aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/tools
AgeCommit message (Collapse)AuthorFilesLines
2026-07-07selftests: drv-net: Add test for cross-esw rate schedulingCosmin Ratiu2-0/+297
Adds a Python selftest using the YNL devlink API to verify the devlink rate ops. The test requires a bond device given in the config as NETIF containing two PFs. Test setup will then create 1 VF on each PF and verify the various rate commands. ./devlink_rate_cross_esw.py TAP version 13 1..3 ok 1 devlink_rate_cross_esw.test_same_esw_parent ok 2 devlink_rate_cross_esw.test_cross_esw_parent ok 3 devlink_rate_cross_esw.test_tx_rates_on_cross_esw Tests will be skipped when the preconditions aren't met, when the devlink API is too old or when the devices don't appear to support cross-esw scheduling (detected via EOPNOTSUPP). Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260701073254.754518-14-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06Merge tag 'mm-hotfixes-stable-2026-07-06-17-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mmLinus Torvalds10-7/+120
Pull misc fixes from Andrew Morton: "20 hotfixes. 17 are for MM. 12 are cc:stable and the remaining 8 address post-7.1 issues or aren't considered suitable for backporting. Two patches from SJ addresses a couple of quite old DAMON issues. And two patches from Yichong Chen fixes tools/virtio build issues. The remaining patches are singletons" * tag 'mm-hotfixes-stable-2026-07-06-17-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: tools/include: include stdint.h for SIZE_MAX in overflow.h tools/virtio: add missing compat definitions for vhost_net_test mm: do file ownership checks with the proper mount idmap samples/damon/mtier: fail early if address range parameters are invalid mm: a second pagecache maintainer mm/damon: add a kernel-doc comment for damon_ctx->rnd_state mm/damon: add a kernel-doc comment for damon_ctx->probes mailmap: add entries for Radu Rendec selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE selftests/mm: pagemap_ioctl: use the correct page size for transact_test() fs/proc: fix KPF_KSM reported for all anonymous pages mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access mm/damon/ops-common: handle extreme intervals in damon_hot_score() MAINTAINERS: add Lance as an rmap reviewer mm/compaction: handle free_pages_prepare() properly in compaction_free() mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() mm: shrinker: fix NULL pointer dereference in debugfs mm: shrinker: fix shrinker_info teardown race with expansion selftests/mm: fix ksft_process_madv.sh test category
2026-07-06KVM: arm64: selftests: Add MMIO sign-extending load testFuad Tabba2-0/+256
Add a test for sign-extending MMIO loads (LDRSB, LDRSH, LDRSW) into Xt and Wt destinations, with and without the sign bit set. The host supplies the MMIO data and checks the guest register holds the sign-extended value. Repeat the loads big-endian on a mixed-endian implementation. Issue those at EL0: SCTLR_EL1.EE would make an EL1 load big-endian but also walk the little-endian page tables big-endian, whereas SCTLR_EL1.E0E selects only EL0 data endianness and leaves the walk little-endian. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260706115522.954913-3-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-07-06selftests: net: make busywait timeout clock portableNirmoy Das1-2/+23
loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute can use uutils date, where `date -u +%s%3N` returns seconds plus full nanoseconds instead of a 3-digit millisecond field. This makes busywait expire too early and can make vlan_bridge_binding.sh read a stale operstate. Fixes: 25ae948b4478 ("selftests/net: add lib.sh") Cc: stable@vger.kernel.org # 6.8+ Link: https://github.com/uutils/coreutils/issues/11658 Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com> Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skbVictor Nogueira1-0/+164
Add test cases to reproduce scenarios fixed recently [1] where multiqueue and taprio forced their children into enqueueing an skb to gso_skb (during peek), but failed to dequeue from gso_skb because they called the child's dequeue callback directly. This causes a desync in the child's qlen/backlog and results in an eventual null-ptr-deref (with a qfq or dualpi2 child). Test cases are the following: - Force multiq to dequeue from its child's gso_skb with qfq leaf (fb6c) - Force multiq to dequeue from its child's gso_skb with dualpi2 leaf (1922) - Force taprio to dequeue from its child's gso_skb with qfq leaf (476f) - Force taprio to dequeue from its child's gso_skb with dualpi2 leaf (0235) [1] https://lore.kernel.org/netdev/20260625-b4-disp-31bcb279-v1-0-85c40b83c529@proton.me/ Signed-off-by: Victor Nogueira <victor@mojatatu.com> Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> Link: https://patch.msgid.link/20260630153651.249752-1-victor@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06selftests/alsa: Fix format specifier and function mismatch in mixer-testMalaya Kumar Rout1-2/+2
