cs_etm__get_trace() returns an int, but it used to return etmq->buf_len
on success. That value comes from auxtrace_buffer::size, which is a
size_t. For a large AUX trace block, returning the byte count through an
int can overflow and make a valid buffer look like a negative error.
The callers do not need the actual byte count from cs_etm__get_trace().
The buffer length is already stored in the etmq->buf_len. The callers
only need to distinguish three states:
< 0: error
= 0: no more AUX buffers
> 0: data is available
Make cs_etm__get_trace() return 0 for all non-error cases and use
etmq->buf_len to indicate whether a new buffer was found. Then make
cs_etm__get_data_block() return 1 whenever data is available, instead of
returning the buffer length.
Also refactor cs_etm__get_data_block() to make its return value
semantics clearer.
Reported-by: Suyash Mahar <smahar@meta.com>
Fixes: 8224531cf5 ("perf cs-etm: Modularize auxtrace_buffer fetch function")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
When monitoring a large number of events (e.g., with wildcards such as
--event 'syscalls:sys_enter_*'), many matched events will return a count
of zero. This clutters the output, making it difficult to spot the
active events.
Add a new option --hide-zero-events to suppress printing events that
have a count of zero.
To prevent formatting and diagnostic issues, the zero-skipping logic
implements the following rules:
1. In metric-only mode (i.e., --metric-only), columns must remain
aligned in the output grid. We evaluate config->metric_only first
to avoid skipping zero-valued columns, preventing values from
shifting left and aligning under incorrect headers
2. For explicitly requested events, we ensure they are not silently
hidden if they are unsupported. We only hide a zero-count event
if counter->supported is true, ensuring that unsupported explicit
events still report "<not supported>"
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
It seems RISCV was added in capstone version 5 (released Jul 2023).
Unfortunately they are enum constants so cannot check with #ifdef but
anyway we can define the symbols. Let's do it using the version
number to avoid build errors. It'll fail at runtime though.
util/capstone.c: In function 'e_machine_to_capstone':
util/capstone.c:186:25: error: 'CS_ARCH_RISCV' undeclared (first use in this function);
did you mean 'CS_ARCH_SYSZ'?
186 | *arch = CS_ARCH_RISCV;
| ^~~~~~~~~~~~~
| CS_ARCH_SYSZ
util/capstone.c:186:25: note: each undeclared identifier is reported only once for each function it appears in
util/capstone.c:187:34: error: 'CS_MODE_RISCV64' undeclared (first use in this function);
did you mean 'CS_MODE_MIPS64'?
187 | *mode |= (is64 ? CS_MODE_RISCV64 : CS_MODE_RISCV32) | CS_MODE_RISCVC;
| ^~~~~~~~~~~~~~~
| CS_MODE_MIPS64
Also note that capstone renamed CS_MODE_RISCVC to CS_MODE_RISCV_C which
would cause a different build failure on latest versions. It's reported
in https://github.com/capstone-engine/capstone/issues/2977 so I think
they will add compatibility layer to prevent the error.
Fixes: 12c4737f55 ("perf capstone: Determine architecture from e_machine")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In add_script_opt(), the function unconditionally increments the optstr
and act pointers for a second optional 'time' popup action before
attempting to invoke add_script_opt_2(). If the first add_script_opt_2()
call failed (for example, due to an asprintf allocation failure), this
leaves a NULL pointer gap in the options array at the prior index. When
ui__popup_menu() is later displayed, it dereferences this gap and
crashes.
Fix it by avoiding unconditional pointer increments. Only advance the
optstr and act pointers if the first script addition actually succeeded,
and safely attach the time parameter to the correct assigned action.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In arch__find(), if the architecture's arch_new_fn[e_machine]() returns
NULL, the error handling path attempts to read result->name, dereferencing
a NULL pointer and crashing. At the same time, it invokes free(tmp)
BEFORE updating the static global archs pointer to tmp. If the
reallocarray() call moved the allocated block, the original archs pointer
remained active but was freed. A subsequent call to arch__find() would
then pass this dangling pointer into bsearch(), causing a use-after-free.
