* [PATCH v5 1/5] tracing: add refcount_final_put tracepoint
2026-08-13 3:49 [PATCH v5 0/5] tracing: add refcount_final_put tracing Eugene Mavick
@ 2026-08-13 3:49 ` Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 2/5] refcount: " Eugene Mavick
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Eugene Mavick @ 2026-08-13 3:49 UTC (permalink / raw)
To: Will Deacon, Peter Zijlstra, Boqun Feng, Mark Rutland, Gary Guo,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, Dennis Zhou, Tejun Heo, Christoph Lameter,
Dmitry Vyukov, Andrey Konovalov, Alexander Potapenko, Marco Elver,
Andrey Ryabinin
Cc: linux-kernel, linux-trace-kernel, linux-mm, kasan-dev,
Eugene Mavick
Add refcount_final_put tracepoint and related core infrastructure
refcount_final_put fires when a reference
count reaches zero and the object enters its final release path.
The tracepoint records three fields:
- caller: function that called the refcounting
function(refcount_sub_and_test, percpu_ref_put_many)
- ip: return address of trace wrapper macro call
- obj: refcount object(struct percpu_ref, refcount_t)
Signed-off-by: Eugene Mavick <m@mavick.dev>
---
include/linux/refcount_trace.h | 33 +++++++++++++++++++++++++
include/trace/events/refcount.h | 55 +++++++++++++++++++++++++++++++++++++++++
lib/Kconfig | 8 ++++++
lib/Makefile | 2 ++
lib/refcount_trace.c | 14 +++++++++++
5 files changed, 112 insertions(+)
diff --git a/include/linux/refcount_trace.h b/include/linux/refcount_trace.h
new file mode 100644
index 000000000000..6f8d0ba910f0
--- /dev/null
+++ b/include/linux/refcount_trace.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_REFCOUNT_TRACE_H
+#define _LINUX_REFCOUNT_TRACE_H
+
+#include <linux/tracepoint-defs.h>
+#include <linux/instruction_pointer.h>
+
+#ifdef CONFIG_REFCOUNT_TRACE_FINAL_PUT
+/* Declare the tracepoint so tracepoint_enabled() can be used */
+DECLARE_TRACEPOINT(refcount_final_put);
+
+/* Wrapper function implemented in lib/ref_trace.c */
+extern void do_refcount_trace_final_put(unsigned long caller, unsigned long ip, const void *obj);
+
+#define do_trace_refcount_final_put(obj) \
+ do { \
+ if (tracepoint_enabled(refcount_final_put)) \
+ do_refcount_trace_final_put(_RET_IP_, _THIS_IP_, obj); \
+ } while (0)
+
+#define do_trace_refcount_final_put_cond(cond, obj) \
+ do { \
+ if (tracepoint_enabled(refcount_final_put) && cond) \
+ do_refcount_trace_final_put(_RET_IP_, _THIS_IP_, obj); \
+ } while (0)
+
+#else /* !CONFIG_REFCOUNT_TRACE_FINAL_PUT */
+extern void do_refcount_trace_final_put(unsigned long caller, unsigned long ip, const void *obj);
+#define do_trace_refcount_final_put(obj) do { } while (0)
+#define do_trace_refcount_final_put_cond(cond, obj) do { } while (0)
+#endif
+
+#endif /* _LINUX_REFCOUNT_TRACE_H */
diff --git a/include/trace/events/refcount.h b/include/trace/events/refcount.h
new file mode 100644
index 000000000000..a4dc23aff93b
--- /dev/null
+++ b/include/trace/events/refcount.h
@@ -0,0 +1,55 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM refcount
+
+#if !defined(_TRACE_REFCOUNT_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_REFCOUNT_H
+
+#include <linux/tracepoint.h>
+
+#ifdef CONFIG_REFCOUNT_TRACE_FINAL_PUT
+
+/**
+ * refcount_final_put - trace when a reference count reaches zero
+ * @caller: return address of refcount
+ * function(refcount_sub_and_test, percpu_ref_put_many)
+ * @ip: return address of trace wrapper macro call,
+ * inlining may cause it to be something else tho
+ * @obj: refcount object(struct percpu_ref, refcount_t)
+ *
+ * Tracepoint instrumentation can be added using the do_refcount_trace_final_put
+ * macro defined in include/linux/refcount_trace.h
+ * which uses _RET_IP_ and _THIS_IP_ for caller and ip arguments respectively,
+ * thus only requiring obj arg to be supplied
+ */
+TRACE_EVENT(refcount_final_put,
+
+ TP_PROTO(unsigned long caller, unsigned long ip, const void *obj),
+
+ TP_ARGS(caller, ip, obj),
+
+ TP_STRUCT__entry(
+ __field( unsigned long, caller )
+ __field( unsigned long, ip )
+ __field( const void *, obj )
+ ),
+
+ TP_fast_assign(
+ __entry->caller = caller;
+ __entry->ip = ip;
+ __entry->obj = obj;
+ ),
+
+ TP_printk("caller=%pS ip=%pS obj=%p",
+ (void *)__entry->caller,
+ (void *)__entry->ip,
+ __entry->obj
+ )
+);
+
+#endif /* CONFIG_REFCOUNT_TRACE_FINAL_PUT */
+
+#endif /* _TRACE_REFCOUNT_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/lib/Kconfig b/lib/Kconfig
index 00a9509636c1..12bc59515a3e 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -52,6 +52,14 @@ config PACKING_KUNIT_TEST
When in doubt, say N.