In the ctl_value_index_valid() function, when validating 64-bit integer controls (SND_CTL_ELEM_TYPE_INTEGER64), the error message for maximum value validation has two bugs: 1. Uses snd_ctl_elem_info_get_max() instead of the 64-bit variant snd_ctl_elem_info_get_max64() 2. Uses %ld format specifier instead of %lld for long long type This is inconsistent with the minimum value validation (line 335-339) which correctly uses get_min64() and %lld. The mismatch can cause: - Incorrect maximum values being reported on some architectures - Undefined behavior due to format specifier mismatch - Potential crashes when printing the error message Fix by using snd_ctl_elem_info_get_max64() and %lld format specifier to match the data type and be consistent with the minimum value check. Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com> Link: https://patch.msgid.link/20260705171038.171966-1-malayarout91@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-05selftests/rseq: Fix spelling of accommodateDing Junlin1-1/+1
It's spelled with two 'm'. Signed-off-by: Ding Junlin <1746193727@qq.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Link: https://patch.msgid.link/tencent_BAB26179A92C5CE28657C0451540E6EE4B05@qq.com
2026-07-05selftests/futex: Dynamically skip unsupported testsWake Liu2-0/+6
Some new futex tests rely on kernel features that may not be supported on all configurations (e.g., FUTEX2_NUMA or PR_FUTEX_HASH). Currently, these tests fail with EINVAL when the features are missing. Add dynamic skip logic to: - futex_priv_hash: Skip if PR_FUTEX_HASH returns ENOSYS or EINVAL. - futex_numa_mpol: Skip if futex2 or FUTEX2_NUMA returns ENOSYS or EINVAL. This allows the tests to pass (as SKIPPED) on kernels without support, while preserving coverage on configurations that do support them. [ tglx: Adapt to harness changes, massage change log ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260624070223.1533167-1-wakel@google.com
2026-07-05selftests/futex: Add FUTEX_LOCK_PI owner-exiting coverageValery Borovsky4-1/+269
The futex functional tests cover FUTEX_LOCK_PI timeout semantics (futex_wait_timeout.c) and robust-list owner death (robust_list.c), but nothing exercises a non-robust PI owner exiting while holding the lock, nor the basic ownership / EDEADLK / unlock word semantics of FUTEX_LOCK_PI. Add futex_lock_pi_exiting.c with three tests: - lock_unlock_basic: an uncontended FUTEX_LOCK_PI puts the owner TID in the futex word, a recursive lock by the owner returns EDEADLK, and FUTEX_UNLOCK_PI clears the word. - owner_dies_with_blocked_waiter: a thread acquires a PI futex and exits while holding it; a blocked FUTEX_LOCK_PI waiter must come out cleanly (0, EOWNERDEAD or ESRCH) and own the lock when it acquires. - stress_owner_exits: repeatedly drive the same exiting-owner path. The exiting-owner retry path is where commit 210d36d892de ("futex: Clear stale exiting pointer in futex_lock_pi() retry path") fixed a stale task pointer that tripped WARN_ON_ONCE() in wait_for_owner_exiting(). That warning does not change the syscall return value, so this test does not assert on it directly; the stress loop exists to give a kernel booted with panic_on_warn=1 (as fuzzers and CI commonly run) a chance to trip on it. Signed-off-by: Valery Borovsky <vebohr@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260607183249.246037-1-vebohr@gmail.com
2026-07-05selftests/futex: Migrate robust_list to harnessWake Liu1-82/+97
Migrate robust_list test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to cloned child functions via child_args struct. Also, fix an out-of-bounds waitpid bug during multithreaded tests. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-8-wakel@google.com
2026-07-05selftests/futex: Migrate futex_priv_hash to harnessWake Liu1-81/+79
Migrate futex_priv_hash test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to all helper functions. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-7-wakel@google.com
2026-07-05selftests/futex: Migrate futex_numa_mpol to harnessWake Liu1-62/+62
Migrate futex_numa_mpol test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to helper functions. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-6-wakel@google.com
