Sync the UAPI header changes of supporting SIMD/eGPRs/SSP sampling into
corresponding tools UAPI headers.
Additionally, support the new introduced perf_event_attr fields in the
perf_event_attr__fprintf and perf_event__attr_swap() helpers, and add
sanity check for the new introduced __reserved_4 field in
perf_attr_check().
Co-developed-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Some new introduced perf_event_attr fields, like config3 and config4,
are forgotten to add into perf_event_attr__fprintf() and
perf_event__attr_swap() helpers. Add these missed fields into these 2
helpers.
The aux_action is an exception. aux_action aliases bitfields
(e.g. aux_start_paused) in a union. Bitfields and plain u32 fields
follow different endian rules, so both views cannot be swapped
correctly at the same time. Leave aux_action unswapped until the ABI
is represented in a byte-order-safe form.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Tighten bounds validation in __get_dwarf_regnum_for_perf_regnum_xxx()
helpers by changing perf_regnum > ARRAY_SIZE() to
perf_regnum >= ARRAY_SIZE().
This fixes an off-by-one condition where perf_regnum == ARRAY_SIZE()
could pass validation and cause out-of-bounds access for
dwarf_xxx_regnums[].
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Extend the mesh bandwidth saturation's list of events to include events
from clearwaterforest, emeraldrapids, grandridge, graniterapids,
sapphirerapids and sierraforest. This makes the lpm_mem_sat metric
available for those CPU models.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The %S conversion in fix_escape_fprintf() calls strlen(s) in the loop
condition while escaping each character. GCC 14.2.0 retains this call
inside the loop in a normal DEBUG=0 (-O3) perf build, repeatedly
scanning the whole string.
Test the current character for NUL instead. This processes the same
bytes without rescanning the string. Escaping and buffer growth are
unchanged.
Full-command wall-clock measurements on an Apple M5 Pro host running an
aarch64 Linux container with GCC 14.2.0 and glibc 2.41 gave these
medians:
perf list --json metrics Before (ms) After (ms)
Default catalog 0.5969 0.5855
PERF_CPUID=0x00000000410fd830 0.7818 0.7033
Each workload used 50 randomized before/after pairs. Each sample
averages the time per invocation across five fresh processes, with
stdout sent to /dev/null and no single-CPU pinning. PERF_CPUID selects
the shipped V3 catalog on the same host; these are not measurements on
V3 hardware. The measurements include process startup and do not
establish a gain on other machines or perf commands.
These observations come from one short run. Relinking also changes code
layout: .text grows from 2,013,172 to 2,017,236 bytes in this build. The
timings do not isolate scan removal from the changed layout.
The existing list shell test passes for both binaries. Source-extracted
functions linked to perf's strbuf implementation pass 906 equivalence
cases with ASan and UBSan. Full-command outputs are byte-identical.
Codex assisted with identifying the redundant scan, preparing the change,
and running the comparisons.
Assisted-by: LLM
Signed-off-by: Qerogram <qerogram@naver.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the
use of WARN macros to explicit tests and then using pr_warning from
debug.h.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
strim() may advance the pointer assigned to cache->size which causes
later frees to crash.
Fix by performing the strim and then memmove-ing the potentially shifted
string back over the original string.
The bug was introduced by the transition from rtrim() to strim(), as
rtrim() wouldn't move on the left.
Fixes: 13c230ab6e ("perf tools: Ditch rtrim(), use strim() from tools/lib")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Updates Tree type hints to correctly use TreeNode[TreeValue]
across all assignments preventing mypy strictness mismatches.
Address some other minor stylistic issues reported by mypy, pylint and
Sashiko.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Clang's uninitialized-const-pointer warning causes a feature test to
fail when building perf with clang. This disables support for 'perf
kvm stat live'. Add default initialization to new_value as a
workaround.
test-timerfd.c:15:30: error: variable 'new_value' is uninitialized when passed
as a const pointer argument here
[-Werror,-Wuninitialized-const-pointer]
15 | if (timerfd_settime(fd, 0, &new_value, NULL) != 0)
| ^~~~~~~~~
1 error generated.
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/r/20260910213907.3206529-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
__msan_unpoison may need the sanitizer header including for its
definition.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Implement a flamegraph widget that recursively walks down a tree
splitting line segments based on their value (summed up periods across
call chains). A visitor pattern is used so that the same logic can
both draw the line segments and locate which segment had a mouse
click.
Add a tab for the flame graph widget.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Co-developed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Alice Rogers <alice.mei.rogers@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
A textual app that displays the results of processing samples similar
to perf report. The app displays a tree of first processes and then
functions which drop down to show more detail on the functions they
call. The functions with the largest number of samples are sorted
first, after each function the percentage of time spent within it is
highlighted. If more than one event is recorded then each event
appears first, with the processes and functions sorted for that event
beneath it.
The app is written in python and requires the textual framework. Using
the textual framework means that in most modern terminals the mouse is
supported, the color scheme can be configured, and screenshots made.
With perf report:
```
$ perf record -e cycles:u -g perf test -w brstack
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.008 MB perf.data (57 samples) ]
$ perf report
...
