
is already orchestrating the build, gracefully back off and let GNU Make
manage parallelism natively.
Finally, optimize the 'out' target (which processes 'run_O' out-of-tree
builds) by stripping sequential bottlenecks like $(call clean) from
isolated tmp directories, and wrapping the target list in a parallel
sub-make call.
These combined changes enable 'build-test' out-of-tree targets to
build completely concurrently without severing jobserver tokens.
Unscientifically measured the change lowered the build-test from
around 15 minutes to 10 minutes on a 28 threaded Alderlake CPU. Fixing
the jobserver issues meant the machine remained somewhat usable while
running the test.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf_gtk__show_hierarchy() builds a merged column header for the
hierarchy view with unbounded strcat() calls into a 512-byte stack
buffer. The pieces being appended come from tracepoint field names and
sort-key headers in perf.data, so a file with enough dynamic sort keys
or long enough field names overflows the buffer.
perf_gtk__add_hierarchy_entries() has a related bug in the loop that
formats each entry's value columns. fmt->entry()/fmt->color() return
via scnprintf(), so ret is clamped to at most hpp->size - 1, but
advance_hpp(hpp, ret + 2) doesn't clamp: when ret hits that maximum,
ret + 2 exceeds hpp->size by one, and hpp->size (size_t) underflows to
roughly SIZE_MAX. The next iteration's fmt->entry() then writes into
the caller's stack buffer using that bogus size, a second overflow.
That same loop also saves bf/size at the top of each iteration but
only restored hpp->buf/hpp->size to them before recursing into
non-leaf children. Leaf entries left the buffer state advanced from
the format loop, so the next sibling in the traversal inherited a
shrunk hpp->size and an already-advanced hpp->buf, eventually running
hpp->size down to 0 and pointing bf past the end of the stack buffer
for the strim(bf) call.
Fix the header builder by tracking the write offset and using
scnprintf() for each append, same pattern already used elsewhere in
this file. Fix the entry loop by clamping the amount passed to
advance_hpp() to what's actually left in the buffer, and by restoring
hpp->buf/hpp->size unconditionally after formatting each entry instead
of only before recursing.
Both bugs predate the perf GTK UI's move to GTK 4; neither function is
touched by that port.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf report --gtk dlopen()s libperf-gtk.so, which expects to resolve
symbols back against the running perf binary (callchain_param,
symbol_conf, evsel__name, and friends live in perf, not the plugin).
Two things broke that after the GTK 4 port:
perf never passed -rdynamic, so none of its symbols were in its
dynamic symbol table for a dlopen()ed plugin to find. Add -rdynamic to
LDFLAGS when GTK4 support is enabled.
annotated_source__hist_entry() was a static inline in annotate.h, so
ui/gtk/annotate.c calling it pulled hashmap__find()'s expansion,
hashmap_find(), into libperf-gtk.so as an undefined symbol. The only
hashmap_find perf links against normally is libbpf's internal one
(tools/lib/bpf/hashmap.c), built with -fvisibility=hidden, so it can
never be exported to a dlopen()ed plugin regardless of LDFLAGS. Move
annotated_source__hist_entry() into annotate.c as an ordinary exported
function, so the plugin depends on it the same way it already depends
on evsel__group_desc() and friends.
With both fixes, a default 'make GTK4=1' build (libbpf statically
linked) can dlopen() libperf-gtk.so and open the report browser without
NO_LIBBPF=1 or manual LDFLAGS. Verified with perf report --gtk against
real perf.data on a GTK4 desktop.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Port straight to GTK 4 rather than GTK 3, since GTK 4 is where new
development happens and GTK 3 is old itself now.
GTK 4 drops GtkContainer, GdkScreen, and the gtk_main()/
gtk_dialog_run() family perf's GTK UI relied on. Containers get
per-widget setters (gtk_box_append() and friends), monitor geometry
comes from GdkMonitor instead of GdkScreen, and the main and
error-dialog loops become explicit GMainLoops quit from the
"close-request" and "response" signals. Widgets are visible by default
now, so gtk_widget_show_all()/set_no_show_all() go away, and the
remaining gtk_widget_show()/gtk_widget_hide() calls become
gtk_widget_set_visible() (with a small wrapper where "response" needs
to pass gtk_widget_hide() as a callback, since it no longer exists as
a plain function).
gtk_ui_progress__finish() skips destroying a progress dialog that was
never created, since gtk_window_destroy() asserts on NULL where the old
widget destroy tolerated it. Two spots the GTK 2 to GTK 3 port had
missed (builtin-annotate.c, ui/gtk/setup.c still using
HAVE_GTK2_SUPPORT and gtk_main_quit()) are fixed to match.