2026-07-05selftests/futex: Migrate futex_requeue_pi_signal_restart to harnessWake Liu1-37/+37
Migrate futex_requeue_pi_signal_restart test to the kselftest harness framework, removing mixed legacy ksft_* API usages and ensuring proper thread joining. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-5-wakel@google.com
2026-07-05selftests/futex: Migrate futex_requeue_pi_mismatched_ops to harnessWake Liu1-16/+25
Migrate futex_requeue_pi_mismatched_ops test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to helper thread. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-4-wakel@google.com
2026-07-05selftests/futex: Migrate futex_requeue_pi to harnessWake Liu1-78/+79
Migrate futex_requeue_pi test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to all helper threads via thread arguments. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-3-wakel@google.com
2026-07-05selftests/futex: Migrate futex_requeue to harnessWake Liu1-10/+24
Migrate futex_requeue test to the kselftest harness framework, removing mixed legacy ksft_* API usages and ensuring proper thread joining. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260601065126.3623867-2-wakel@google.com
2026-07-05selftests/futex: Migrate futex_wait_uninitialized_heap to harnessWake Liu1-15/+20
Migrate futex_wait_uninitialized_heap test to the kselftest harness framework, removing mixed legacy ksft_* API usages and ensuring proper thread joining. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260525092002.3762888-4-wakel@google.com
2026-07-05selftests/futex: Migrate futex_wait_private_mapped_file to harnessWake Liu1-16/+20
Migrate futex_wait_private_mapped_file test to the kselftest harness framework, removing mixed legacy ksft_* API usages and passing test metadata to helper thread. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260525092002.3762888-3-wakel@google.com
2026-07-05selftests/futex: Migrate futex_wait to harnessWake Liu1-47/+80
Migrate futex_wait test to the kselftest harness framework, removing mixed legacy ksft_* API usages and ensuring proper thread joining. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260525092002.3762888-2-wakel@google.com
2026-07-05selftests/futex: Correct validation logic in waitvWake Liu1-25/+30
In futex_waitv negative tests (invalid_flag, unaligned_address, etc.), test results are evaluated as: if (res == EINVAL) Since sys_futex_waitv returns -1 on error and sets errno, direct positive comparisons against res are always false, causing tests to silently pass regardless of real errors. Correct these validations to assert EXPECT_EQ(res, -1) and compare errno directly against expected constants. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260526010635.23980-3-wakel@google.com
2026-07-05selftests/futex: Migrate functional tests to harnessWake Liu4-137/+144
Currently, multiple futex functional tests (wait_timeout, waitv, wait_wouldblock) mix low-level ksft_* logging and result APIs with the kselftest_harness.h framework. On older kernels where system calls like futex_waitv are missing (returning -ENOSYS), this mixed usage triggers framework inconsistencies, causing the test to fail with: "Illegal usage of low-level ksft APIs in harness test". Address this by completely refactoring these tests to exclusively use the high-level kselftest_harness.h framework (gtest-like API), mapping all low-level calls to native harness macros: - Non-fatal assertions: Replace ksft_test_result_fail() with EXPECT_EQ() and EXPECT_NE(). - Fatal assertions: Replace ksft_exit_fail_msg() with ASSERT_EQ() and ASSERT_TRUE() to immediately terminate execution upon setup failure. - Test skipping: Replace ksft_exit_skip() with the graceful SKIP() macro combined with early runtime availability checks for sys_futex_waitv. - Debug logging: Replace ksft_print_dbg_msg() with TH_LOG() to inherit automatic file/line context. - Success reporting: Remove explicit ksft_test_result_pass() calls, deferring to automated harness completion reporting. Additionally: - Fix a critical SIGSEGV crash in early syscall probing logic caused by passing a NULL pointer to inline user-space timespec conversions. - Introduce TEST_TIMEOUT() and GET_ABS_TIMEOUT() macros in wait_timeout to encapsulate assertions while preserving source line attribution. - Pass test metadata (_metadata) into secondary threads to allow native harness assertions during concurrent execution. [ tglx: Fixup coding style ] Signed-off-by: Wake Liu <wakel@google.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260526010635.23980-2-wakel@google.com