Fix both by printing the numeric e_machine ID instead of result->name,
and updating the static global archs pointer to tmp immediately after the
successful reallocarray() invocation to safely retain the valid prior
architectures.
Closes: https://lore.kernel.org/linux-perf-users/20260709035721.9EE901F000E9@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Looking at switch_data_file(), it uses the POSIX constant PATH_MAX.
Omitting the explicit inclusion of limits.h can cause build failures on
musl libc systems, which do not implicitly include headers in the same way
glibc does. Fix this by explicitly including <limits.h> at the top of
tools/perf/ui/browsers/hists.c.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In evsel__hists_browse(), the 'options' and 'actions' arrays are
statically allocated on the stack with a size of MAX_OPTIONS (16).
Further down, the function sequentially calls several add_*_opt()
functions, which increment nr_options without bounds checking.
Depending on the context (e.g., branch mode, scripting, annotations),
the sum of added options can theoretically exceed 16 (potentially
reaching up to ~19). This could lead to a stack buffer overflow.
Increase MAX_OPTIONS to 32 to safely accommodate the maximum possible
number of options without risking an overflow.
Closes: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Link: https://lore.kernel.org/linux-perf-users/20260708235834.3FB771F00A3A@smtp.kernel.org/
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The bfd_boolean type was gone and converted to the standard bool type
but we have some old code that uses the type. It caused a failure in
the build test.
util/libbfd.c: In function 'slurp_symtab':
util/libbfd.c:94:9: error: unknown type name 'bfd_boolean'
94 | bfd_boolean dynamic = FALSE;
| ^~~~~~~~~~~
util/libbfd.c:94:31: error: 'FALSE' undeclared (first use in this function)
94 | bfd_boolean dynamic = FALSE;
| ^~~~~
util/libbfd.c:94:31: note: each undeclared identifier is reported only once for each function it appears in
util/libbfd.c:102:27: error: 'TRUE' undeclared (first use in this function)
102 | dynamic = TRUE;
| ^~~~
Fix it with standard bool type and constants.
Reviewed-by: Ian Rogers <irogers@google.com>
Link: https://sourceware.org/pipermail/binutils-cvs/2021-March/056231.html
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The loop for processing syscall args in augment_raw_syscalls has a
history of breaking with Clang updates, see e.g. commit 013eb043f3
("perf trace: Fix BPF loading failure (-E2BIG)") from Clang 15 to 16.
Now, a similar thing happened between Clang 21 and 22. While the issue
is mitigated on the main line by a recent verifier update, it remains
broken on the 6.12 and 6.18 stable branches:
[linux-6.18.y]# sudo perf trace true
libbpf: prog 'sys_enter': BPF program load failed: -E2BIG
libbpf: prog 'sys_enter': -- BEGIN PROG LOAD LOG --
[...]
BPF program is too large. Processed 1000001 insn
processed 1000001 insns (limit 1000000) max_states_per_insn 40 total_states 37941 peak_states 232 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'sys_enter': failed to load: -E2BIG
libbpf: failed to load object 'augmented_raw_syscalls_bpf'
libbpf: failed to load BPF skeleton 'augmented_raw_syscalls_bpf': -E2BIG
Error: failed to get syscall or beauty map fd
[...]
The reason is that the loop is quite complex and the BPF verifier often
struggles to prove that it terminates.
Fix the issue by replacing the standard for loop with the bpf_for macro,
which uses a numeric BPF iterator. This should prevent future breakages
of this kind since the verifier has a much easier job proving that the
loop terminates.
Small adjustments were necessary for the loop to make it work. The main
problem is that the verifier sometimes has problems with bpf_for loops
that use a carry-over state, such as the `payload_offset` and `output`
vars here, since the verifier tries to track their values too precisely
and cannot prove loop convergence. To resolve the issue, we (1)
explicitly recompute `payload_offset` in every iteration and (2) use a
trick with adding a global zero to `output` to help the verifier forget
its precise state and use a range instead.
