linux-next.git/tools/perf/util/trace_augment.h, branch master

perf trace: Filter the target's tasks in BPF

2026-10-01T15:39:14+00:00

The augmented syscalls BPF programs are attached to raw_syscalls system wide, so they run for every task. To make the bpf-output event system wide, and so augment the target's children, they need to know which tasks are the target's. Add a pids_to_trace map, seeded from the target's thread map, that sys_enter and sys_exit check, leaving other tasks' events alone. tp_btf programs add children on fork when inheriting, remove exited tasks and follow a thread that exec gives the leader's pid. Tasks that don't fit in the map, including when seeding, are counted and reported as lost. Other forks drop any entry for the child's pid, seeded for a task that had exited, such as a zombie. A workload waits for its exec, like enable_on_exec. When inheriting, unless given threads with -t, key the map by tgid, like off-cpu's task_filter, so a process's threads share its entry. New threads are then traced with their process, which is forgotten when its last thread exits, and exec keeps the key. The sched programs attach when the skeleton loads and the map is seeded before the events are opened, so the forks and exits that follow are seen. sys_enter and sys_exit now attach once the maps are populated, rather than at load where the empty prog arrays made them veto every raw_syscalls event. Reviewed-by: Namhyung Kim Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo

perf trace: Split unaugmented sys_exit program

2026-10-01T15:36:46+00:00

We want to handle syscall exit path differently so let's split the unaugmented exit BPF program. Currently it does nothing (same as sys_enter). [ irogers: Use struct syscall_{enter,exit}_args and make trace__find_syscall_bpf_prog() fall back to the exit program for exits ] Signed-off-by: Namhyung Kim Link: https://lore.kernel.org/r/20250814071754.193265-3-namhyung@kernel.org Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo

perf trace: Include the headers declaring pid_t, strcmp and assert

2026-09-22T12:59:58+00:00

trace_augment.h uses pid_t in the augmented_syscalls__set_filter_pids() prototype and in the !HAVE_BPF_SKEL stub. bpf_trace_augment.c calls strcmp() in augmented_syscalls__find_by_title() and assert() in augmented_syscalls__create_bpf_output(), but neither pulls in the header that declares what it uses. Both happen to build today only because something else in the include chain drags , and in first, which is not guaranteed and does not hold on libcs such as musl that keep the POSIX namespaces strictly separated. Include , and explicitly. Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo

perf trace: Split BPF skel code to util/bpf_trace_augment.c

2025-06-26T17:31:05+00:00

And make builtin-trace.c less conditional. Dummy functions will be called when BUILD_BPF_SKEL=0 is used. This makes the builtin-trace.c slightly smaller and simpler by removing the skeleton and its helpers. The conditional guard of trace__init_syscalls_bpf_prog_array_maps() is changed from the HAVE_BPF_SKEL to HAVE_LIBBPF_SUPPORT as it doesn't have a skeleton in the code directly. And a dummy function is added so that it can be called unconditionally. The function will succeed only if the both conditions are true. Do not include trace_augment.h from the BPF code and move the definition of TRACE_AUG_MAX_BUF to the BPF directly. Reviewed-by: Howard Chu Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250623225721.21553-1-namhyung@kernel.org Signed-off-by: Namhyung Kim

perf trace: Pretty print buffer data

2024-09-10T12:52:13+00:00

Define TRACE_AUG_MAX_BUF in trace_augment.h data, which is the maximum buffer size we can augment. BPF will include this header too. Print buffer in a way that's different than just printing a string, we print all the control characters in \digits (such as \0 for null, and \10 for newline, LF). For character that has a bigger value than 127, we print the digits instead of the character itself as well. Committer notes: Simplified the buffer scnprintf to avoid using multiple buffers as discussed in the patch review thread. We can't really all 'buf' args to SCA_BUF as we're collecting so far just on the sys_enter path, so we would be printing the previous 'read' arg buffer contents, not what the kernel puts there. So instead of: static int syscall_fmt__cmp(const void *name, const void *fmtp) @@ -1987,8 +1989,6 @@ syscall_arg_fmt__init_array(struct syscall_arg_fmt *arg, struct tep_format_field - else if (strstr(field->type, "char *") && strstr(field->name, "buf")) - arg->scnprintf = SCA_BUF; Do: static const struct syscall_fmt syscall_fmts[] = { + { .name = "write", .errpid = true, + .arg = { [1] = { .scnprintf = SCA_BUF /* buf */, from_user = true, }, }, }, Signed-off-by: Howard Chu Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Link: https://lore.kernel.org/r/20240815013626.935097-8-howardchu95@gmail.com Link: https://lore.kernel.org/r/20240824163322.60796-6-howardchu95@gmail.com Signed-off-by: Arnaldo Carvalho de Melo