2026-07-05selftests/futex: Remove static keyword from 'head'Ankit Khushwaha1-1/+1
'head' is defined as 'static struct robust_list_head' that stores the local variable of 'struct lock_struct a' raising the Wdangling-pointer warning. robust_list.c: In function ‘child_circular_list’: robust_list.c:522:24: warning: storing the address of local variable ‘a’ in ‘head.list.next’ [-Wdangling-pointer=] 522 | head.list.next = &a.list; | ~~~~~~~~~~~~~~~^~~~~~~~~ robust_list.c:513:28: note: ‘a’ declared here 513 | struct lock_struct a, b, c; | ^ robust_list.c:512:40: note: ‘head’ declared here 512 | static struct robust_list_head head; | ^~~~ Since 'head' doesn't need static storge duration, removing the static keyword of it to fix this. Signed-off-by: Ankit Khushwaha <ankitkhushwaha.linux@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260420173544.55288-1-ankitkhushwaha.linux@gmail.com
2026-07-05Merge tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tipLinus Torvalds1-0/+86
Pull perf events fixes from Ingo Molnar: - Fix a perf_event_attr::remove_on_exec bug for group events (Taeyang Lee) - Fix uprobes CALL emulation interaction with shadow stacks, and add a testcase for this (David Windsor) - Fix uprobes unregister bug (Jiri Olsa) * tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline selftests/x86: Add shadow stack uprobe CALL test x86/uprobes: Keep shadow stack in sync for emulated CALLs perf/core: Detach event groups during remove_on_exec
2026-07-05selftests/alsa: Fix memory leak in find_controls error pathMalaya Kumar Rout1-0/+1
In find_controls(), card_data is allocated with malloc() but when snd_ctl_open_lconf() fails, the code jumps to next_card without freeing the allocated memory. This results in a memory leak for each card where snd_ctl_open_lconf() fails. Add free(card_data) before goto next_card to ensure proper cleanup of the allocated memory in the error path. Fixes: 5aaf9efffc57 ("kselftest: alsa: Add simplistic test for ALSA mixer controls kselftest") Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com> Link: https://patch.msgid.link/20260704105736.94874-1-malayarout91@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-04perf tests: Add auto counter reload (ACR) sampling testDapeng Mi1-0/+43
Add auto counter reload sampling test to verify that the intended event records can be captured and the self-reloaded events won't generate any records. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-04perf vendor events amd: Update Zen 6 core eventsSandipan Das1-5/+29
Update definitions for the following events. * PMCx00A - Fix descriptions * PMCx00C - Add missing unit masks * PMCx00D - Add missing unit masks and fix descriptions * PMCx013 - Fix incorrect unit masks Fixes: 2f42fb0661d9 ("perf vendor events amd: Add Zen 6 core events") Signed-off-by: Sandipan Das <sandipan.das@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-04perf vendor events amd: Update Zen 5 core eventsSandipan Das2-18/+120
Update definitions for the following events. * PMCx00A - Add missing unit masks * PMCx00B - Add missing unit masks and fix descriptions * PMCx00C - Add missing unit masks * PMCx00D - Add missing unit masks * PMCx025 - Add missing unit masks and fix descriptions Fixes: 45c072f2537a ("perf vendor events amd: Add Zen 5 core events") Signed-off-by: Sandipan Das <sandipan.das@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-04perf test amd ibs: avoid using executable heapOndrej Mosnacek1-14/+6
Making [parts of] the heap executable is dangerous and is blocked by SELinux on Fedora/RHEL even for an unconfined user. Replace the malloc() + mprotect() combo with just mmap(), creating a private anonymous rwx mapping, which only requires the more commonly allowed "execmem" permission under SELinux (things like JIT or regex compilation need it as well). mmap() with MAP_ANONYMOUS will give us a zeroed mapping that begins on a page boundary, so the result is equivalent to the original code even without a memset() or the page-alignment dance. Verified that the test still passes on a machine with an AMD CPU that has the "ibs" CPU flag. Fixes: 35db59fa8ea2 ("perf test amd ibs: Add sample period unit test") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-04selftests/bpf: Add tests for forked/cloned optimized uprobesJiri Olsa1-0/+88
Adding tests for forked/cloned optimized uprobes and make sure the child can properly execute optimized probe for both fork (dups mm) and clone with CLONE_VM. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-14-jolsa@kernel.org
2026-07-04selftests/bpf: Add tests for uprobe nop10 red zone clobberingAndrii Nakryiko4-0/+164