Runtime fallout from the new signal-driven loops: the error dialog's
nested loop hung if the parent window closed
(GTK_DIALOG_DESTROY_WITH_PARENT destroys without emitting "response");
gtk_info_bar_get_content_area() is gone, breaking GTK_INFO_BAR_SUPPORT;
the progress dialog's static widget pointers dangled after a manual
close; perf_gtk__error() and the warning functions reused an exhausted
va_list when vasprintf() failed.
The error loop is tracked in a list instead of a single pointer, since
perf_gtk__error() can be called re-entrantly (the dialog isn't modal)
and a lone global leaked the outer loop when that happened. The list
is only ever touched from the main thread: perf_gtk__error() updates
it while handling a dialog, and SIGINT/SIGQUIT/SIGTERM are deferred to
a GLib source via g_unix_signal_add() rather than calling
perf_gtk__exit() straight out of a real signal handler, so quitting on
those signals is serialized with the list update instead of racing it
from signal-handler context. SIGSEGV/SIGFPE keep a real handler, since
they're synchronous faults with no "later" to defer to, but it's pared
down to reporting and reraising the default disposition
(perf_gtk__fatal_signal()): there's no safe way to run GTK/GLib code
from the faulting context. stdarg.h, stdio.h, and string.h are now
included explicitly where used (util.c, hists.c, annotate.c) rather
than relying on transitive includes, which musl doesn't guarantee.
The gtk4-infobar feature check is dropped: GtkInfoBar has existed
unconditionally since GTK 3.10, so the check can only ever pass, and it
was failing outright here anyway since gtk_info_bar_new() is deprecated
and the check treats deprecation warnings as errors.
HAVE_GTK_INFO_BAR_SUPPORT and its statusbar-only fallback go away; the
info bar is now built unconditionally.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Link: https://lore.kernel.org/r/20260908-perf-gtk2-v8-1-e90d5d155f0d@gmail.com
[ Fixed up some patch fuzz ]
[ Removed gtk2 from FEATURES_DISPLAY, it is opt-in use 'make VF=1' to see if it was detected ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
If has_supported_counters fails then msg was passed to ui__error
regardless of whether an error was written into msg leading to reading
uninitialized memory. Avoid this by always terminating msg at
initialization.
Opportunistically reduce the scope of msg to make its use clearer.
Fixes: c9a8c343ef ("perf stat: When no events, don't report an error if there is none")
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/r/20260908220720.564614-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Check the return value of zalloc() before dereferencing the allocated
dwfl_ui_ti structure.
Return -ENOMEM when the allocation fails to avoid a NULL pointer
dereference.
Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When pretty-printing augmented struct payloads using BTF via
btf_struct_scnprintf(), augmented_arg->size is currently only validated
against values <= 0.
However, several edge cases can result in size mismatches or buffer
over-reads:
1. If arg->augmented.size is smaller than sizeof(*augmented_arg),
dereferencing augmented_arg->size reads past the available
buffer.
2. If augmented_arg->size exceeds arg->augmented.size -
sizeof(*augmented_arg), calculating consumed =
sizeof(*augmented_arg) + augmented_arg->size can overflow signed
integer limits (e.g., with crafted INT_MAX values in an
untrusted perf.data file) or cause arg->augmented.size to
underflow. This advances arg->augmented.args out of bounds,
corrupting the parsing state for subsequent arguments in
multi-argument syscalls.
3. If the captured payload is truncated (e.g., short reads in BPF,
or during cross-architecture analysis such as replaying a 32-bit
perf.data on a 64-bit host where host BTF type->size exceeds the
32-bit target payload), passing type->size to
btf_dump__dump_type_data() causes libbpf to read past the end of
the payload buffer.
Enforce an upper bound on augmented_arg->size against the remaining
buffer (arg->augmented.size - sizeof(*augmented_arg)) and verify that the
captured payload contains at least type->size bytes before passing it to
btf_dump__dump_type_data().
Fixes: cb32035214 ("perf trace: Pretty print struct data")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Cc: Howard Chu <howardchu95@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cleanup function was removed by writing to /dev/null rather than
temporary files. The exit path still had a call.
Fixes: 44f6b44027 ("perf test: Fix hybrid testing of event fallback test")
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Teach perf annotate about the Alpha control-transfer instructions, so that
an Alpha perf.data gets call and jump arrows and resolved call targets,
whether it is read on Alpha or on another host.