Finally, to keep backwards compatibility with older kernel versions that
don't have bpf_for (i.e. numeric iterators), fall back to standard loop.
Signed-off-by: Viktor Malik <vmalik@redhat.com>
Cc: stable@vger.kernel.org
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Fixes: a68fd6a6cd ("perf trace: Collect augmented data using BPF")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The BPF program in augmented_raw_syscalls uses a for loop to iterate all
syscall arguments. The loop body is quite complex and often poses
problems for the BPF verifier. As a preparation step for addressing this
issue, factor out the loop body into a separate function.
Signed-off-by: Viktor Malik <vmalik@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
To simply check the number of output lines with and without the option.
Before this series, it failed like below:
$ perf test -v 125
125: perf stat --bpf-counters --for-each-cgroup test:
---- start ----
test child forked, pid 1941516
Normal output has 22 lines, but it now has 54
---- end(-1) ----
125: perf stat --bpf-counters --for-each-cgroup test : FAILED!
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In the evsel, there's an internal struct to put fields need copy when
the evsel is cloned. This is purely to make it easier track those
fields even if it sometimes failed to do so. :)
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
IIUC bpf_fd and bpf_obj fields are not used anymore. It seems like
leftover from 3d6dfae889 ("perf parse-events: Remove BPF event
support").
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The --bpf-counters and --for-each-cgroup options use a set of shared
events among the given cgroups rather than adding events for each cgroup
respectively. It only uses cgroup-ID to compare and calculate the
result. So no need to open and keep FDs for cgroups in BPF mode.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
If the realloc for fda->entries succeeds but the realloc for fda->priv
fails, the error path frees the newly allocated entries.
However, fda->entries is neither updated to point to the new entries block
nor cleared to NULL. If realloc moved the allocation to a new block, the
old fda->entries pointer is now freed memory.
When fdarray__exit() is later called to clean up, it executes
free(fda->entries), which would trigger a double-free on that old pointer.
Reported-by: Sashiko Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The first entry of the sched_usage is dynamically allocated in
parse_options_subcommand() so it should be released at the end.
Do not return from a subcommand directly.
Fixes: 064790a3d4 ("perf sched stats: Add support for diff subcommand")
Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The second pass data is not saved in the list and only used to calculate
delta from the first pass. Let's free the data after use.
Fixes: 5a357ae6ad ("perf sched stats: Add support for report subcommand")
Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The perf sched stats record missed to release the session and ASAN
reported a leak.
Fixes: c3030995f2 ("perf sched stats: Add record and rawdump support")
Reviewed-and-tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In evsel__tp_format(), when trace_event__tp_format*() returns an error,
IS_ERR() checks the local variable 'tp_format', but PTR_ERR() incorrectly
uses 'evsel->tp_format' which hasn't been assigned yet.
Fix this by using PTR_ERR(tp_format) to extract the error code from the
correct variable.
Fixes: 6c8310e838 ("perf evsel: Allow evsel__newtp without libtraceevent")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Use MAP_FAILED instead of NULL to detect mmap errors, and fix the
slots_p variable name typo in the sample code.
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
New OMR MSRs are introduced for OMR events on DMR and NVL. Perf continues
to reuse the existing offcore_rsp attribute to encode the MSR value,
similar to existing OCR event handling.
Add the corresponding OMR MSR mappings in lookup_msr() so jevents can
translate these events and generate the correct offcore_rsp attribute.
Link: https://lore.kernel.org/all/20260114011750.350569-2-dapeng1.mi@linux.intel.com/
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Remove duplicate inclusion of util/term.h in builtin-test.c to clean up
redundant code.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
With Zstd compression enabled ('perf record -z'), a single mmap push
whose compressed output exceeds the maximum record size makes
zstd_compress_stream_to_records() emit several PERF_RECORD_COMPRESSED2
records back to back. record__pushfn() however rewrote only the first
record's header to describe the whole blob as one record:
event->data_size = compressed - sizeof(struct perf_record_compressed2);
event->header.size = PERF_ALIGN(compressed, sizeof(u64));
padding = event->header.size - compressed;
...
record__write(rec, map, &pad, padding);
perf_event_header::size is a __u16, so once the compressed blob no
longer fits in it the header.size assignment truncates and 'padding'
(size_t) underflows. write() is then handed that bogus length and fails
with EFAULT, aborting the recording:
failed to write perf data, error: Bad address
The bytes that did reach the file are mis-framed, so reading it back
cannot be decompressed.