Samples: 57 of event 'cycles:u', Event count (approx.): 15907831
Children Self Command Shared Object Symbol
- 88.86% 0.00% perf libc.so.6 [.] 0x000079b17df69ca8
0x79b17df69ca8
main
handle_internal_command
cmd_test
- brstack
- 84.27% brstack_bench
- 40.69% brstack_foo
brstack_bar
3.32% brstack_bar
3.31% brstack_bar
1.27% brstack_foo
+ 88.86% 0.00% perf perf [.] main
+ 88.86% 0.00% perf perf [.] handle_internal_command
+ 88.86% 0.00% perf perf [.] cmd_test
+ 88.86% 0.00% perf perf [.] brstack
+ 84.27% 40.26% perf perf [.] brstack_bench
+ 41.96% 30.71% perf perf [.] brstack_foo
+ 17.89% 17.89% perf perf [.] brstack_bar
```
With the treport script:
```
$ perf record -e cycles:u -g perf test -w brstack
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.008 MB perf.data (57 samples) ]
$ tools/perf/python/treport.py
O ReportApp
Report
╸━━━━━━╺━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
▼ Profile
└── ▼ cycles:u 100%
└── ▼ perf (32963) 100%
├── ▼ /usr/lib/x86_64-linux-gnu/libc.so.6 0x79b17df6
│ └── ▼ main 56.1%
│ └── ▼ handle_internal_command 56.1%
│ └── ▼ cmd_test 56.1%
│ └── ▼ brstack 56.1% ▁▁
│ ├── ▼ brstack_bench 52.6%
│ │ ├── ▶ brstack_foo 24.6%
│ │ └── brstack_bar 1.75%
│ ├── brstack_foo 1.75%
│ └── brstack_bar 1.75%
├── ▶ /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
▌
^q Quit ▏^p palette
```
Committer testing:
One needs to install 'python-textual' to have this working.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Co-developed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Alice Rogers <alice.mei.rogers@gmail.com>
Link: https://lore.kernel.org/r/20260809051820.2436530-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Configure clang-format to ensure structs within arrays maintain left
alignment inside tools/perf/.clang-format. This prevents standard
formatting runs from arbitrarily squashing tabbed initialization pillars.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Replace hardcoded 'make' calls with '$(MAKE)' within tests/make
to ensure GNU Make jobserver file descriptors are properly inherited
by nested builds.
Additionally, remove the notorious 'unexport MAKEFLAGS' from
tools/perf/Makefile. This hack was originally added to prevent
the wrapper's internal '-j$(JOBS)' override from crashing when parent
jobserver tokens were present. Instead, use proper GNU Make conditionals
to check for '-j' or 'jobserver' strings within MAKEFLAGS. If a jobserver
is already orchestrating the build, gracefully back off and let GNU Make
manage parallelism natively.
Finally, optimize the 'out' target (which processes 'run_O' out-of-tree
builds) by stripping sequential bottlenecks like $(call clean) from
isolated tmp directories, and wrapping the target list in a parallel
sub-make call.
These combined changes enable 'build-test' out-of-tree targets to
build completely concurrently without severing jobserver tokens.
Unscientifically measured the change lowered the build-test from
around 15 minutes to 10 minutes on a 28 threaded Alderlake CPU. Fixing
the jobserver issues meant the machine remained somewhat usable while
running the test.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf_gtk__show_hierarchy() builds a merged column header for the
hierarchy view with unbounded strcat() calls into a 512-byte stack
buffer. The pieces being appended come from tracepoint field names and
sort-key headers in perf.data, so a file with enough dynamic sort keys
or long enough field names overflows the buffer.
perf_gtk__add_hierarchy_entries() has a related bug in the loop that
formats each entry's value columns. fmt->entry()/fmt->color() return
via scnprintf(), so ret is clamped to at most hpp->size - 1, but
advance_hpp(hpp, ret + 2) doesn't clamp: when ret hits that maximum,
ret + 2 exceeds hpp->size by one, and hpp->size (size_t) underflows to
roughly SIZE_MAX. The next iteration's fmt->entry() then writes into
the caller's stack buffer using that bogus size, a second overflow.
That same loop also saves bf/size at the top of each iteration but
only restored hpp->buf/hpp->size to them before recursing into
non-leaf children. Leaf entries left the buffer state advanced from
the format loop, so the next sibling in the traversal inherited a
shrunk hpp->size and an already-advanced hpp->buf, eventually running
hpp->size down to 0 and pointing bf past the end of the stack buffer
for the strim(bf) call.
Fix the header builder by tracking the write offset and using
scnprintf() for each append, same pattern already used elsewhere in
this file. Fix the entry loop by clamping the amount passed to
advance_hpp() to what's actually left in the buffer, and by restoring
hpp->buf/hpp->size unconditionally after formatting each entry instead
of only before recursing.
Both bugs predate the perf GTK UI's move to GTK 4; neither function is
touched by that port.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf report --gtk dlopen()s libperf-gtk.so, which expects to resolve
symbols back against the running perf binary (callchain_param,
symbol_conf, evsel__name, and friends live in perf, not the plugin).
Two things broke that after the GTK 4 port:
perf never passed -rdynamic, so none of its symbols were in its
dynamic symbol table for a dlopen()ed plugin to find. Add -rdynamic to
LDFLAGS when GTK4 support is enabled.
annotated_source__hist_entry() was a static inline in annotate.h, so
ui/gtk/annotate.c calling it pulled hashmap__find()'s expansion,
hashmap_find(), into libperf-gtk.so as an undefined symbol. The only
hashmap_find perf links against normally is libbpf's internal one
(tools/lib/bpf/hashmap.c), built with -fvisibility=hidden, so it can
never be exported to a dlopen()ed plugin regardless of LDFLAGS. Move
annotated_source__hist_entry() into annotate.c as an ordinary exported
function, so the plugin depends on it the same way it already depends
on evsel__group_desc() and friends.
With both fixes, a default 'make GTK4=1' build (libbpf statically
linked) can dlopen() libperf-gtk.so and open the report browser without
NO_LIBBPF=1 or manual LDFLAGS. Verified with perf report --gtk against
real perf.data on a GTK4 desktop.
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Port straight to GTK 4 rather than GTK 3, since GTK 4 is where new
development happens and GTK 3 is old itself now.
