[PATCH bpf-next] bpftool: Search for tracefs at /sys/kernel/tracing first

[PATCH bpf-next] bpftool: Search for tracefs at /sys/kernel/tracing first

[Quentin Monnet]

With "bpftool prog tracelog", bpftool prints messages from the trace
pipe. To do so, it first needs to find the tracefs mount point to open
the pipe. Bpftool looks at a few "default" locations, including
/sys/kernel/debug/tracing and /sys/kernel/tracing.

Some of these locations, namely /tracing and /trace, are not standard.
They are in the list because some users used to hardcode the tracing
directory to short names; but we have no compelling reason to look at
these locations. If we fail to find the tracefs at the default
locations, we have an additional step to find it by parsing /proc/mounts
anyway, so it's safe to remove these entries from the list of default
locations to check.

Additionally, Alexei reports that looking for the tracefs at
/sys/kernel/debug/tracing may automatically mount the file system under
that location, and generate a kernel log message telling that
auto-mounting there is deprecated. To avoid this message, let's swap the
order for checking the potential mount points: try /sys/kernel/tracing
first, which should be the standard location nowadays. The kernel log
message may still appear if the tracefs is not mounted on
/sys/kernel/tracing when we run bpftool.

Reported-by: Alexei Starovoitov <ast@kernel.org>
Closes: https://lore.kernel.org/r/CAADnVQLcMi5YQhZKsU4z3S2uVUAGu_62C33G2Zx_ruG3uXa-Ug@mail.gmail.com/
Signed-off-by: Quentin Monnet <qmo@kernel.org>
---
 tools/bpf/bpftool/tracelog.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/tools/bpf/bpftool/tracelog.c b/tools/bpf/bpftool/tracelog.c
index 31d806e3bdaa..49828a4f60c2 100644
--- a/tools/bpf/bpftool/tracelog.c
+++ b/tools/bpf/bpftool/tracelog.c
@@ -57,10 +57,8 @@ find_tracefs_mnt_single(unsigned long magic, char *mnt, const char *mntpt)
 static bool get_tracefs_pipe(char *mnt)
 {
 	static const char * const known_mnts[] = {
-		"/sys/kernel/debug/tracing",
 		"/sys/kernel/tracing",
-		"/tracing",
-		"/trace",
+		"/sys/kernel/debug/tracing",
 	};
 	const char *pipe_name = "/trace_pipe";
 	const char *fstype = "tracefs";
@@ -96,11 +94,11 @@ static bool get_tracefs_pipe(char *mnt)
 
 	p_info("could not find tracefs, attempting to mount it now");
 	/* Most of the time, tracefs is automatically mounted by debugfs at
-	 * /sys/kernel/debug/tracing when we try to access it. If we could not
+	 * /sys/kernel/tracing when we try to access it. If we could not
 	 * find it, it is likely that debugfs is not mounted. Let's give one
 	 * attempt at mounting just tracefs at /sys/kernel/tracing.
 	 */
-	strcpy(mnt, known_mnts[1]);
+	strcpy(mnt, known_mnts[0]);
 	if (mount_tracefs(mnt))
 		return false;
 
-- 
2.43.0

Re: [PATCH bpf-next] bpftool: Search for tracefs at /sys/kernel/tracing first

[Daniel Borkmann]

On 9/12/25 12:43 PM, Quentin Monnet wrote:
[...]
> diff --git a/tools/bpf/bpftool/tracelog.c b/tools/bpf/bpftool/tracelog.c
> index 31d806e3bdaa..49828a4f60c2 100644
> --- a/tools/bpf/bpftool/tracelog.c
> +++ b/tools/bpf/bpftool/tracelog.c
> @@ -57,10 +57,8 @@ find_tracefs_mnt_single(unsigned long magic, char *mnt, const char *mntpt)
>   static bool get_tracefs_pipe(char *mnt)
>   {
>   	static const char * const known_mnts[] = {
> -		"/sys/kernel/debug/tracing",
>   		"/sys/kernel/tracing",
> -		"/tracing",
> -		"/trace",
> +		"/sys/kernel/debug/tracing",
>   	};
>   	const char *pipe_name = "/trace_pipe";
>   	const char *fstype = "tracefs";
> @@ -96,11 +94,11 @@ static bool get_tracefs_pipe(char *mnt)
>   
>   	p_info("could not find tracefs, attempting to mount it now");
>   	/* Most of the time, tracefs is automatically mounted by debugfs at
> -	 * /sys/kernel/debug/tracing when we try to access it. If we could not
> +	 * /sys/kernel/tracing when we try to access it. If we could not
>   	 * find it, it is likely that debugfs is not mounted. Let's give one

nit: Should this comment be tweaked further, or maybe even removed completely
given the now stale references to debugfs there?

>   	 * attempt at mounting just tracefs at /sys/kernel/tracing.
>   	 */
> -	strcpy(mnt, known_mnts[1]);
> +	strcpy(mnt, known_mnts[0]);
>   	if (mount_tracefs(mnt))
>   		return false;
>   

Re: [PATCH bpf-next] bpftool: Search for tracefs at /sys/kernel/tracing first

[Quentin Monnet]

2025-09-15 13:33 UTC+0200 ~ Daniel Borkmann <daniel@iogearbox.net>
> On 9/12/25 12:43 PM, Quentin Monnet wrote:
> [...]
>> diff --git a/tools/bpf/bpftool/tracelog.c b/tools/bpf/bpftool/tracelog.c
>> index 31d806e3bdaa..49828a4f60c2 100644
>> --- a/tools/bpf/bpftool/tracelog.c
>> +++ b/tools/bpf/bpftool/tracelog.c
>> @@ -57,10 +57,8 @@ find_tracefs_mnt_single(unsigned long magic, char
>> *mnt, const char *mntpt)
>>   static bool get_tracefs_pipe(char *mnt)
>>   {
>>       static const char * const known_mnts[] = {
>> -        "/sys/kernel/debug/tracing",
>>           "/sys/kernel/tracing",
>> -        "/tracing",
>> -        "/trace",
>> +        "/sys/kernel/debug/tracing",
>>       };
>>       const char *pipe_name = "/trace_pipe";
>>       const char *fstype = "tracefs";
>> @@ -96,11 +94,11 @@ static bool get_tracefs_pipe(char *mnt)
>>         p_info("could not find tracefs, attempting to mount it now");
>>       /* Most of the time, tracefs is automatically mounted by debugfs at
>> -     * /sys/kernel/debug/tracing when we try to access it. If we
>> could not
>> +     * /sys/kernel/tracing when we try to access it. If we could not
>>        * find it, it is likely that debugfs is not mounted. Let's give
>> one
> 
> nit: Should this comment be tweaked further, or maybe even removed
> completely
> given the now stale references to debugfs there?


Hi Daniel! Re-reading it, I realise my change for the comment is not
even correct, /sys/kernel/tracing is not mounted automatically. So yes,
I'll send a v2 to remove it. Thanks for the review!

Quentin