The uprobe nop5 optimization used to replace a 5-byte NOP with a 5-byte CALL to a trampoline. The CALL pushes a return address onto the stack at [rsp-8], clobbering whatever was stored there. On x86-64, the red zone is the 128 bytes below rsp that user code may use for temporary storage without adjusting rsp. Compilers can place USDT argument operands there, generating specs like "8@-8(%rbp)" when rbp == rsp. With the CALL-based optimization, the return address overwrites that argument before the BPF-side USDT argument fetch runs. Add two tests for this case. The uprobe_syscall subtest stores known values at -8(%rsp), -16(%rsp), and -24(%rsp), executes an optimized nop10 uprobe, and verifies the red-zone data is still intact. The USDT subtest triggers a probe in a function where the compiler places three USDT operands in the red zone and verifies that all 10 optimized invocations deliver the expected argument values to BPF. On an unfixed kernel, the first hit goes through the INT3 path and later hits use the optimized CALL path, so the red-zone checks fail after optimization. [ updates to use nop10 ] Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-13-jolsa@kernel.org
2026-07-04selftests/bpf: Add reattach tests for uprobe syscallJiri Olsa1-10/+120
Adding reattach tests for uprobe syscall tests to make sure we can re-attach and optimize same uprobe multiple times. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20260703114917.238144-12-jolsa@kernel.org
2026-07-04selftests/bpf: Change uprobe/usdt trigger bench code to use nop10Jiri Olsa3-29/+29
Changing uprobe/usdt trigger bench code to use nop10 instead of nop5. Also changing run_bench_uprobes.sh to use nop10 triggers. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-11-jolsa@kernel.org
2026-07-04selftests/bpf: Change uprobe syscall tests to use nop10Jiri Olsa4-25/+34
Optimized uprobes are now on top of 10-bytes nop instructions, reflect that in existing tests. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-10-jolsa@kernel.org
2026-07-04selftests/bpf: Emit nop,nop10 instructions combo for x86_64 archJiri Olsa1-1/+1
Syncing latest usdt.h change [1]. Now that we have nop10 optimization support in kernel, let's emit nop,nop10 for usdt probe. We leave it up to the library to use desirable nop instruction. [1] https://github.com/libbpf/usdt/commit/9018f82577d1dad7ed628d9efdaffc09f8f2241b Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-9-jolsa@kernel.org
2026-07-04libbpf: Detect uprobe syscall with new errorJiri Olsa2-3/+3
In the previous optimized uprobe fix we changed the syscall error used for its detection from ENXIO to EPROTO. Changing related probe_uprobe_syscall detection check. Fixes: 05738da0efa1 ("libbpf: Add uprobe syscall feature detection") Fixes: 554ba38456da ("uprobes/x86: Move optimized uprobe from nop5 to nop10") Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://patch.msgid.link/20260703114917.238144-8-jolsa@kernel.org
2026-07-04libbpf: Change has_nop_combo to work on top of nop10Jiri Olsa1-8/+8
We now expect nop combo with 10 bytes nop instead of 5 bytes nop, fixing has_nop_combo to reflect that. Fixes: 41a5c7df4466 ("libbpf: Add support to detect nop,nop5 instructions combo for usdt probe") Fixes: 554ba38456da ("uprobes/x86: Move optimized uprobe from nop5 to nop10") Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://patch.msgid.link/20260703114917.238144-7-jolsa@kernel.org
2026-07-03perf test: Add Arm CoreSight callchain testLeo Yan6-2/+213
Add a CoreSight shell test for synthesized callchains. The test uses the new callchain workload to generate trace and decodes it with synthesis callchain. It then verifies that the instruction samples show the expected callchain push and pop. Use control FIFOs so tracing starts only around the workload, which keeps the trace data small. The test is limited to with the cs_etm event available and root permission. After: perf test 138 -vvv 138: CoreSight synthesized callchain: ---- start ---- test child forked, pid 35581 Callchain flow matched: l1=4642868 l2=4642880 l3=4642895 l4=4642919 l5=4670494 l6=4670500 l7=4670520 ---- end(0) ---- 138: CoreSight synthesized callchain : Ok Assisted-by: Codex:GPT-5.5 Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Synthesize callchains for instruction samplesLeo Yan1-5/+78