GTK 4 drops GtkContainer, GdkScreen, and the gtk_main()/
gtk_dialog_run() family perf's GTK UI relied on. Containers get
per-widget setters (gtk_box_append() and friends), monitor geometry
comes from GdkMonitor instead of GdkScreen, and the main and
error-dialog loops become explicit GMainLoops quit from the
"close-request" and "response" signals. Widgets are visible by default
now, so gtk_widget_show_all()/set_no_show_all() go away, and the
remaining gtk_widget_show()/gtk_widget_hide() calls become
gtk_widget_set_visible() (with a small wrapper where "response" needs
to pass gtk_widget_hide() as a callback, since it no longer exists as
a plain function).
gtk_ui_progress__finish() skips destroying a progress dialog that was
never created, since gtk_window_destroy() asserts on NULL where the old
widget destroy tolerated it. Two spots the GTK 2 to GTK 3 port had
missed (builtin-annotate.c, ui/gtk/setup.c still using
HAVE_GTK2_SUPPORT and gtk_main_quit()) are fixed to match.
Runtime fallout from the new signal-driven loops: the error dialog's
nested loop hung if the parent window closed
(GTK_DIALOG_DESTROY_WITH_PARENT destroys without emitting "response");
gtk_info_bar_get_content_area() is gone, breaking GTK_INFO_BAR_SUPPORT;
the progress dialog's static widget pointers dangled after a manual
close; perf_gtk__error() and the warning functions reused an exhausted
va_list when vasprintf() failed.
The error loop is tracked in a list instead of a single pointer, since
perf_gtk__error() can be called re-entrantly (the dialog isn't modal)
and a lone global leaked the outer loop when that happened. The list
is only ever touched from the main thread: perf_gtk__error() updates
it while handling a dialog, and SIGINT/SIGQUIT/SIGTERM are deferred to
a GLib source via g_unix_signal_add() rather than calling
perf_gtk__exit() straight out of a real signal handler, so quitting on
those signals is serialized with the list update instead of racing it
from signal-handler context. SIGSEGV/SIGFPE keep a real handler, since
they're synchronous faults with no "later" to defer to, but it's pared
down to reporting and reraising the default disposition
(perf_gtk__fatal_signal()): there's no safe way to run GTK/GLib code
from the faulting context. stdarg.h, stdio.h, and string.h are now
included explicitly where used (util.c, hists.c, annotate.c) rather
than relying on transitive includes, which musl doesn't guarantee.
The gtk4-infobar feature check is dropped: GtkInfoBar has existed
unconditionally since GTK 3.10, so the check can only ever pass, and it
was failing outright here anyway since gtk_info_bar_new() is deprecated
and the check treats deprecation warnings as errors.
HAVE_GTK_INFO_BAR_SUPPORT and its statusbar-only fallback go away; the
info bar is now built unconditionally.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Link: https://lore.kernel.org/r/20260908-perf-gtk2-v8-1-e90d5d155f0d@gmail.com
[ Fixed up some patch fuzz ]
[ Removed gtk2 from FEATURES_DISPLAY, it is opt-in use 'make VF=1' to see if it was detected ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
If has_supported_counters fails then msg was passed to ui__error
regardless of whether an error was written into msg leading to reading
uninitialized memory. Avoid this by always terminating msg at
initialization.
Opportunistically reduce the scope of msg to make its use clearer.
Fixes: c9a8c343ef ("perf stat: When no events, don't report an error if there is none")
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/r/20260908220720.564614-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Check the return value of zalloc() before dereferencing the allocated
dwfl_ui_ti structure.
Return -ENOMEM when the allocation fails to avoid a NULL pointer
dereference.
Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When pretty-printing augmented struct payloads using BTF via
btf_struct_scnprintf(), augmented_arg->size is currently only validated
against values <= 0.
However, several edge cases can result in size mismatches or buffer
over-reads:
1. If arg->augmented.size is smaller than sizeof(*augmented_arg),
dereferencing augmented_arg->size reads past the available
buffer.
2. If augmented_arg->size exceeds arg->augmented.size -
sizeof(*augmented_arg), calculating consumed =
sizeof(*augmented_arg) + augmented_arg->size can overflow signed
integer limits (e.g., with crafted INT_MAX values in an
untrusted perf.data file) or cause arg->augmented.size to
underflow. This advances arg->augmented.args out of bounds,
corrupting the parsing state for subsequent arguments in
multi-argument syscalls.
3. If the captured payload is truncated (e.g., short reads in BPF,
or during cross-architecture analysis such as replaying a 32-bit
perf.data on a 64-bit host where host BTF type->size exceeds the
32-bit target payload), passing type->size to
btf_dump__dump_type_data() causes libbpf to read past the end of
the payload buffer.
Enforce an upper bound on augmented_arg->size against the remaining
buffer (arg->augmented.size - sizeof(*augmented_arg)) and verify that the
captured payload contains at least type->size bytes before passing it to
btf_dump__dump_type_data().
Fixes: cb32035214 ("perf trace: Pretty print struct data")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Cc: Howard Chu <howardchu95@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cleanup function was removed by writing to /dev/null rather than
temporary files. The exit path still had a call.
Fixes: 44f6b44027 ("perf test: Fix hybrid testing of event fallback test")
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Teach perf annotate about the Alpha control-transfer instructions, so that
an Alpha perf.data gets call and jump arrows and resolved call targets,
whether it is read on Alpha or on another host.