This is easy to hit with a high event rate and a large buffer, e.g.:
perf record -z -F max -m 32M --per-thread -- perf test -w thloop 5 1
The single-record fixup is wrong by construction: because header.size is
16 bits a compressed record cannot exceed 64KB, so the compressor must
split a push into a chain of records, and the session reader already
consumes them as such.
Frame each record where it is produced instead: make
process_comp_header() set the per-record data_size, 8-byte-align
header.size and zero the trailing padding, and let record__pushfn()
write the resulting blob, as the AIO path already does. Reduce
max_record_size by sizeof(u64) so the per-record alignment padding
cannot push header.size past its u16 field. process_comp_header()
returns -1 when that padding would not fit the space left in 'dst', so
the compressor stops instead of overrunning the output buffer.
There is no on-disk format change; a perf.data written by the fixed tool
is still read by existing perf.
Fixes: 208c0e1683 ("perf record: Add 8-byte aligned event type PERF_RECORD_COMPRESSED2")
Reported-by: Farid Zakaria <fmzakari@meta.com>
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
process_comp_header() is called from zstd_compress_stream_to_records()
twice per record: once with data_size == 0 to write the record header,
and once with the payload size to finalize it. It returns the increment
it was passed, and the loop separately decides whether a record still
fits by comparing the remaining 'dst_size' against the header size.
With the fit check split from the code that writes the record,
process_comp_header() cannot reject a record on its own, so any bytes it
writes into 'dst' have to be bounds-checked by the caller instead of
where they are produced.
Pass the space left in 'dst' to process_comp_header(), let it return the
number of bytes written or -1 when the header does not fit, and account
the compressed payload in the loop.
No functional change intended.
Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The recent commit caused a failure in make build-test for static builds.
Let's not pass -static the option to dlfilters which is dynamically
loaded as it's hard-coded with -shared even for static builds.
Tested-by: Leo Yan <leo.yan@arm.com>
Cc: Trevor Allison <tallison@redhat.com>
Fixes: e1065ed188 ("perf build: Add LDFLAGS to dlfilters .so link")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
metricgroup__copy_metric_events() allocates a new metric expression and
duplicates metric_name before linking the expression into the destination
metric event.
Free new_expr when strdup() fails, and free the duplicated metric_name on
the later error paths.
Fixes: b85a4d61d3 ("perf metric: Allow modifiers on metrics")
Signed-off-by: Yu Peng <pengyu@kylinos.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
This commit updates the .clang-format rules for the perf tools.
It prioritizes Python.h sorting and expands the regex lists for C
standard library and OS specific headers.
- Prioritize Python.h by sorting it first (Priority -1), ensuring it
is sorted before even the main header (Priority 0).
- Keep other header priorities (1 and 2) to maintain their relative
order.
- Sanity check and complete "C Standard Library Headers" up to C23
(added stdbit.h, stdckdint.h).
- Sanity check and complete "OS/System-Specific Headers" based on
actual usage in tools/perf (added asm-generic, uapi, and various
flat POSIX/system headers).
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Under system-wide (-a) parallel streaming mode (--threads=cpu),
background recording threads can be inundated by a continuous
firehose of hardware samples generated by the OS. In this state,
a background thread's local hit count remains unequal to its
sample count, causing it to bypass the blocking fdarray__poll()
call entirely on each iteration of its recording loop.
