kernel/git/next/linux-next.git/tools/perf, branch master

perf unwind: Handle allocation failure in libdw__get_entries()

2026-09-08T21:51:13+00:00

Check the return value of zalloc() before dereferencing the allocated dwfl_ui_ti structure. Return -ENOMEM when the allocation fails to avoid a NULL pointer dereference. Signed-off-by: Triet Hoang Acked-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo

perf trace: Add upper bound checks for augmented BTF struct printing

2026-09-08T21:42:37+00:00

When pretty-printing augmented struct payloads using BTF via btf_struct_scnprintf(), augmented_arg->size is currently only validated against values <= 0. However, several edge cases can result in size mismatches or buffer over-reads: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. If augmented_arg->size exceeds arg->augmented.size - sizeof(*augmented_arg), calculating consumed = sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer limits (e.g., with crafted INT_MAX values in an untrusted perf.data file) or cause arg->augmented.size to underflow. This advances arg->augmented.args out of bounds, corrupting the parsing state for subsequent arguments in multi-argument syscalls. 3. If the captured payload is truncated (e.g., short reads in BPF, or during cross-architecture analysis such as replaying a 32-bit perf.data on a 64-bit host where host BTF type->size exceeds the 32-bit target payload), passing type->size to btf_dump__dump_type_data() causes libbpf to read past the end of the payload buffer. Enforce an upper bound on augmented_arg->size against the remaining buffer (arg->augmented.size - sizeof(*augmented_arg)) and verify that the captured payload contains at least type->size bytes before passing it to btf_dump__dump_type_data(). Fixes: cb32035214b9a09d ("perf trace: Pretty print struct data") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin Cc: Howard Chu Signed-off-by: Arnaldo Carvalho de Melo

perf test: Avoid call to missing cleanup function

2026-09-08T21:13:52+00:00

Cleanup function was removed by writing to /dev/null rather than temporary files. The exit path still had a call. Fixes: 44f6b44027910eb9 ("perf test: Fix hybrid testing of event fallback test") Reviewed-by: Dapeng Mi Signed-off-by: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo

perf annotate: add Alpha instruction support

2026-09-08T21:08:53+00:00

Teach perf annotate about the Alpha control-transfer instructions, so that an Alpha perf.data gets call and jump arrows and resolved call targets, whether it is read on Alpha or on another host. Add tools/perf/util/annotate-arch/annotate-alpha.c with arch__new_alpha() and an associate_instruction_ops() that classifies: call: bsr, plus jsr and jcr as indirect calls ret: ret jump: br, the conditional branches beq/bne/blt/ble/bgt/bge/blbc/blbs and fbeq/fbne/fblt/fble/fbgt/fbge, plus jmp as an indirect jump mov: mov, fmov (objdump pseudos) That is every mnemonic binutils can print for the branch and JSR formats. jcr rather than jsr_coroutine, because both name the same MBR(0x1a,3) encoding and print_insn_alpha() takes the first match in the table, where the jcr alias has come first since the sources were imported in 1999. bsr needs an Alpha-specific parse routine. The generic call__parse() expects the operand string to begin with the target address, but a bsr prints its return-address register first: bsr t0,fffffc0001031dc0 strtoull() then stops on the leading register name, leaving the target address as 0, which makes call__scnprintf() fall back to printing the raw operands and leaves target.sym unresolved so the browser cannot follow the call. alpha_call__parse() takes the address from after the comma instead, as s390_call__parse() does for the same reason. The PC-relative branches need no such handling, as jump__parse() already skips up to two operands. jsr and jmp get ins_ops that resolve no target at all. They transfer control to a register, and their trailing operand is only a branch prediction hint: jsr ra,(t12),fffffc0001014ee8 <_printk> binutils extracts that hint as a 14-bit signed field scaled by four and prints it relative to the next instruction (extract_jhint() in alpha-opc.c, print_insn_alpha() in alpha-dis.c), so it can name the callee only when the callee lies within the resulting +-32KB. It also defaults to zero, which prints as the next instruction. Of the 213750 jsr in a vmlinux built from this tree, only 23093 hints land on a symbol; 157204 point into the middle of an unrelated function and 33453 are that default. Parsing the hint would therefore invent a call target for the majority of calls, so these keep their operands, as an indirect call does elsewhere. EM_ALPHA is 0x9026, far too large to index the e_machine-keyed arch_new_fn[] table in arch__find(), so select arch__new_alpha explicitly before the table lookup. Declare it in disasm.h and add the object to the annotate-arch Build. Disassembly itself comes from objdump/binutils, which already supports Alpha; this provides perf's instruction-class metadata for annotation. Tested on an EV7 Marvel, both natively and by annotating its perf.data on an x86_64 host, over bsr to a local function, jsr through the PLT and kernel-mode jsr; the two hosts produce identical output. Reviewed-by: Ian Rogers Signed-off-by: Matt Turner Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Fix live-session detection in thread__e_machine()