CS ETM already records branches into the thread stack, but instruction samples do not carry synthesized callchains. It misses to support the callchain and no output with the itrace option 'g'. Allocate a callchain buffer per queue and use thread_stack__sample() when synthesizing instruction samples. Advertise PERF_SAMPLE_CALLCHAIN on the synthetic instruction event. Allocate one extra callchain entry than requested, as the first entry is reserved for storing context information. cs_etm__context() is introduced for handling context packet and update the thread info and start kernel address for frontend decoding. After: perf script --itrace=g16l64i1i callchain_test 6543 [002] 1 instructions: ffff800080010c14 vectors+0x414 ([kernel.kallsyms]) aaaad6b60784 do_svc+0x1c (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaad6b60798 print+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaad6b607b0 foo+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaad6b607c8 main+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff9325225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff9325233c call_init+0x9c (inlined) ffff9325233c __libc_start_main_impl+0x9c (inlined) aaaad6b60670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff800080012290 ret_to_user+0x120 ([kernel.kallsyms]) Signed-off-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Support call indentationLeo Yan1-5/+15
The perf script callindent is derived from call stack in thread context, CS ETM ignores the requirement for callindent without pushing and poping call stack. Enable thread-stack when either itrace thread-stack support or last branch entries are requested, allocate the branch stack storage accordingly, and feed taken branches to thread_stack__event() whenever thread-stack state is needed. When callindent is requested, pass callstack=true to thread_stack__event() so the common thread-stack code maintains call depth for branch samples. Before: perf script -F +callindent callchain_test 6543 [002] 1 branches: main ffff93252258 __libc_start_call_main+0x78 (/usr/lib/aarch64-linux-gnu/libc.so.6) callchain_test 6543 [002] 1 branches: foo aaaad6b607c4 main+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: print aaaad6b607ac foo+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: do_svc aaaad6b60794 print+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: vectors aaaad6b60780 do_svc+0x18 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: el0t_64_sync_handler ffff80008001159c el0t_64_sync+0x194 ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: el0_svc ffff800081829194 el0t_64_sync_handler+0x9c ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: lockdep_hardirqs_off ffff800081828794 el0_svc+0x24 ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: __this_cpu_preempt_check ffff80008182b348 lockdep_hardirqs_off+0xf0 ([kernel.kallsyms]) After: callchain_test 6543 [002] 1 branches: main ffff93252258 __libc_start_call_main+0x78 (/usr/lib/aarch64-linux-gnu/libc.so.6) callchain_test 6543 [002] 1 branches: foo aaaad6b607c4 main+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: print aaaad6b607ac foo+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: do_svc aaaad6b60794 print+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: vectors aaaad6b60780 do_svc+0x18 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 6543 [002] 1 branches: el0t_64_sync_handler ffff80008001159c el0t_64_sync+0x194 ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: el0_svc ffff800081829194 el0t_64_sync_handler+0x9c ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: lockdep_hardirqs_off ffff800081828794 el0_svc+0x24 ([kernel.kallsyms]) callchain_test 6543 [002] 1 branches: __this_cpu_preempt_check ffff80008182b348 lockdep_hardirqs_off+0xf0 ([kernel.kallsyms]) Signed-off-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Flush thread stacks after decoder resetLeo Yan1-0/+45
Perf resets the CoreSight decoder when moving to a new AUX trace buffer, this causes trace discontinunity globally. For callchain synthesis, keeping thread-stack state after decoder reset can leave stale call/return history attached to threads that are decoded later, producing incorrect synthesized callchains. Flush all host thread stacks after a decoder reset. When virtualization is present, flush the guest thread stacks as well. Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Use thread-stack for last branch entriesLeo Yan1-115/+58