Add tools/perf/util/annotate-arch/annotate-alpha.c with arch__new_alpha()
and an associate_instruction_ops() that classifies:
call: bsr, plus jsr and jcr as indirect calls
ret: ret
jump: br, the conditional branches beq/bne/blt/ble/bgt/bge/blbc/blbs
and fbeq/fbne/fblt/fble/fbgt/fbge, plus jmp as an indirect jump
mov: mov, fmov (objdump pseudos)
That is every mnemonic binutils can print for the branch and JSR formats.
jcr rather than jsr_coroutine, because both name the same MBR(0x1a,3)
encoding and print_insn_alpha() takes the first match in the table, where
the jcr alias has come first since the sources were imported in 1999.
bsr needs an Alpha-specific parse routine. The generic call__parse()
expects the operand string to begin with the target address, but a bsr
prints its return-address register first:
bsr t0,fffffc0001031dc0 <cserve_ena>
strtoull() then stops on the leading register name, leaving the target
address as 0, which makes call__scnprintf() fall back to printing the raw
operands and leaves target.sym unresolved so the browser cannot follow the
call. alpha_call__parse() takes the address from after the comma instead,
as s390_call__parse() does for the same reason. The PC-relative branches
need no such handling, as jump__parse() already skips up to two operands.
jsr and jmp get ins_ops that resolve no target at all. They transfer
control to a register, and their trailing operand is only a branch
prediction hint:
jsr ra,(t12),fffffc0001014ee8 <_printk>
binutils extracts that hint as a 14-bit signed field scaled by four and
prints it relative to the next instruction (extract_jhint() in alpha-opc.c,
print_insn_alpha() in alpha-dis.c), so it can name the callee only when the
callee lies within the resulting +-32KB. It also defaults to zero, which
prints as the next instruction. Of the 213750 jsr in a vmlinux built from
this tree, only 23093 hints land on a symbol; 157204 point into the middle
of an unrelated function and 33453 are that default. Parsing the hint
would therefore invent a call target for the majority of calls, so these
keep their operands, as an indirect call does elsewhere.
EM_ALPHA is 0x9026, far too large to index the e_machine-keyed
arch_new_fn[] table in arch__find(), so select arch__new_alpha explicitly
before the table lookup. Declare it in disasm.h and add the object to the
annotate-arch Build.
Disassembly itself comes from objdump/binutils, which already supports
Alpha; this provides perf's instruction-class metadata for annotation.
Tested on an EV7 Marvel, both natively and by annotating its perf.data on
an x86_64 host, over bsr to a local function, jsr through the PLT and
kernel-mode jsr; the two hosts produce identical output.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When the per-thread e_machine cannot be determined from the DSOs in the
thread's maps, thread__e_machine_endian() decides between reading
/proc/<pid>/exe and falling back to the recorded session environment:
bool is_live = machine->machines == NULL;
if (!is_live) {
/* Check if the session has a data file. */
struct perf_session *session = container_of(...);
is_live = !!session->data;
}
Neither half of that works.
The back pointer added by commit a088031c49 ("perf tools: Add machine to
machines back pointer") is set by machines__add(), which only ever adds
guests; the host machine never gets one. Host-machine threads, which is to
say almost all of them, therefore see machine->machines == NULL and are
declared live before the session is consulted at all.
The session test is also inverted. A session with a perf_data attached is
one being read from a perf.data file, i.e. exactly the case that is not
live, while a live session such as 'perf top' passes data=NULL to
__perf_session__new().
So a file-based session takes the live path and reads /proc/<pid>/exe on
the analysing host, which at best describes an unrelated process that has
since been given the recorded pid, and normally just fails, leaving
e_machine as EM_NONE. The perf_env fallback that would have supplied the
recorded architecture is never reached, and thread__e_machine() returns
EM_HOST.
For a same-architecture recording this is invisible, since EM_HOST is the
right answer anyway. Cross-architecture it is not: annotating an Alpha
perf.data on an x86_64 host selects the x86 struct arch, so the Alpha
disassembly is matched against the x86 instruction table. Alpha's 'ret'
collides with x86's and gets ret_ops, while its calls and branches match
nothing and are left unparsed, so no call target is resolved and no jump
arrows are drawn.
Set the back pointer for the host machine and correct the session test.
The new back pointer does not disturb the other reader of the field,
machine__findnew_guest_code(), which machine__resolve() only calls when
!machine__is_host(machine).
Fixes: 70351029b5 ("perf thread: Add support for reading the e_machine type for a thread")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The waiting helpers implement timeouts using:
date +%s%1N
This relies on GNU coreutils date truncating %N to the specified width,
so %1N yields tenths of a second.
Rust coreutils (uutils) interprets the width differently and does not
truncate the nanoseconds field. Consequently "date +%1N" returns all
nine nanosecond digits, causing the elapsed-time calculation to be done
in nanoseconds while timeout values remain in tenths of a second.
As a result, timeout comparisons succeed immediately and the waiting
helpers time out on their first iteration. This causes
test_intel_pt.sh to fail on systems using uutils "date".
Avoid implementation-specific date formatting entirely. Instead, wait
for 100 ms on each iteration and count the timeout down. Besides fixing
the portability issue, this removes the busy-waiting behaviour in
wait_for_perf_to_start(), which could otherwise consume CPU while
waiting for perf record to start.
Since the timeout is now based on repeated sleeps, it is only
approximate. Update the comments accordingly. Also make is_running()
wait for exactly the documented number of tenths by changing its timeout
test from -gt to the new logic, and quote tm_out in the modified code.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
I've realized that it didn't set up the tracing files when BPF is used
so poll() just returns immediately. It ends up with calling poll()
unnecessarily in a loop.
BPF still needs the loop to wait for the target process exiting or a
signal from users. Let's use a semaphore instead.
Suggested-by: Ian Rogers <irogers@google.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
In get_argument_count(), the variable code_obj is assigned to itself
before being assigned the result of PyObject_GetAttrString(). This is
a redundant self-assignment that appears to be a typo.
