[PATCH bpf 0/2] bpftool: fix sparse logical CPU handling

[PATCH bpf 0/2] bpftool: fix sparse logical CPU handling

[Hui Su]

Per-CPU map values are stored in dense slots, while the slots correspond
to logical CPU IDs from the kernel's possible CPU mask. On sparse CPU
topologies, bpftool currently reports dense slot numbers as CPU IDs when
dumping per-CPU maps.

The prog profile command has the same assumption in a different form: it
uses the compact possible CPU count as the logical CPU range and as the
stride of its PERF_EVENT_ARRAY. This produces incorrect event keys when
logical CPU IDs are sparse.

The first patch adds a helper to enumerate logical CPU IDs from the
possible CPU mask and uses it in the map output paths. The second patch
reuses the helper for perf-event setup and uses a logical-ID span for
multi-metric event-array keys, while retaining compact userspace result
storage.

The series was tested in an arm64 QEMU guest with possible, present, and
online CPUs set to 0,2-3. Map output, including a BTF-described per-CPU
array, reports CPU IDs 0,2,3. The QEMU PMU does not provide usable
hardware profile counts; the profile test nevertheless reaches perf-event
setup in the fixed version, while the pre-fix version faults in
perf_event_alloc().

Hui Su (2):
  bpftool: Fix CPU IDs in per-CPU map output
  bpftool: Fix sparse CPU IDs in prog profile

 tools/bpf/bpftool/common.c                | 37 +++++++++++
 tools/bpf/bpftool/main.h                  |  1 +
 tools/bpf/bpftool/map.c                   | 77 ++++++++++++++++-------
 tools/bpf/bpftool/prog.c                  | 35 +++++++----
 tools/bpf/bpftool/skeleton/profiler.bpf.c |  7 ++-
 5 files changed, 121 insertions(+), 36 deletions(-)

-- 
2.54.0

[PATCH bpf 1/2] bpftool: Fix CPU IDs in per-CPU map output

[Hui Su]

bpftool uses dense per-CPU value-buffer slots when printing per-CPU map
values. It also uses the slot index as the CPU ID, which produces
incorrect labels when the possible CPU mask is sparse, such as 0,2-3.

Parse the possible CPU mask and use the corresponding logical CPU ID in
plain, JSON, and BTF-formatted output. Keep the dense slot index for
accessing the per-CPU value buffer, and propagate CPU-ID lookup errors
through map lookup output.

Tested:
- Built tools/bpf/bpftool successfully on the host.
- Booted an arm64 QEMU guest with a patched virt device tree reporting
  possible=0,2-3, present=0,2-3, and online=0,2-3.
- Compared pre-fix and fixed plain and JSON map output in that guest:
  labels changed from CPU 0,1,2 to CPU 0,2,3.
- Loaded a BTF-described per-CPU array and dumped it with the fixed
  bpftool in plain BTF and JSON formats; both formats reported CPU 0,2,3
  while preserving the three dense per-CPU values.

Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool")
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://lore.kernel.org/bpf/20260813155131.1022745-3-sh_def@163.com/
---
 tools/bpf/bpftool/common.c | 37 ++++++++++++++++++
 tools/bpf/bpftool/main.h   |  1 +
 tools/bpf/bpftool/map.c    | 77 +++++++++++++++++++++++++++-----------
 3 files changed, 93 insertions(+), 22 deletions(-)

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index ef366ccc9650..d6f35257b203 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -31,6 +31,7 @@
 #include <bpf/bpf.h>
 #include <bpf/hashmap.h>
 #include <bpf/libbpf.h> /* libbpf_num_possible_cpus */
+#include <bpf/libbpf_internal.h>
 #include <bpf/btf.h>
 #include <zlib.h>
 