Add tools/perf/util/annotate-arch/annotate-alpha.c with arch__new_alpha()
and an associate_instruction_ops() that classifies:
call: bsr, plus jsr and jcr as indirect calls
ret: ret
jump: br, the conditional branches beq/bne/blt/ble/bgt/bge/blbc/blbs
and fbeq/fbne/fblt/fble/fbgt/fbge, plus jmp as an indirect jump
mov: mov, fmov (objdump pseudos)
That is every mnemonic binutils can print for the branch and JSR formats.
jcr rather than jsr_coroutine, because both name the same MBR(0x1a,3)
encoding and print_insn_alpha() takes the first match in the table, where
the jcr alias has come first since the sources were imported in 1999.
bsr needs an Alpha-specific parse routine. The generic call__parse()
expects the operand string to begin with the target address, but a bsr
prints its return-address register first:
bsr t0,fffffc0001031dc0 <cserve_ena>
strtoull() then stops on the leading register name, leaving the target
address as 0, which makes call__scnprintf() fall back to printing the raw
operands and leaves target.sym unresolved so the browser cannot follow the
call. alpha_call__parse() takes the address from after the comma instead,
as s390_call__parse() does for the same reason. The PC-relative branches
need no such handling, as jump__parse() already skips up to two operands.
jsr and jmp get ins_ops that resolve no target at all. They transfer
control to a register, and their trailing operand is only a branch
prediction hint:
jsr ra,(t12),fffffc0001014ee8 <_printk>
binutils extracts that hint as a 14-bit signed field scaled by four and
prints it relative to the next instruction (extract_jhint() in alpha-opc.c,
print_insn_alpha() in alpha-dis.c), so it can name the callee only when the
callee lies within the resulting +-32KB. It also defaults to zero, which
prints as the next instruction. Of the 213750 jsr in a vmlinux built from
this tree, only 23093 hints land on a symbol; 157204 point into the middle
of an unrelated function and 33453 are that default. Parsing the hint
would therefore invent a call target for the majority of calls, so these
keep their operands, as an indirect call does elsewhere.
EM_ALPHA is 0x9026, far too large to index the e_machine-keyed
arch_new_fn[] table in arch__find(), so select arch__new_alpha explicitly
before the table lookup. Declare it in disasm.h and add the object to the
annotate-arch Build.
Disassembly itself comes from objdump/binutils, which already supports
Alpha; this provides perf's instruction-class metadata for annotation.
Tested on an EV7 Marvel, both natively and by annotating its perf.data on
an x86_64 host, over bsr to a local function, jsr through the PLT and
kernel-mode jsr; the two hosts produce identical output.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When the per-thread e_machine cannot be determined from the DSOs in the
thread's maps, thread__e_machine_endian() decides between reading
/proc/<pid>/exe and falling back to the recorded session environment:
bool is_live = machine->machines == NULL;
if (!is_live) {
/* Check if the session has a data file. */
struct perf_session *session = container_of(...);
is_live = !!session->data;
}
Neither half of that works.
The back pointer added by commit a088031c49 ("perf tools: Add machine to
machines back pointer") is set by machines__add(), which only ever adds
guests; the host machine never gets one. Host-machine threads, which is to
say almost all of them, therefore see machine->machines == NULL and are
declared live before the session is consulted at all.
The session test is also inverted. A session with a perf_data attached is
one being read from a perf.data file, i.e. exactly the case that is not
live, while a live session such as 'perf top' passes data=NULL to
__perf_session__new().
So a file-based session takes the live path and reads /proc/<pid>/exe on
the analysing host, which at best describes an unrelated process that has
since been given the recorded pid, and normally just fails, leaving
e_machine as EM_NONE. The perf_env fallback that would have supplied the
recorded architecture is never reached, and thread__e_machine() returns
EM_HOST.
For a same-architecture recording this is invisible, since EM_HOST is the
right answer anyway. Cross-architecture it is not: annotating an Alpha
perf.data on an x86_64 host selects the x86 struct arch, so the Alpha
disassembly is matched against the x86 instruction table. Alpha's 'ret'
collides with x86's and gets ret_ops, while its calls and branches match
nothing and are left unparsed, so no call target is resolved and no jump
arrows are drawn.
Set the back pointer for the host machine and correct the session test.
The new back pointer does not disturb the other reader of the field,
machine__findnew_guest_code(), which machine__resolve() only calls when
!machine__is_host(machine).
Fixes: 70351029b5 ("perf thread: Add support for reading the e_machine type for a thread")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The waiting helpers implement timeouts using:
date +%s%1N
This relies on GNU coreutils date truncating %N to the specified width,
so %1N yields tenths of a second.
Rust coreutils (uutils) interprets the width differently and does not
truncate the nanoseconds field. Consequently "date +%1N" returns all
nine nanosecond digits, causing the elapsed-time calculation to be done
in nanoseconds while timeout values remain in tenths of a second.
As a result, timeout comparisons succeed immediately and the waiting
helpers time out on their first iteration. This causes
test_intel_pt.sh to fail on systems using uutils "date".
Avoid implementation-specific date formatting entirely. Instead, wait
for 100 ms on each iteration and count the timeout down. Besides fixing
the portability issue, this removes the busy-waiting behaviour in
wait_for_perf_to_start(), which could otherwise consume CPU while
waiting for perf record to start.