Fix it by removing the redundant self-assignment.
Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The test case 'perf stat tests' fails on s390 z/VM machines. The
root cause is the unsupported CPU measurement facility on z/VM.
Therefore the events cycles and instructions do not exist and
are unsupported. This cause the subtest
Hide zero events stat test
to fail.
Output before:
# perf test 116
116: perf stat tests : FAILED!
=== Test Summary ===
Passed main tests : 0
Passed subtests : 0
Skipped tests : 0
Failed tests : 1
List of failed tests:
116: perf stat tests
#
Output after:
# ./perf test 116
116: perf stat tests : Ok
=== Test Summary ===
Passed main tests : 1
Passed subtests : 0
Skipped tests : 0
Failed tests : 0
#
Fixes: 64724095a3 ("perf stat: Add --hide-zero-events option to suppress zero-count events")
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Cc: Aaron Tomlin <atomlin@atomlin.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The kernel does not provide sys_futex() on 32-bit architectures that lack
a 32-bit time representation, such as riscv32. Consequently glibc does not
define SYS_futex there, only SYS_futex_time64, and perf bench's futex
benchmarks fail to build:
bench/futex.h: In function 'futex_syscall':
bench/futex.h:77:18: error: 'SYS_futex' undeclared (first use in this function)
Define SYS_futex as SYS_futex_time64 when only the latter is available.
The guard and its comment are taken verbatim from
tools/testing/selftests/futex/include/futextest.h, where they were added by
commit 04850819c6 ("selftests/futex: Define SYS_futex on 32-bit
architectures with 64-bit time_t"), keeping the two futex userspace headers
in sync.
No timespec conversion helper is needed on top of this. glibc lays out
struct timespec on 32-bit architectures with 64-bit time_t as
{ int64 tv_sec; int32 tv_nsec; 32-bit pad }, which is compatible with
struct __kernel_timespec, and every futex_wait()/futex_lock_pi()/
futex_wait_requeue_pi() call site in perf bench passes a NULL timeout
anyway, so no timespec ever crosses the syscall boundary here.
Note that an earlier and more ambitious attempt at this was
commit c1ff12dac4 ("perf bench futex: Add support for 32-bit systems
with 64-bit time_t"), reverted by
commit ba4026b09d ("Revert "perf bench futex: Add support for 32-bit
systems with 64-bit time_t"") because it included linux/time_types.h,
which is unavailable on older distributions. This change deliberately
avoids that dependency and adds only the one guard needed to fix
compilation.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Nylon Chen <nylon.chen@sifive.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements. POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself. A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.
This is the same off-by-one fixed for Intel PT by commit c4362d5e1a
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb822595 ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").
Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.
Fixes: c4bbd4ec2e ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
hist.h isn't related to UI and so remove the UI inclusion. Fix the
transitive dependency issues this exposes.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Declare stubs directly inside perf.c for commands that have library
dependencies sometimes omitted at build time, such as libtraceevent
(timechart, sched, kmem, lock, trace, kwork) and libelf (probe).
By unconditionally including these commands in the commands[] array,
users will receive a clear, unified warning indicating the missing
dependency instead of the command silently being absent.
Running `perf trace` with libtraceevent missing. Before:
```
perf: 'trace' is not a perf-command. See 'perf --help'.
Did you mean this?
ftrace
```
After:
```
'trace' command not available: missing libtraceevent devel package at build time.
```
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The code is mostly used by perf.c with additional unused functionality
such as function pointers derived from early git code. Moving it into
perf.c directly reduces the code footprint, drops the util/util.h
dependence from perf.c, and allows us to remove util/usage.c entirely.
The string constants are exposed in builtin.h, as they are used
in builtin-help.c.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Remove perf-sys.h, internal/lib.h (page_size), signal.h, and perf.h
since their exports are not used directly in perf.c.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Use git clang-format to sort header files. Review header file includes
removing those that were unnecessary or adding explicit includes in
cases where transitive dependencies were be using.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Move definitions to places they are used, or path.h in the case of
path.c's mkpath function. Remove unused definitions. Fix transitive
include dependencies.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Here are two simple fixes for this cycle.
- Do not use separate debug files for Intel PT decoding.
- Fix size of raw data in the PowerPC VPA DTL samples.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSo2x5BnqMqsoHtzsmMstVUGiXMgwUCap7zPAAKCRCMstVUGiXM
g57gAP9skjhPwFoQ8H5eGnR6dO3N8WDVrl+ZcQ/l8R9Yk+Q6aQD9EVM/2NUyGxtK
/LyQTM+WRl2UE26H7Fm39THNhoJGcAY=
=/JlH
-----END PGP SIGNATURE-----
Merge tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
Pull perf tools fixes from Namhyung Kim:
"Two simple fixes for this cycle:
- Do not use separate debug files for Intel PT decoding
- Fix size of raw data in the PowerPC VPA DTL samples"
* tag 'perf-tools-fixes-for-v7.3-2026-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
perf powerpc-vpadtl: Fix raw_size of DTL samples
perf symbol: Do not use debug file as the binary type
- A symlink racing with rmdir of its target could reach a freed
->ci_dentry. The reference get_target() takes pins the config_item,
not its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
configfs_remove_dir() drops while the item is still alive. Take the
target's configfs_dirent under ->d_lock instead of chasing
->ci_dentry.
- configfs_rmdir() left the dentry hashed across the final put of the
item, and configfs_get_config_item() treats a hashed dentry as proof
of a live item. A concurrent symlink could therefore resurrect a
dying item and hit a use-after-free. Unhash in configfs_remove_dir(),
while the item is still guaranteed to be there.