+config REFCOUNT_TRACE_FINAL_PUT
+ bool "Trace final puts on multiple refcount implementations"
+ depends on TRACEPOINTS && DEBUG_KERNEL
+ help
+ Trace when a refcount implementation considers refcounted object dead.
+
+ If unsure, say N.
+
config BITREVERSE
tristate
diff --git a/lib/Makefile b/lib/Makefile
index f33a24bf1c19..e75e88f0c870 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -335,3 +335,5 @@ CONTEXT_ANALYSIS_test_context-analysis.o := y
obj-$(CONFIG_CONTEXT_ANALYSIS_TEST) += test_context-analysis.o
subdir-$(CONFIG_FORTIFY_SOURCE) += test_fortify
+
+obj-$(CONFIG_REFCOUNT_TRACE_FINAL_PUT) += refcount_trace.o
diff --git a/lib/refcount_trace.c b/lib/refcount_trace.c
new file mode 100644
index 000000000000..2476bb5f2f60
--- /dev/null
+++ b/lib/refcount_trace.c
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0
+#define CREATE_TRACE_POINTS
+#include <trace/events/refcount.h>
+#include <linux/refcount_trace.h>
+
+//Wrapper function for functions defined entirely in header files
+void do_refcount_trace_final_put(unsigned long caller,
+ unsigned long ip,
+ const void *obj)
+{
+ trace_call__refcount_final_put(caller, ip, obj);
+}
+EXPORT_SYMBOL_GPL(do_refcount_trace_final_put);
+EXPORT_TRACEPOINT_SYMBOL_GPL(refcount_final_put);
--
2.51.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 2/5] refcount: add refcount_final_put tracepoint
2026-08-13 3:49 [PATCH v5 0/5] tracing: add refcount_final_put tracing Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 1/5] tracing: add refcount_final_put tracepoint Eugene Mavick
@ 2026-08-13 3:49 ` Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 3/5] percpu-refcount: " Eugene Mavick
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Eugene Mavick @ 2026-08-13 3:49 UTC (permalink / raw)
To: Will Deacon, Peter Zijlstra, Boqun Feng, Mark Rutland, Gary Guo,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, Dennis Zhou, Tejun Heo, Christoph Lameter,
Dmitry Vyukov, Andrey Konovalov, Alexander Potapenko, Marco Elver,
Andrey Ryabinin
Cc: linux-kernel, linux-trace-kernel, linux-mm, kasan-dev,
Eugene Mavick
Add the refcount_final_put tracepoint to __refcount_sub_and_test()
and refcount_dec_if_one()
refcount_final_put fires when a reference
count reaches zero and the object enters its final release path.