2026-09-08T21:08:37+00:00

When the per-thread e_machine cannot be determined from the DSOs in the thread's maps, thread__e_machine_endian() decides between reading /proc//exe and falling back to the recorded session environment: bool is_live = machine->machines == NULL; if (!is_live) { /* Check if the session has a data file. */ struct perf_session *session = container_of(...); is_live = !!session->data; } Neither half of that works. The back pointer added by commit a088031c4998 ("perf tools: Add machine to machines back pointer") is set by machines__add(), which only ever adds guests; the host machine never gets one. Host-machine threads, which is to say almost all of them, therefore see machine->machines == NULL and are declared live before the session is consulted at all. The session test is also inverted. A session with a perf_data attached is one being read from a perf.data file, i.e. exactly the case that is not live, while a live session such as 'perf top' passes data=NULL to __perf_session__new(). So a file-based session takes the live path and reads /proc//exe on the analysing host, which at best describes an unrelated process that has since been given the recorded pid, and normally just fails, leaving e_machine as EM_NONE. The perf_env fallback that would have supplied the recorded architecture is never reached, and thread__e_machine() returns EM_HOST. For a same-architecture recording this is invisible, since EM_HOST is the right answer anyway. Cross-architecture it is not: annotating an Alpha perf.data on an x86_64 host selects the x86 struct arch, so the Alpha disassembly is matched against the x86 instruction table. Alpha's 'ret' collides with x86's and gets ret_ops, while its calls and branches match nothing and are left unparsed, so no call target is resolved and no jump arrows are drawn. Set the back pointer for the host machine and correct the session test. The new back pointer does not disturb the other reader of the field, machine__findnew_guest_code(), which machine__resolve() only calls when !machine__is_host(machine). Fixes: 70351029b55677eb ("perf thread: Add support for reading the e_machine type for a thread") Reviewed-by: Ian Rogers Signed-off-by: Matt Turner Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo

perf test waiting.sh: Replace timestamp polling with sleep

2026-09-08T21:06:01+00:00

The waiting helpers implement timeouts using: date +%s%1N This relies on GNU coreutils date truncating %N to the specified width, so %1N yields tenths of a second. Rust coreutils (uutils) interprets the width differently and does not truncate the nanoseconds field. Consequently "date +%1N" returns all nine nanosecond digits, causing the elapsed-time calculation to be done in nanoseconds while timeout values remain in tenths of a second. As a result, timeout comparisons succeed immediately and the waiting helpers time out on their first iteration. This causes test_intel_pt.sh to fail on systems using uutils "date". Avoid implementation-specific date formatting entirely. Instead, wait for 100 ms on each iteration and count the timeout down. Besides fixing the portability issue, this removes the busy-waiting behaviour in wait_for_perf_to_start(), which could otherwise consume CPU while waiting for perf record to start. Since the timeout is now based on repeated sleeps, it is only approximate. Update the comments accordingly. Also make is_running() wait for exactly the documented number of tenths by changing its timeout test from -gt to the new logic, and quote tm_out in the modified code. Reviewed-by: Ian Rogers Signed-off-by: Adrian Hunter Signed-off-by: Arnaldo Carvalho de Melo

perf ftrace latency: Do not read trace files when BPF is used

2026-09-08T21:04:33+00:00

I've realized that it didn't set up the tracing files when BPF is used so poll() just returns immediately. It ends up with calling poll() unnecessarily in a loop. BPF still needs the loop to wait for the target process exiting or a signal from users. Let's use a semaphore instead. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Masami Hiramatsu Cc: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo

perf python: Fix redundant self-assignment in get_argument_count()

2026-09-08T20:57:06+00:00

In get_argument_count(), the variable code_obj is assigned to itself before being assigned the result of PyObject_GetAttrString(). This is a redundant self-assignment that appears to be a typo. Fix it by removing the redundant self-assignment. Signed-off-by: Liu Jing Signed-off-by: Arnaldo Carvalho de Melo

perf test: perf stat tests fails on s390

2026-09-08T20:54:53+00:00

The test case 'perf stat tests' fails on s390 z/VM machines. The root cause is the unsupported CPU measurement facility on z/VM. Therefore the events cycles and instructions do not exist and are unsupported. This cause the subtest Hide zero events stat test to fail. Output before: # perf test 116 116: perf stat tests : FAILED! === Test Summary === Passed main tests : 0 Passed subtests : 0 Skipped tests : 0 Failed tests : 1 List of failed tests: 116: perf stat tests # Output after: # ./perf test 116 116: perf stat tests : Ok === Test Summary === Passed main tests : 1 Passed subtests : 0 Skipped tests : 0 Failed tests : 0 # Fixes: 64724095a33fbee8 ("perf stat: Add --hide-zero-events option to suppress zero-count events") Reviewed-by: Aaron Tomlin Reviewed-by: Ian Rogers Signed-off-by: Thomas Richter Cc: Aaron Tomlin Cc: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo

perf bench futex: Define SYS_futex on 32-bit arches with 64-bit time_t

2026-09-08T20:50:39+00:00

The kernel does not provide sys_futex() on 32-bit architectures that lack a 32-bit time representation, such as riscv32. Consequently glibc does not define SYS_futex there, only SYS_futex_time64, and perf bench's futex benchmarks fail to build: bench/futex.h: In function 'futex_syscall': bench/futex.h:77:18: error: 'SYS_futex' undeclared (first use in this function) Define SYS_futex as SYS_futex_time64 when only the latter is available. The guard and its comment are taken verbatim from tools/testing/selftests/futex/include/futextest.h, where they were added by commit 04850819c65c ("selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t"), keeping the two futex userspace headers in sync. No timespec conversion helper is needed on top of this. glibc lays out struct timespec on 32-bit architectures with 64-bit time_t as { int64 tv_sec; int32 tv_nsec; 32-bit pad }, which is compatible with struct __kernel_timespec, and every futex_wait()/futex_lock_pi()/ futex_wait_requeue_pi() call site in perf bench passes a NULL timeout anyway, so no timespec ever crosses the syscall boundary here. Note that an earlier and more ambitious attempt at this was commit c1ff12dac465 ("perf bench futex: Add support for 32-bit systems with 64-bit time_t"), reverted by commit ba4026b09d83 ("Revert "perf bench futex: Add support for 32-bit systems with 64-bit time_t"") because it included linux/time_types.h, which is unavailable on older distributions. This change deliberately avoids that dependency and adds only the one guard needed to fix compilation. Reviewed-by: Ian Rogers Signed-off-by: Nylon Chen Signed-off-by: Arnaldo Carvalho de Melo