Both issues were found by syzbot.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEErIU5puj0ZwLKSkObNaOTn/x4d20FAmqe6GQACgkQNaOTn/x4
d21unBAAqg0vIxjQAGhQ/hZnnqdFJ9es63NE93H4ZZJzkLa9J5xqMnbAVAOUoPwo
BIbUs4uNVunJdhx3hgiPFSjEB9g+d9xxuoxNLHNPFptQe720QJ5ETC5X/QCmCrUc
QUOVLFN0EomOXXN7HK8+hKKTbslIFHDN2SmLkICprHwL6YKygginhhHaHGukY8Oo
Mfro0MTaFaVvQM6137r9EB3pnR+i+mtwEDjyWxBQFH3/KtyPW0RrUiyPM5uBP5ds
ECr1UsqMNFJfeLDH8T6SQ80hz/dczByo5OHyrMrmdmeQWmZLNEtKS0Q9L7kveS5L
l5PuAH2f6PHcF+cziflvB1hVy/zFWAZ6aOUMdKJY7HBImMWnWdjhm2p9ssVVe0zy
GlrXbULTekq7W4o/X70948hnk0jU3auHkeFSTHc6T/u8pt1HmKVV+Bg/uYsj8cFh
+DSeR5iZwj5LaYQ9mMocZQucjEBjT/Cqy/N2sT2gvKqnbyQ0w1mJEeuXMrU23NsV
2oRSMcXYEraBw6Ccnq2E7LL97tKwLp4g7myUsUGjcAe6i1JSM8d1X9wDoyL9QaHs
JTdHzIg0LoDX5hHjc7gBW2/Kj3cm8xvvs+lxjNM8aBIsszKTGVNakjA3IsI5UFax
/1IhMMKiyhIGJO2APFlfAzViTPm04DuAkFM80zCdH9pRfvcD2DU=
=kqSj
-----END PGP SIGNATURE-----
Merge tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux
Pull configfs fixes from Breno Leitao:
- A symlink racing with rmdir of its target could reach a freed
->ci_dentry.
The reference that get_target() takes pins the config_item, not
its dentry; the dentry is pinned by DCACHE_PERSISTENT, which
configfs_remove_dir() drops while the item is still alive.
Take the target's configfs_dirent under ->d_lock instead of chasing
->ci_dentry.
- configfs_rmdir() left the dentry hashed across the final put of the
item, and configfs_get_config_item() treats a hashed dentry as proof
of a live item. A concurrent symlink could therefore resurrect a
dying item and hit a use-after-free.
Unhash in configfs_remove_dir(), while the item is still guaranteed
to be there.
Both issues were found by syzbot.
* tag 'configfs-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:
configfs: unhash the dentry before dropping the item in rmdir
configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
configfs_get_config_item() treats a hashed dentry as proof that
sd->s_element is a live config_item. configfs_rmdir() breaks that:
simple_rmdir() leaves the dentry hashed, the last reference to the item is
dropped right after, and the dentry is only unhashed by d_delete() once
->rmdir() has returned. configfs_symlink() resolves its target holding no
lock on it, so get_target() can land in that window:
BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90
get_target fs/configfs/symlink.c:128 [inline]
configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185
Unhash in configfs_remove_dir(), while the item is still guaranteed to be
there. A reference obtained just before that stays harmless, as
create_link() rechecks CONFIGFS_USET_DROPPING, already set by
configfs_detach_prep(). Both configfs_unregister_subsystem() paths
d_drop() after detaching, so this only makes rmdir match them.
Reported-by: syzbot+6b16e3d085833cbf3e25@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25
Fixes: 7063fbf226 ("[PATCH] configfs: User-driven configuration filesystem")
Cc: stable@vger.kernel.org
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Tested-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260730093435.195441-3-vasilisalmpanis@gmail.com
Signed-off-by: Breno Leitao <leitao@debian.org>
create_link() reads the target's configfs_dirent from
item->ci_dentry->d_fsdata, relying on the item reference taken by
get_target(). That reference pins the item, not its dentry: the dentry is
pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via
simple_rmdir() while the item is still alive. A symlink racing with rmdir
of its target can therefore find ->ci_dentry freed and its dirent
released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().
Take the dirent in get_target() as well, under ->d_lock and atomically
with the item reference, and pass it down to create_link(). A hashed
dentry has not been killed yet, so its ->d_fsdata reference keeps the
dirent alive there.
Cc: stable@vger.kernel.org
Fixes: 7063fbf226 ("[PATCH] configfs: User-driven configuration filesystem")
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Tested-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260730093435.195441-2-vasilisalmpanis@gmail.com
Signed-off-by: Breno Leitao <leitao@debian.org>
Ritesh and Shrikanth has been helping in the powerpc mailing list
patch reviews, adding them as reviewers.
Acked-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Acked-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Acked-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260818035037.613186-1-maddy@linux.ibm.com
GCC fails to build ps3_defconfig with the following errors:
arch/powerpc/platforms/ps3/repository.c: In function ‘make_first_field.constprop’:
arch/powerpc/platforms/ps3/repository.c:78:9: error: ‘strnlen’ specified bound 8 exceeds source size 3 [-Werror=stringop-overread]
78 | memcpy((char *)&n, text, strnlen(text, sizeof(n)));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/platforms/ps3/repository.c: In function ‘make_first_field.constprop’:
arch/powerpc/platforms/ps3/repository.c:78:9: error: ‘strnlen’ specified bound 8 exceeds source size 4 [-Werror=stringop-overread]
78 | memcpy((char *)&n, text, strnlen(text, sizeof(n)));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The current use of strnlen(text, sizeof(n)) triggers -Wstringop-overread
when text is a short string literal that is smaller than sizeof(n), such
as "bi" or "bus". Use strlen(text) instead and clamp the copy length to
sizeof(n) before memcpy().