Because the termination check relies on the POLLHUP event status
populated specifically by fdarray__poll(), bypassing it prevents
the background thread from ever recognizing that its control pipe
was closed by the main thread. This traps the background thread
in an infinite recording loop, hanging the main thread indefinitely
as it awaits a termination acknowledgment that never arrives.
Ensure teardown completion by adding explicit evlist__disable()
calls in the main thread's cleanup paths at out_child: and
out_child_no_flush:. Additionally, patch fdarray__filter() to
respect the fdarray_flag__nonfilterable flag, preventing it
from incorrectly setting the background thread's control pipe
file descriptor to -1 and clearing its revents mask upon
processing termination POLLHUP signals.
Fixes: f94563fac2 ("perf record: fix poll storm when monitored threads exit")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
In print_capstone_detail(), maps__find() is used to locate the kernel
map. This function increments the reference count of the found map
object. However, the current implementation fails to call map__put()
after the map is no longer needed, leading to a reference count leak.
Fix this by adding a map__put(map) call to properly release the
reference after use.
Fixes: 92dfc59463 ("perf annotate: Add symbol name when using capstone")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Commit ae42a2a2a3 ("perf tests: Speed up lock contention analysis shell test")
in linux-next heavily optimized the test runtimes by switching the workload from
the default of 10 process groups down to 1 (`perf bench sched messaging -g 1`).
However, this change inadvertently dropped the original `-p` flag, causing the
benchmark to default to `socketpair()` instead of `pipe()`. While `socketpair()`
still generates some lock events on x86, it fails to trigger enough samples on
architectures like s390, causing the test suite to fail due to lack of captured
data.
Restore the omitted `-p` pipe flag. The test retains the massive speedups
achieved through the `-g 1` scaling, while producing a massive density of lock
events across all architectures to fully satisfy the BPF trace filtering logic.
Fixes: ae42a2a2a3 ("perf tests: Speed up lock contention analysis shell test")
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
The current kallsyms detection in dso__is_kallsyms() uses the
dso_binary_type enum which fixes the issue of kallsyms being cached in
the build-id cache for out-of-tree modules.
However, during build-id injection in perf record/inject, dso_binary_type
has not been explicitly set yet,so dso__binary_type() returns
DSO_BINARY_TYPE__NOT_FOUND instead of DSO_BINARY_TYPE__KALLSYMS for the
kernel DSO. The current check then fails to identify it as kallsyms,
causing build-id symlinks to not be created in ~/.debug/.build-id/ and
perf archive to fail with "Cannot stat" errors.
Steps to reproduce the issue:
1. rm -rf ~/.debug/.build-id
2. perf record sleep 1
3. perf archive
Fix by falling back to matching long_name against the known kallsyms
strings explicitly when binary_type is not yet set
(== DSO_BINARY_TYPE__NOT_FOUND). Use strcmp() for exact matching of
fixed names and strict validation for guest kallsyms with embedded PID
to prevent path traversal attacks.
Fixes: ebf0b33273 ("perf dso: fix dso__is_kallsyms() check")
Signed-off-by: Tanushree Shah <tshah@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Specifying --field-separator option is stating you want CSV output.
Passing both --field-separator and --json-output is then stating
you want output to be in CSV and JSON format at same time.
Currently this combination is not rejected, and the outcome
is a malformed combination of CSV and JSON output.
This is because of inconsistencies in various printing functions,
some of them have if-else chains that start with
"Should I print JSON?", and some start with "Should I print CSV?".
Example of current output:
$ tools/perf/perf stat -x , -j -e cpu-migrations true
{"counter-value" : "0.000000", "unit" : "", "event" : "cpu-migrations", "event-runtime" : 474817, "pcnt-running" : 100.00,,
Instead reject the option combination,
with a helpful error message and non-zero exit code.
Example of new output:
$ tools/perf/perf stat -x , -j true
cannot use both --field-separator and --json-output
Usage: perf stat [<options>] [<command>]
-x, --field-separator <separator>
print counts with custom separator
-j, --json-output print counts in JSON format
Signed-off-by: Ivan Lazaric <ivan.lazaric1@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