Since the timeout is now based on repeated sleeps, it is only
approximate. Update the comments accordingly. Also make is_running()
wait for exactly the documented number of tenths by changing its timeout
test from -gt to the new logic, and quote tm_out in the modified code.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
I've realized that it didn't set up the tracing files when BPF is used
so poll() just returns immediately. It ends up with calling poll()
unnecessarily in a loop.
BPF still needs the loop to wait for the target process exiting or a
signal from users. Let's use a semaphore instead.
Suggested-by: Ian Rogers <irogers@google.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
In get_argument_count(), the variable code_obj is assigned to itself
before being assigned the result of PyObject_GetAttrString(). This is
a redundant self-assignment that appears to be a typo.
Fix it by removing the redundant self-assignment.
Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The test case 'perf stat tests' fails on s390 z/VM machines. The
root cause is the unsupported CPU measurement facility on z/VM.
Therefore the events cycles and instructions do not exist and
are unsupported. This cause the subtest
Hide zero events stat test
to fail.
Output before:
# perf test 116
116: perf stat tests : FAILED!
=== Test Summary ===
Passed main tests : 0
Passed subtests : 0
Skipped tests : 0
Failed tests : 1
List of failed tests:
116: perf stat tests
#
Output after:
# ./perf test 116
116: perf stat tests : Ok
=== Test Summary ===
Passed main tests : 1
Passed subtests : 0
Skipped tests : 0
Failed tests : 0
#
Fixes: 64724095a3 ("perf stat: Add --hide-zero-events option to suppress zero-count events")
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Cc: Aaron Tomlin <atomlin@atomlin.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The kernel does not provide sys_futex() on 32-bit architectures that lack
a 32-bit time representation, such as riscv32. Consequently glibc does not
define SYS_futex there, only SYS_futex_time64, and perf bench's futex
benchmarks fail to build:
bench/futex.h: In function 'futex_syscall':
bench/futex.h:77:18: error: 'SYS_futex' undeclared (first use in this function)
Define SYS_futex as SYS_futex_time64 when only the latter is available.
The guard and its comment are taken verbatim from
tools/testing/selftests/futex/include/futextest.h, where they were added by
commit 04850819c6 ("selftests/futex: Define SYS_futex on 32-bit
architectures with 64-bit time_t"), keeping the two futex userspace headers
in sync.
No timespec conversion helper is needed on top of this. glibc lays out
struct timespec on 32-bit architectures with 64-bit time_t as
{ int64 tv_sec; int32 tv_nsec; 32-bit pad }, which is compatible with
struct __kernel_timespec, and every futex_wait()/futex_lock_pi()/
futex_wait_requeue_pi() call site in perf bench passes a NULL timeout
anyway, so no timespec ever crosses the syscall boundary here.
Note that an earlier and more ambitious attempt at this was
commit c1ff12dac4 ("perf bench futex: Add support for 32-bit systems
with 64-bit time_t"), reverted by
commit ba4026b09d ("Revert "perf bench futex: Add support for 32-bit
systems with 64-bit time_t"") because it included linux/time_types.h,
which is unavailable on older distributions. This change deliberately
avoids that dependency and adds only the one guard needed to fix
compilation.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Nylon Chen <nylon.chen@sifive.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements. POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself. A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.
This is the same off-by-one fixed for Intel PT by commit c4362d5e1a
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb822595 ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").
Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.
Fixes: c4bbd4ec2e ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
hist.h isn't related to UI and so remove the UI inclusion. Fix the
transitive dependency issues this exposes.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Declare stubs directly inside perf.c for commands that have library
dependencies sometimes omitted at build time, such as libtraceevent
(timechart, sched, kmem, lock, trace, kwork) and libelf (probe).
By unconditionally including these commands in the commands[] array,
users will receive a clear, unified warning indicating the missing
dependency instead of the command silently being absent.
Running `perf trace` with libtraceevent missing. Before:
```
perf: 'trace' is not a perf-command. See 'perf --help'.
Did you mean this?
ftrace
```
After:
```
'trace' command not available: missing libtraceevent devel package at build time.
```
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The code is mostly used by perf.c with additional unused functionality
such as function pointers derived from early git code. Moving it into
perf.c directly reduces the code footprint, drops the util/util.h
dependence from perf.c, and allows us to remove util/usage.c entirely.
The string constants are exposed in builtin.h, as they are used
in builtin-help.c.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Remove perf-sys.h, internal/lib.h (page_size), signal.h, and perf.h
since their exports are not used directly in perf.c.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Use git clang-format to sort header files. Review header file includes
removing those that were unnecessary or adding explicit includes in
cases where transitive dependencies were be using.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Move definitions to places they are used, or path.h in the case of
path.c's mkpath function. Remove unused definitions. Fix transitive
include dependencies.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