@@ -655,6 +656,42 @@ unsigned int get_possible_cpus(void)
 	return cpus;
 }
 
+int get_possible_cpu_ids(int **cpu_ids)
+{
+	const char *possible_cpus_file = "/sys/devices/system/cpu/possible";
+	bool *mask = NULL;
+	int mask_sz, nr_cpus = 0;
+	int *ids = NULL;
+	int i, err;
+
+	*cpu_ids = NULL;
+
+	err = parse_cpu_mask_file(possible_cpus_file, &mask, &mask_sz);
+	if (err)
+		return err;
+
+	for (i = 0; i < mask_sz; i++)
+		nr_cpus += mask[i];
+
+	ids = calloc(nr_cpus, sizeof(*ids));
+	if (!ids) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	for (i = 0, nr_cpus = 0; i < mask_sz; i++) {
+		if (mask[i])
+			ids[nr_cpus++] = i;
+	}
+	*cpu_ids = ids;
+	ids = NULL;
+	err = nr_cpus;
+out:
+	free(ids);
+	free(mask);
+	return err;
+}
+
 static char *
 ifindex_to_name_ns(__u32 ifindex, __u32 ns_dev, __u32 ns_ino, char *buf)
 {
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 78b6e0ebb85d..6540b632a3ac 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -216,6 +216,7 @@ void print_hex_data_json(uint8_t *data, size_t len);
 
 unsigned int get_page_size(void);
 unsigned int get_possible_cpus(void);
+int get_possible_cpu_ids(int **cpu_ids);
 const char *
 ifindex_to_arch(__u32 ifindex, __u64 ns_dev, __u64 ns_ino, const char **opt);
 
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 684a8fb72414..e4e4a520401e 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -70,7 +70,7 @@ static void *alloc_value(struct bpf_map_info *info)
 
 static int do_dump_btf(const struct btf_dumper *d,
 		       struct bpf_map_info *map_info, void *key,
-		       void *value)
+		       void *value, const int *cpu_ids)
 {
 	__u32 value_id;
 	int ret = 0;
@@ -101,7 +101,7 @@ static int do_dump_btf(const struct btf_dumper *d,
 		step = round_up(map_info->value_size, 8);
 		for (i = 0; i < n; i++) {
 			jsonw_start_object(d->jw);
-			jsonw_int_field(d->jw, "cpu", i);
+			jsonw_int_field(d->jw, "cpu", cpu_ids[i]);
 			jsonw_name(d->jw, "value");
 			ret = btf_dumper_type(d, value_id, value + i * step);
 			jsonw_end_object(d->jw);
@@ -130,7 +130,8 @@ static json_writer_t *get_btf_writer(void)
 }
 
 static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
-			     unsigned char *value, struct btf *btf)
+			     unsigned char *value, struct btf *btf,
+			     const int *cpu_ids)
 {
 	jsonw_start_object(json_wtr);
 
@@ -150,7 +151,7 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
 			};
 
 			jsonw_name(json_wtr, "formatted");
-			do_dump_btf(&d, info, key, value);
+			do_dump_btf(&d, info, key, value, cpu_ids);
 		}
 	} else {
 		unsigned int i, n, step;
@@ -166,7 +167,7 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
 		for (i = 0; i < n; i++) {
 			jsonw_start_object(json_wtr);
 
-			jsonw_int_field(json_wtr, "cpu", i);
+			jsonw_int_field(json_wtr, "cpu", cpu_ids[i]);
 
 			jsonw_name(json_wtr, "value");
 			print_hex_data_json(value + i * step,
@@ -183,7 +184,7 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
 			};
 
 			jsonw_name(json_wtr, "formatted");
-			do_dump_btf(&d, info, key, value);
+			do_dump_btf(&d, info, key, value, cpu_ids);
 		}
 	}
 
@@ -245,7 +246,7 @@ print_entry_error(struct bpf_map_info *map_info, void *key, int lookup_errno)
 }
 
 static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
-			      unsigned char *value)
+			      unsigned char *value, const int *cpu_ids)
 {
 	if (!map_is_per_cpu(info->type)) {
 		bool single_line, break_names;
@@ -285,8 +286,8 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 		}
 		if (info->value_size) {
 			for (i = 0; i < n; i++) {
-				printf("value (CPU %02u):%c",
-				       i, info->value_size > 16 ? '\n' : ' ');
+				printf("value (CPU %02d):%c",
+				       cpu_ids[i], info->value_size > 16 ? '\n' : ' ');
 				fprint_hex(stdout, value + i * step,
 					   info->value_size, " ");
 				printf("\n");
@@ -742,7 +743,7 @@ static int do_show(int argc, char **argv)
 
 static int dump_map_elem(int fd, void *key, void *value,
 			 struct bpf_map_info *map_info, struct btf *btf,
-			 json_writer_t *btf_wtr)
+			 json_writer_t *btf_wtr, const int *cpu_ids)
 {
 	if (bpf_map_lookup_elem(fd, key, value)) {
 		print_entry_error(map_info, key, errno);
@@ -750,7 +751,7 @@ static int dump_map_elem(int fd, void *key, void *value,
 	}
 
 	if (json_output) {
-		print_entry_json(map_info, key, value, btf);
+		print_entry_json(map_info, key, value, btf, cpu_ids);
 	} else if (btf) {
 		struct btf_dumper d = {
 			.btf = btf,
@@ -758,9 +759,9 @@ static int dump_map_elem(int fd, void *key, void *value,
 			.is_plain_text = true,
 		};
 
