[PATCH bpf-next v2] bpftool: Search for tracefs at /sys/kernel/tracing first

[PATCH bpf-next v2] bpftool: Search for tracefs at /sys/kernel/tracing first

[Quentin Monnet]

With "bpftool prog tracelog", bpftool prints messages from the trace
pipe. To do so, it first needs to find the tracefs mount point to open
the pipe. Bpftool looks at a few "default" locations, including
/sys/kernel/debug/tracing and /sys/kernel/tracing.

Some of these locations, namely /tracing and /trace, are not standard.
They are in the list because some users used to hardcode the tracing
directory to short names; but we have no compelling reason to look at
these locations. If we fail to find the tracefs at the default
locations, we have an additional step to find it by parsing /proc/mounts
anyway, so it's safe to remove these entries from the list of default
locations to check.

Additionally, Alexei reports that looking for the tracefs at
/sys/kernel/debug/tracing may automatically mount the file system under
that location, and generate a kernel log message telling that
auto-mounting there is deprecated. To avoid this message, let's swap the
order for checking the potential mount points: try /sys/kernel/tracing
first, which should be the standard location nowadays. The kernel log
message may still appear if the tracefs is not mounted on
/sys/kernel/tracing when we run bpftool.

Reported-by: Alexei Starovoitov <ast@kernel.org>
Closes: https://lore.kernel.org/r/CAADnVQLcMi5YQhZKsU4z3S2uVUAGu_62C33G2Zx_ruG3uXa-Ug@mail.gmail.com/
Signed-off-by: Quentin Monnet <qmo@kernel.org>
---
v2: Remove outdated comment entirely
---
 tools/bpf/bpftool/tracelog.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/tools/bpf/bpftool/tracelog.c b/tools/bpf/bpftool/tracelog.c
index 31d806e3bdaa..573a8d99f009 100644
--- a/tools/bpf/bpftool/tracelog.c
+++ b/tools/bpf/bpftool/tracelog.c
@@ -57,10 +57,8 @@ find_tracefs_mnt_single(unsigned long magic, char *mnt, const char *mntpt)
 static bool get_tracefs_pipe(char *mnt)
 {
 	static const char * const known_mnts[] = {
-		"/sys/kernel/debug/tracing",
 		"/sys/kernel/tracing",
-		"/tracing",
-		"/trace",
+		"/sys/kernel/debug/tracing",
 	};
 	const char *pipe_name = "/trace_pipe";
 	const char *fstype = "tracefs";
@@ -95,12 +93,7 @@ static bool get_tracefs_pipe(char *mnt)
 		return false;
 
 	p_info("could not find tracefs, attempting to mount it now");
-	/* Most of the time, tracefs is automatically mounted by debugfs at
-	 * /sys/kernel/debug/tracing when we try to access it. If we could not
-	 * find it, it is likely that debugfs is not mounted. Let's give one
-	 * attempt at mounting just tracefs at /sys/kernel/tracing.
-	 */
-	strcpy(mnt, known_mnts[1]);
+	strcpy(mnt, known_mnts[0]);
 	if (mount_tracefs(mnt))
 		return false;
 
-- 
2.43.0

Re: [PATCH bpf-next v2] bpftool: Search for tracefs at /sys/kernel/tracing first

[Daniel Borkmann]

On 9/15/25 3:42 PM, Quentin Monnet wrote:
> With "bpftool prog tracelog", bpftool prints messages from the trace
> pipe. To do so, it first needs to find the tracefs mount point to open
> the pipe. Bpftool looks at a few "default" locations, including
> /sys/kernel/debug/tracing and /sys/kernel/tracing.
> 
> Some of these locations, namely /tracing and /trace, are not standard.
> They are in the list because some users used to hardcode the tracing
> directory to short names; but we have no compelling reason to look at
> these locations. If we fail to find the tracefs at the default
> locations, we have an additional step to find it by parsing /proc/mounts
> anyway, so it's safe to remove these entries from the list of default
> locations to check.
> 
> Additionally, Alexei reports that looking for the tracefs at
> /sys/kernel/debug/tracing may automatically mount the file system under
> that location, and generate a kernel log message telling that
> auto-mounting there is deprecated. To avoid this message, let's swap the
> order for checking the potential mount points: try /sys/kernel/tracing
> first, which should be the standard location nowadays. The kernel log
> message may still appear if the tracefs is not mounted on
> /sys/kernel/tracing when we run bpftool.
> 
> Reported-by: Alexei Starovoitov <ast@kernel.org>
> Closes: https://lore.kernel.org/r/CAADnVQLcMi5YQhZKsU4z3S2uVUAGu_62C33G2Zx_ruG3uXa-Ug@mail.gmail.com/
> Signed-off-by: Quentin Monnet <qmo@kernel.org>

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Re: [PATCH bpf-next v2] bpftool: Search for tracefs at /sys/kernel/tracing first

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 15 Sep 2025 14:42:09 +0100 you wrote:
> With "bpftool prog tracelog", bpftool prints messages from the trace
> pipe. To do so, it first needs to find the tracefs mount point to open
> the pipe. Bpftool looks at a few "default" locations, including
> /sys/kernel/debug/tracing and /sys/kernel/tracing.
> 
> Some of these locations, namely /tracing and /trace, are not standard.
> They are in the list because some users used to hardcode the tracing
> directory to short names; but we have no compelling reason to look at
> these locations. If we fail to find the tracefs at the default
> locations, we have an additional step to find it by parsing /proc/mounts
> anyway, so it's safe to remove these entries from the list of default
> locations to check.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2] bpftool: Search for tracefs at /sys/kernel/tracing first
    https://git.kernel.org/bpf/bpf-next/c/32d376610bdf

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html