CS ETM maintains its own circular array for last branch entries, with local helpers to update, copy and reset the branch stack. This duplicates logic already provided by the common code. Record taken branches with thread_stack__event() and synthesize PERF_SAMPLE_BRANCH_STACK data with thread_stack__br_sample(). This removes the private last_branch_rb buffer and its position tracking. This also makes the branch history state belong to the thread rather than the trace queue. That is a better fit for CoreSight traces where a trace queue can effectively be CPU scoped, while call/return history is per thread. Keep the buffer number updated via thread_stack__set_trace_nr(), which is used when exporting samples to Python scripts. Pass callstack=false for now; synthesized callchains are added by a later patch. The output should remain same, except that be->flags.predicted is no longer set. Since CoreSight trace does not provide branch prediction information, clearing the flag avoids confusion. Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Refactor instruction size handlingLeo Yan1-21/+22
This patch introduces a new function cs_etm__instr_size() to calculate the instruction size based on ISA type and instruction address. Given the trace data can be MB and most likely that will be A64/A32 on a lot of platforms, cs_etm__instr_addr() keeps a single ISA type check for A64/A32 and executes an optimized calculation (addr + offset * 4). Signed-off-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Decode ETE exception packetsLeo Yan1-3/+3
ETE shares the same packet format as ETMv4, but exception decoding handled ETMv4 packets only. As a result, ETE exception packets were not classified. Recognize the ETE magic for exception number decoding. Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Filter synthesized branch samplesLeo Yan3-6/+22
The itrace 'c' and 'r' options request synthesized branch events for calls and returns only. For perf script the default itrace options are "--itrace=ce", so CS ETM should emit call branches and error events by default. CS ETM currently synthesizes a branch sample for every decoded taken branch whenever branch synthesis is enabled. This produces redundant jump and conditional branch samples. Add a branch filter derived from the itrace calls and returns options. When neither option is set, keep the existing behavior and synthesize all branch samples. When calls or returns are requested, emit only branch samples whose flags match the selected branch type, while preserving trace begin/end markers. Also update test_arm_coresight_disasm.sh and arm-cs-trace-disasm.py to use the --itrace=b option for generating branch samples. Before: perf script -F,+flags callchain_test 6114 [005] 331519.825214: 1 branches: tr strt jmp 0 [unknown] ([unknown]) => ffff8000803a3a68 perf_report_aux_output_id+0x50 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000803a3a74 perf_report_aux_output_id+0x5c ([kernel.kallsyms]) => ffff8000817f4d88 memset+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jmp ffff8000817f4d8c memset+0x4 ([kernel.kallsyms]) => ffff8000817f4c00 __pi_memset_generic+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4c1c __pi_memset_generic+0x1c ([kernel.kallsyms]) => ffff8000817f4c44 __pi_memset_generic+0x44 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4c4c __pi_memset_generic+0x4c ([kernel.kallsyms]) => ffff8000817f4c5c __pi_memset_generic+0x5c ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4c5c __pi_memset_generic+0x5c ([kernel.kallsyms]) => ffff8000817f4cf0 __pi_memset_generic+0xf0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4d30 __pi_memset_generic+0x130 ([kernel.kallsyms]) => ffff8000817f4d68 __pi_memset_generic+0x168 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4d78 __pi_memset_generic+0x178 ([kernel.kallsyms]) => ffff8000817f4d6c __pi_memset_generic+0x16c ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4d78 __pi_memset_generic+0x178 ([kernel.kallsyms]) => ffff8000817f4d6c __pi_memset_generic+0x16c ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000817f4d78 __pi_memset_generic+0x178 ([kernel.kallsyms]) => ffff8000817f4d6c __pi_memset_generic+0x16c ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: return ffff8000817f4d84 __pi_memset_generic+0x184 ([kernel.kallsyms]) => ffff8000803a3a78 perf_report_aux_output_id+0x60 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: jcc ffff8000803a3a98 perf_report_aux_output_id+0x80 ([kernel.kallsyms]) => ffff8000803a3b04 perf_report_aux_output_id+0xec ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000803a3b1c perf_report_aux_output_id+0x104 ([kernel.kallsyms]) => ffff8000803a38f8 __perf_event_header__init_id+0x0 ([kernel.kallsyms]) After: callchain_test 6114 [005] 331519.825214: 1 branches: tr strt jmp 0 [unknown] ([unknown]) => ffff8000803a3a68 perf_report_aux_output_id+0x50 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000803a3a74 perf_report_aux_output_id+0x5c ([kernel.kallsyms]) => ffff8000817f4d88 