-		do_dump_btf(&d, map_info, key, value);
+		do_dump_btf(&d, map_info, key, value, cpu_ids);
 	} else {
-		print_entry_plain(map_info, key, value);
+		print_entry_plain(map_info, key, value, cpu_ids);
 	}
 
 	return 0;
@@ -833,6 +834,7 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 	void *key, *value, *prev_key;
 	unsigned int num_elems = 0;
 	struct btf *btf = NULL;
+	int *cpu_ids = NULL;
 	int err;
 
 	key = malloc(info->key_size);
@@ -845,6 +847,17 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 
 	prev_key = NULL;
 
+	if (map_is_per_cpu(info->type)) {
+		err = get_possible_cpu_ids(&cpu_ids);
+		if (err < 0)
+			goto exit_free;
+		if (err != (int)get_possible_cpus()) {
+			p_err("possible CPU count mismatch");
+			err = -1;
+			goto exit_free;
+		}
+	}
+
 	if (wtr) {
 		err = get_map_kv_btf(info, &btf);
 		if (err) {
@@ -876,7 +889,7 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 				err = 0;
 			break;
 		}
-		if (!dump_map_elem(fd, key, value, info, btf, wtr))
+		if (!dump_map_elem(fd, key, value, info, btf, wtr, cpu_ids))
 			num_elems++;
 		prev_key = key;
 	}
@@ -893,6 +906,7 @@ map_dump(int fd, struct bpf_map_info *info, json_writer_t *wtr,
 exit_free:
 	free(key);
 	free(value);
+	free(cpu_ids);
 	free_map_kv_btf(btf);
 
 	return err;
@@ -1035,17 +1049,33 @@ static int do_update(int argc, char **argv)
 	return err;
 }
 
-static void print_key_value(struct bpf_map_info *info, void *key,
-			    void *value)
+static int print_key_value(struct bpf_map_info *info, void *key,
+			   void *value)
 {
 	json_writer_t *btf_wtr;
 	struct btf *btf;
+	int *cpu_ids = NULL;
+	int err = 0;
+
+	if (map_is_per_cpu(info->type)) {
+		int cpu_cnt = get_possible_cpu_ids(&cpu_ids);
+
+		if (cpu_cnt < 0) {
+			err = cpu_cnt;
+			goto out;
+		}
+		if (cpu_cnt != (int)get_possible_cpus()) {
+			p_err("possible CPU count mismatch");
+			err = -EINVAL;
+			goto out;
+		}
+	}
 
 	if (get_map_kv_btf(info, &btf))
-		return;
+		goto out;
 
 	if (json_output) {
-		print_entry_json(info, key, value, btf);
+		print_entry_json(info, key, value, btf, cpu_ids);
 	} else if (btf) {
 		/* if here json_wtr wouldn't have been initialised,
 		 * so let's create separate writer for btf
@@ -1055,7 +1085,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
 			p_info("failed to create json writer for btf. falling back to plain output");
 			free_map_kv_btf(btf);
 			btf = NULL;
-			print_entry_plain(info, key, value);
+			print_entry_plain(info, key, value, cpu_ids);
 		} else {
 			struct btf_dumper d = {
 				.btf = btf,
@@ -1063,13 +1093,16 @@ static void print_key_value(struct bpf_map_info *info, void *key,
 				.is_plain_text = true,
 			};
 
-			do_dump_btf(&d, info, key, value);
+			do_dump_btf(&d, info, key, value, cpu_ids);
 			jsonw_destroy(&btf_wtr);
 		}
 	} else {
-		print_entry_plain(info, key, value);
+		print_entry_plain(info, key, value, cpu_ids);
 	}
 	free_map_kv_btf(btf);
+out:
+	free(cpu_ids);
+	return err;
 }
 
 static int do_lookup(int argc, char **argv)
@@ -1114,7 +1147,7 @@ static int do_lookup(int argc, char **argv)
 	}
 
 	/* here means bpf_map_lookup_elem() succeeded */
-	print_key_value(&info, key, value);
+	err = print_key_value(&info, key, value);
 
 exit_free:
 	free(key);
-- 
2.54.0

[PATCH bpf 2/2] bpftool: Fix sparse CPU IDs in prog profile

[Hui Su]

bpftool prog profile currently treats the number of possible CPUs as
both the logical CPU ID range and the stride of the perf event array.
That misses valid logical CPUs when the possible CPU mask is sparse, such
as 0,2-3, and can use incorrect PERF_EVENT_ARRAY keys.