Drop the redundant char * cast while at it.
Fixes: f94a84a091 ("powerpc/ps3: refactor strncpy usage")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260703165834.137242-2-thorsten.blum@linux.dev
- Fix several tracefs files that did not take the trace_array reference
A trace instance can be created and destroyed in the tracefs "instances"
directory via mkdir and rmdir respectively. The instance is represented by
a trace_array descriptor. Most tracefs files pass the trace_array as the
private data of the inode to the open/read/write functions. Since there is
no locking between the time a task opens a file and the deletion of the
instance (and the freeing of the trace_array), each open needs to get a
reference to the trace_array and each close must remove it. A instance
can't be removed if there's any reference taken on its trace_array. The
open function uses trace_array_get() that takes a lock (preventing removal
of instances) and iterates the list of all existing trace_arrays and if it
finds a match, it takes the reference and releases the lock. If it doesn't
find a match, it causes the open to return -ENODEV.
There were some added files that did not take the trace_array reference
on open that needed to be fixed. Sashiko also correctly pointed out that
there were some files that took an address of an field or element of the
trace_array which had a pointer back to the trace_array to take its
reference on open. But this leaves a slight race between referencing this
element to get the trace_array as the element itself could be freed. To
solve this, some helper functions were created to look for trace_arrays
with this field or element in the search so that the element did not have
to be dereferenced before the trace_array's reference was taken.
- Add a lock around ftrace_ops initialization
When a ftrace_ops is first used by ftrace, some internal initialization is
performed on the ops. But if multiple tasks were calling functions that
did this initialization, it could race and perform doing the
initialization more than once, corrupting the internal data. Add a lock in
the initialization code to prevent this from happening.
- Fix splice reads on mmapped buffers
The logic in the ring buffer splice code for mmapped buffers is supposed
to do a copy of the memory as the mapped buffers can't be given to splice.
But there was an if statement within the copy code that would return a -1
if a request for a full page was done and it wasn't a partial read. This
is because this logic was written before mmapped buffers existed and this
case didn't make sense at the time. For mmapped buffers it makes perfect
sense and by returning early can drop a lot of pages unnecessarily.
- Have the persistent ring buffer validation check nr_subbufs
Sashiko reported that the validation code was relying on the saved
nr_subbufs to match the calculated nr_pages + 1 and if they were off, that
the code could cause corruption. Sashiko is correct, and the saved
nr_subbufs should be validated before assuming it is correct.
- Do not allow more than one instance with the same name on cmdline
If an admin were to add more than one trace instances with the same name
they all would be created, but only the first one would be accessible via
tracefs. This used to not be allowed but some restructuring of code has
since made it possible.
- Fix the race between subbuf resize and trace_pipe_raw readers
If a task was reading trace_pipe_raw while another task was changing the
ring buffer subbuf size, it could crash the reader. The trace_pipe_raw
readers do get their own copy of the page from the buffer, but the code
needs some restructuring to not have the resize of the subbuffers cause
issues.
- Cap the size of the mapped (static) ring buffer nr_pages
The meta data used for ring buffer mapped buffers is 32 bit in size. A
normal ring buffer could (in theory) have more than 4 billion pages.
But this is not allowed by mapped buffers, so enforce it.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCap3GJRQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qtAfAP9hDPtzctAoz+IHZq+GYejhKTu99ICG
vAxTOZivuG6KYAD/UPA4P7z5ayxGM5UlT+2U81+mpCd55F2oFiIxRuFYcwk=
=/d+T
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix several tracefs files that did not take the trace_array reference
A trace instance can be created and destroyed in the tracefs
"instances" directory via mkdir and rmdir respectively. The instance
is represented by a trace_array descriptor.
Most tracefs files pass the trace_array as the private data of the
inode to the open/read/write functions. Since there is no locking
between the time a task opens a file and the deletion of the instance
(and the freeing of the trace_array), each open needs to get a
reference to the trace_array and each close must remove it.
An instance can't be removed if there's any reference taken on its
trace_array. The open function uses trace_array_get() that takes a
lock (preventing removal of instances) and iterates the list of all
existing trace_arrays and if it finds a match, it takes the reference
and releases the lock. If it doesn't find a match, it causes the open
to return -ENODEV.
There were some added files that did not take the trace_array
reference on open that needed to be fixed. Sashiko also correctly
pointed out that there were some files that took an address of an
field or element of the trace_array which had a pointer back to the
trace_array to take its reference on open. But this leaves a slight
race between referencing this element to get the trace_array as the
element itself could be freed. To solve this, some helper functions
were created to look for trace_arrays with this field or element in
the search so that the element did not have to be dereferenced before
the trace_array's reference was taken.
- Add a lock around ftrace_ops initialization
When a ftrace_ops is first used by ftrace, some internal
initialization is performed on the ops. But if multiple tasks were
calling functions that did this initialization, it could race and
perform doing the initialization more than once, corrupting the
internal data. Add a lock in the initialization code to prevent this
from happening.
- Fix splice reads on mmapped buffers
The logic in the ring buffer splice code for mmapped buffers is
supposed to do a copy of the memory as the mapped buffers can't be
given to splice. But there was an if statement within the copy code
that would return a -1 if a request for a full page was done and it
wasn't a partial read. This is because this logic was written before
mmapped buffers existed and this case didn't make sense at the time.
For mmapped buffers it makes perfect sense and by returning early can
drop a lot of pages unnecessarily.