memset+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000803a3b1c perf_report_aux_output_id+0x104 ([kernel.kallsyms]) => ffff8000803a38f8 __perf_event_header__init_id+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000803a39c0 __perf_event_header__init_id+0xc8 ([kernel.kallsyms]) => ffff800080105258 __task_pid_nr_ns+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff80008010528c __task_pid_nr_ns+0x34 ([kernel.kallsyms]) => ffff8000801d5610 __rcu_read_lock+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000801052b0 __task_pid_nr_ns+0x58 ([kernel.kallsyms]) => ffff800080192078 lock_acquire+0x0 ([kernel.kallsyms]) callchain_test 6114 [005] 331519.825214: 1 branches: call ffff8000801923f4 lock_acquire+0x37c ([kernel.kallsyms]) => ffff8000801d6da0 rcu_is_watching+0x0 ([kernel.kallsyms]) Fixes: b12235b113cf ("perf tools: Add mechanic to synthesise CoreSight trace packets") Signed-off-by: Leo Yan <leo.yan@linaro.org> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf cs-etm: Fix thread leaks on trace queue init failureLeo Yan1-0/+4
cs_etm__init_traceid_queue() allocates the frontend and decode threads, if a later allocation fails, the error path does not drop thread reference that was already acquired. Release both thread pointers with thread__zput() on the error path, so does not leak thread references or leave stale pointers behind. Fixes: 951ccccdc715 ("perf cs-etm: Only track threads instead of PID and TIDs") Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf test: Extend perf kvm tests to check default eventNamhyung Kim1-0/+10
It can now pass command line arguments to perf kvm record. Let's pass 'sleep 1' directly and see it doesn't fail. $ sudo perf test -vv kvm 96: perf kvm tests: ---- start ---- test child forked, pid 3686726 Starting qemu-system-x86_64... Testing perf kvm stat Recording kvm events for pid 3686746 (duration 1s)... perf kvm stat test [Success] Testing perf kvm record/report Recording kvm profile for pid 3686746 (duration 1s)... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.576 MB /tmp/__perf_kvm_test.perf.data.0HgX6 (4009 samples) ] perf kvm record/report test [Success] Testing perf kvm buildid-list perf kvm buildid-list test [Success] Testing perf kvm stat live perf kvm stat live test [Success] Testing perf kvm record default event with command line [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.000 MB /dev/null ] perf kvm record default event [Success] ---- end(0) ---- 96: perf kvm tests : Ok === Test Summary === Passed main tests : 1 Passed subtests : 0 Skipped tests : 0 Failed tests : 0 Tested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf kvm: Fix a memory leak in the usage stringNamhyung Kim1-7/+8
The first element of the kvm_usage string is allocated dynamically by parse_options_subcommand() if it's NULL. Callers should free it after use. Tested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf kvm: Do not copy filename stringNamhyung Kim1-10/+4
As it removed STRDUP_FAIL_EXIT(), it no longer calls free() for elements in the copied argv. Thus, the filename should not be allocated as well. In fact, it's a pointer to string literals and should be fine to pass the pointer. Tested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf kvm: Kill STRDUP_FAIL_EXIT()Namhyung Kim4-53/+24
It's used to pass command line options to a copied argv. But there's no reason to make the copies as it's all used in the same function. It can simply use stack variables. In fact, it fixes a subtle double free issue. As parse_options() can move contents in argv[], some entries may point to the same item. So freeing all items in the argv could trigger a double free. With stack variables, we don't need to allocate and free them. Tested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-03perf kvm: Check kvm_need_default_arch_event() earlyNamhyung Kim1-10/+11
There's a subtle issue with option parsing in perf record. It calls the function with PARSE_OPT_STOP_AT_NON_OPTION so that it can pass later options to the external command it runs. But perf kvm record passes the default arch events after the argv. So if user calls it with command, then it passes the event to the external command and fails it like below: $ sudo perf kvm --host record sleep 1 sleep: invalid option -- 'e' Try 'sleep --help' for more information. [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.046 MB perf.data.kvm (5 samples) ] We can check if the default options are needed before passing the extra command line to make sure it's passed to perf record. Tested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.