Keep the compact possible CPU count for per-CPU result buffers, while
using the actual logical CPU IDs for perf events and the maximum logical
CPU ID plus one as the metric stride in the PERF_EVENT_ARRAY. Keep the
userspace perf file descriptor index separate from the BPF map key. Do
not advance profile_perf_event_cnt for CPUs that return ENODEV, since it
tracks opened userspace perf file descriptors rather than event-array
slots.

Tested:
- Built tools/bpf/bpftool successfully on the host.
- Booted an arm64 QEMU guest with a patched virt device tree reporting
  possible=0,2-3, present=0,2-3, and online=0,2-3.
- Ran both pre-fix and fixed bpftool with cycles and instructions against
  a BTF-enabled fentry target. The pre-fix binary faulted in
  perf_event_alloc(), while the fixed binary reached perf-event setup and
  reported failure to create the instructions event on CPU 0. QEMU did
  not provide a usable hardware PMU runtime result, so no profile counts
  are claimed.

Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
Signed-off-by: Hui Su <sh_def@163.com>
Link: https://lore.kernel.org/bpf/20260813160858.1042834-3-sh_def@163.com/
---
 tools/bpf/bpftool/prog.c                  | 35 ++++++++++++++++-------
 tools/bpf/bpftool/skeleton/profiler.bpf.c |  7 +++--
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index a9f730d407a9..b1f3d1ce5f0f 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -2349,6 +2349,8 @@ static int profile_tgt_fd = -1;
 static char *profile_tgt_name;
 static int *profile_perf_events;
 static int profile_perf_event_cnt;
+static int *profile_cpu_ids;
+static int profile_cpu_id_span;
 
 static void profile_close_perf_events(struct profiler_bpf *obj)
 {
@@ -2358,10 +2360,11 @@ static void profile_close_perf_events(struct profiler_bpf *obj)
 		close(profile_perf_events[i]);
 
 	free(profile_perf_events);
+	profile_perf_events = NULL;
 	profile_perf_event_cnt = 0;
 }
 
-static int profile_open_perf_event(int mid, int cpu, int map_fd)
+static int profile_open_perf_event(int mid, int cpu, int map_key, int map_fd)
 {
 	int pmu_fd;
 
@@ -2371,15 +2374,12 @@ static int profile_open_perf_event(int mid, int cpu, int map_fd)
 		if (errno == ENODEV) {
 			p_info("cpu %d may be offline, skip %s profiling.",
 				cpu, metrics[mid].name);
-			profile_perf_event_cnt++;
 			return 0;
 		}
 		return -1;
 	}
 
-	if (bpf_map_update_elem(map_fd,
-				&profile_perf_event_cnt,
-				&pmu_fd, BPF_ANY) ||
+	if (bpf_map_update_elem(map_fd, &map_key, &pmu_fd, BPF_ANY) ||
 	    ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) {
 		close(pmu_fd);
 		return -1;
@@ -2391,7 +2391,7 @@ static int profile_open_perf_event(int mid, int cpu, int map_fd)
 
 static int profile_open_perf_events(struct profiler_bpf *obj)
 {
-	unsigned int cpu, m;
+	unsigned int cpu, m, metric_idx = 0;
 	int map_fd;
 
 	profile_perf_events = calloc(
@@ -2411,12 +2411,16 @@ static int profile_open_perf_events(struct profiler_bpf *obj)
 		if (!metrics[m].selected)
 			continue;
 		for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) {
-			if (profile_open_perf_event(m, cpu, map_fd)) {
-				p_err("failed to create event %s on cpu %u",
-				      metrics[m].name, cpu);
+			int cpu_id = profile_cpu_ids[cpu];
+			int map_key = cpu_id + metric_idx * profile_cpu_id_span;
+
+			if (profile_open_perf_event(m, cpu_id, map_key, map_fd)) {
+				p_err("failed to create event %s on cpu %d",
+				      metrics[m].name, cpu_id);
 				return -1;
 			}
 		}
+		metric_idx++;
 	}
 	return 0;
 }
@@ -2430,6 +2434,8 @@ static void profile_print_and_cleanup(void)
 