- Have the persistent ring buffer validation check nr_subbufs
Sashiko reported that the validation code was relying on the saved
nr_subbufs to match the calculated nr_pages + 1 and if they were off,
that the code could cause corruption. Sashiko is correct, and the
saved nr_subbufs should be validated before assuming it is correct.
- Do not allow more than one instance with the same name on cmdline
If an admin were to add more than one trace instances with the same
name they all would be created, but only the first one would be
accessible via tracefs. This used to not be allowed but some
restructuring of code has since made it possible.
- Fix the race between subbuf resize and trace_pipe_raw readers
If a task was reading trace_pipe_raw while another task was changing
the ring buffer subbuf size, it could crash the reader. The
trace_pipe_raw readers do get their own copy of the page from the
buffer, but the code needs some restructuring to not have the resize
of the subbuffers cause issues.
- Cap the size of the mapped (static) ring buffer nr_pages
The meta data used for ring buffer mapped buffers is 32 bit in size.
A normal ring buffer could (in theory) have more than 4 billion
pages. But this is not allowed by mapped buffers, so enforce it.
* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Use a macro for static buffer bits
tracing: Fix comment in tracing_buffers_splice_read()
ring-buffer: Prevent truncation of nr_pages / nr_subbufs
ring-buffer: Cap static ring buffer nr_pages
tracing: Fix subbuf resize races with trace_pipe_raw readers
tracing: Fix to avoid creating trace instances with duplicate names
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
ring-buffer: Allow splice reads on static buffers
tracing: Take trace_array reference when opening options file
ftrace: Synchronize the initialization of ftrace_ops
ftrace: Take trace_array reference before accessing its ftrace_ops
tracing: Have show_event_filters/triggers files take trace array ref
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmqdhRMACgkQ6rmadz2v
bTo8vRAAnP+x1z6FBOgHawGmmBpXtazoipRFeok/+/YGQ4SbS+evvFNvmkeCyihZ
7EeNHGuWEbA6xQBAcMf0StMjmr3jkJvUA6lsHSxBiFLpHGqNt0Fz9IXvAL/8QWPg
F7+CBs5A+J61i66LEmINbWzW1ujDf7baU/1VWui9zfPxnmPu40V/74eXzm6DmH/V
oHTsCscCYNe+N+Wix6B6nLrObY537fcJU12N56uqpkaSc0+6H1fBQJmyFGpYroTX
+4g+DNzEHyIYmt6B3+oDpbT0Zh/pP6ROq5TPDNJSSa+5B/uPo5C5pH520HwXF9hJ
04uaD7y2fpE809Nwl3OEK4ozpJ+mEGU1NKZPvFAxckY6GCiBtfbGd1etFno7r+4F
mZhNBKbQVEQX4XJUlcoqn9n7T2OCDnjiuneZAjIi4vUdevnSnakr0rCTFriiHP54
jg4fEkXxvYjPiqs5SQbxoGxmYSfg9fYaSfK4HgFdlfbwp+3Vmv4BW/tcsIJ9dcPs
L3YWkUU3znjbu2BLy0CP9fGt/1ik8p4/tA8vvZwz0yqpDMJkLy1TziGMef51UQ7k
1Pe/Ln5J3C6xnWs+3TRF11y8PuuCF0y47DGPACfwPoQxca1ufJ5fgmLXRRQToZe4
RjDmoeQvvI9w9kxh6gVhTHoiiEeD0wcQqx2CMHKTrU/PbM7d4Co=
=oz4Z
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
"This mainly contains verifier fixes that address bugs reported by
Nicholas Carlini.
- Fix incorrect non-NULL inference in pointer comparisons: pointer
types that may be NULL at runtime, pointers with unbounded offsets,
JMP32 comparisons with zero, and imprecise zero registers (Eduard
Zingerman)
- Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
NULL call arguments (Eduard Zingerman)
- Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
patterns entered by a jump (Eduard Zingerman)
- Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
(Hui Su)
- Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
and reject key-less BTF for hash maps (Jiayuan Chen)
- Various fixes (Kumar Kartikeya Dwivedi):
- Fix out-of-bounds access in disassembler on invalid LDSX
instruction
- mark siginfo of signal tracepoints as scalar and
sched_process_wait argument as nullable
- mark faultable stack helpers as sleepable
- reject tail calls and legacy packet loads from callbacks
- enforce rbtree callback lock restrictions for resilient locks
- require MEM_PERCPU for percpu kptr stores
- clear NON_OWN_REF after RCU protection ends
- mark NULL kptr stores precise
- preserve inner map identity in callback frames
- reject non-scalar bpf_loop() iteration counts
- Fix trampoline allocation slowdown on x86 by using
EXECMEM_MODULE_DATA (Mike Rapoport)
- Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
reject untrusted allocated-object pointers (Ning Ding)
- Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
Yuan Chen)"
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
bpf, riscv: Make arena support depend on ZACAS
selftests/bpf: Test pointer bpf_loop iteration count rejection
bpf: Reject non-scalar bpf_loop iteration counts
bpf: use mark_arg_precision() in check_mem_size_reg()
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
bpf: mark a NULL BTF_ID argument of a global subprogram precise
selftests/bpf: precision of a NULL kfunc argument
bpf: mark a NULL kfunc argument precise
selftests/bpf: precision of a NULL global subprogram memory argument
bpf: mark a NULL memory argument of a call precise
selftests/bpf: precision of a NULL helper argument
bpf: mark a NULL call argument precise
selftests/bpf: Test inner map identities in callbacks
bpf: Preserve inner map identity in callback frames
selftests/bpf: Test imprecise scalar kptr stores
bpf: Mark NULL kptr stores precise
selftests/bpf: Test rhtab kptr cancellation semantics
bpf: Cancel special fields when recycling rhtab elements
selftests/bpf: Test timer field on recycled rhtab element
...