 	close(profile_tgt_fd);
 	free(profile_tgt_name);
+	free(profile_cpu_ids);
+	profile_cpu_ids = NULL;
 }
 
 static void int_exit(int signo)
@@ -2441,6 +2447,7 @@ static void int_exit(int signo)
 static int do_profile(int argc, char **argv)
 {
 	int num_metric, num_cpu, err = -1;
+	int *cpu_ids = NULL;
 	struct bpf_program *prog;
 	unsigned long duration;
 	char *endptr;
@@ -2471,11 +2478,13 @@ static int do_profile(int argc, char **argv)
 	if (num_metric <= 0)
 		goto out;
 
-	num_cpu = libbpf_num_possible_cpus();
+	num_cpu = get_possible_cpu_ids(&cpu_ids);
 	if (num_cpu <= 0) {
 		p_err("failed to identify number of CPUs");
 		goto out;
 	}
+	profile_cpu_ids = cpu_ids;
+	profile_cpu_id_span = cpu_ids[num_cpu - 1] + 1;
 
 	profile_obj = profiler_bpf__open();
 	if (!profile_obj) {
@@ -2485,9 +2494,11 @@ static int do_profile(int argc, char **argv)
 
 	profile_obj->rodata->num_cpu = num_cpu;
 	profile_obj->rodata->num_metric = num_metric;
+	profile_obj->rodata->cpu_id_span = profile_cpu_id_span;
 
 	/* adjust map sizes */
-	bpf_map__set_max_entries(profile_obj->maps.events, num_metric * num_cpu);
+	bpf_map__set_max_entries(profile_obj->maps.events,
+				 num_metric * profile_cpu_id_span);
 	bpf_map__set_max_entries(profile_obj->maps.fentry_readings, num_metric);
 	bpf_map__set_max_entries(profile_obj->maps.accum_readings, num_metric);
 	bpf_map__set_max_entries(profile_obj->maps.counts, 1);
@@ -2534,6 +2545,8 @@ static int do_profile(int argc, char **argv)
 		profiler_bpf__destroy(profile_obj);
 	close(profile_tgt_fd);
 	free(profile_tgt_name);
+	free(profile_cpu_ids);
+	profile_cpu_ids = NULL;
 	return err;
 }
 
diff --git a/tools/bpf/bpftool/skeleton/profiler.bpf.c b/tools/bpf/bpftool/skeleton/profiler.bpf.c
index f48c783cb9f7..9486498f7605 100644
--- a/tools/bpf/bpftool/skeleton/profiler.bpf.c
+++ b/tools/bpf/bpftool/skeleton/profiler.bpf.c
@@ -10,7 +10,7 @@ struct bpf_perf_event_value___local {
 	__u64 running;
 } __attribute__((preserve_access_index));
 
-/* map of perf event fds, num_cpu * num_metric entries */
+/* map of perf event fds, cpu_id_span * num_metric entries */
 struct {
 	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
 	__uint(key_size, sizeof(u32));
@@ -40,6 +40,7 @@ struct {
 
 const volatile __u32 num_cpu = 1;
 const volatile __u32 num_metric = 1;
+const volatile __u32 cpu_id_span = 1;
 #define MAX_NUM_METRICS 4
 
 SEC("fentry/XXX")
@@ -67,7 +68,7 @@ int BPF_PROG(fentry_XXX)
 		if (err)
 			return 0;
 		*(ptrs[i]) = reading;
-		key += num_cpu;
+		key += cpu_id_span;
 	}
 
 	return 0;
@@ -107,7 +108,7 @@ int BPF_PROG(fexit_XXX)
 
 	/* read all events before updating the maps, to reduce error */
 	for (i = 0; i < num_metric && i < MAX_NUM_METRICS; i++) {
-		err = bpf_perf_event_read_value(&events, cpu + i * num_cpu,
+		err = bpf_perf_event_read_value(&events, cpu + i * cpu_id_span,
 						(void *)(readings + i),
 						sizeof(*readings));
 		if (err)
-- 
2.54.0