refcount_final_put records three fields:
- caller: function that called the refcounting
function(refcount_sub_and_test, percpu_ref_put_many)
- ip: return address of trace wrapper macro call
- obj: refcount object(struct percpu_ref, refcount_t)
Signed-off-by: Eugene Mavick <m@mavick.dev>
---
include/linux/refcount.h | 2 ++
lib/refcount.c | 6 +++++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/linux/refcount.h b/include/linux/refcount.h
index ba7657ced281..23291a31d1be 100644
--- a/include/linux/refcount.h
+++ b/include/linux/refcount.h
@@ -107,6 +107,7 @@
#include <linux/limits.h>
#include <linux/refcount_types.h>
#include <linux/spinlock_types.h>
+#include <linux/refcount_trace.h>
struct mutex;
@@ -393,6 +394,7 @@ bool __refcount_sub_and_test(int i, refcount_t *r, int *oldp)
if (old > 0 && old == i) {
smp_acquire__after_ctrl_dep();
+ do_trace_refcount_final_put(r);
return true;
}
diff --git a/lib/refcount.c b/lib/refcount.c
index a207a8f22b3c..8b148b576503 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -7,6 +7,7 @@
#include <linux/refcount.h>
#include <linux/spinlock.h>
#include <linux/bug.h>
+#include <linux/refcount_trace.h>
#define REFCOUNT_WARN(str) WARN_ONCE(1, "refcount_t: " str ".\n")
@@ -56,7 +57,10 @@ bool refcount_dec_if_one(refcount_t *r)
{
int val = 1;
- return atomic_try_cmpxchg_release(&r->refs, &val, 0);
+ bool ret = atomic_try_cmpxchg_release(&r->refs, &val, 0);
+
+ do_trace_refcount_final_put_cond(ret, r);
+ return ret;
}
EXPORT_SYMBOL(refcount_dec_if_one);
--
2.51.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 3/5] percpu-refcount: add refcount_final_put tracepoint
2026-08-13 3:49 [PATCH v5 0/5] tracing: add refcount_final_put tracing Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 1/5] tracing: add refcount_final_put tracepoint Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 2/5] refcount: " Eugene Mavick
@ 2026-08-13 3:49 ` Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 4/5] kunit: add test for refcount_final_put Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 5/5] MAINTAINERS: add entries for refcount_final_put trace Eugene Mavick
4 siblings, 0 replies; 6+ messages in thread
From: Eugene Mavick @ 2026-08-13 3:49 UTC (permalink / raw)
To: Will Deacon, Peter Zijlstra, Boqun Feng, Mark Rutland, Gary Guo,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, Dennis Zhou, Tejun Heo, Christoph Lameter,
Dmitry Vyukov, Andrey Konovalov, Alexander Potapenko, Marco Elver,
Andrey Ryabinin
Cc: linux-kernel, linux-trace-kernel, linux-mm, kasan-dev,
Eugene Mavick
Add the refcount_final_put tracepoint to percpu_ref_put_many().
The tracepoint fires when the atomic counter reaches zero in the
atomic fallback path (after percpu_ref_kill() has been called).
refcount_final_put records three fields:
- caller: function that called the refcounting
function(refcount_sub_and_test, percpu_ref_put_many)
- ip: return address of trace wrapper macro call
- obj: refcount object(struct percpu_ref, refcount_t)
Signed-off-by: Eugene Mavick <m@mavick.dev>
---
include/linux/percpu-refcount.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index d73a1c08c3e3..244992b2f746 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -55,6 +55,7 @@
#include <linux/rcupdate.h>
#include <linux/types.h>
#include <linux/gfp.h>
+#include <linux/refcount_trace.h>
struct percpu_ref;
typedef void (percpu_ref_func_t)(struct percpu_ref *);
@@ -331,8 +332,10 @@ static inline void percpu_ref_put_many(struct percpu_ref *ref, unsigned long nr)
if (__ref_is_percpu(ref, &percpu_count))
this_cpu_sub(*percpu_count, nr);
- else if (unlikely(atomic_long_sub_and_test(nr, &ref->data->count)))
+ else if (unlikely(atomic_long_sub_and_test(nr, &ref->data->count))) {
+ do_trace_refcount_final_put(ref);
ref->data->release(ref);
+ }
rcu_read_unlock();
}
--
2.51.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 4/5] kunit: add test for refcount_final_put
2026-08-13 3:49 [PATCH v5 0/5] tracing: add refcount_final_put tracing Eugene Mavick
` (2 preceding siblings ...)
2026-08-13 3:49 ` [PATCH v5 3/5] percpu-refcount: " Eugene Mavick
@ 2026-08-13 3:49 ` Eugene Mavick
2026-08-13 3:49 ` [PATCH v5 5/5] MAINTAINERS: add entries for refcount_final_put trace Eugene Mavick
4 siblings, 0 replies; 6+ messages in thread
From: Eugene Mavick @ 2026-08-13 3:49 UTC (permalink / raw)
To: Will Deacon, Peter Zijlstra, Boqun Feng, Mark Rutland, Gary Guo,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, Dennis Zhou, Tejun Heo, Christoph Lameter,
Dmitry Vyukov, Andrey Konovalov, Alexander Potapenko, Marco Elver,
Andrey Ryabinin
Cc: linux-kernel, linux-trace-kernel, linux-mm, kasan-dev,
Eugene Mavick
Add a KUnit test suite for the refcount_final_put tracepoint.
The test registers a probe function and triggers both refcount_t and
percpu_ref final put paths, verifying that the tracepoint fires
correctly and that the recorded fields match expected values.
Signed-off-by: Eugene Mavick <m@mavick.dev>
---
lib/Kconfig | 10 +++
lib/tests/Makefile | 1 +
lib/tests/refcount_trace_kunit.c | 141 +++++++++++++++++++++++++++++++++++++++
3 files changed, 152 insertions(+)
diff --git a/lib/Kconfig b/lib/Kconfig
index 12bc59515a3e..ee12e8f95158 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -60,6 +60,16 @@ config REFCOUNT_TRACE_FINAL_PUT
If unsure, say N.
+config REFCOUNT_TRACE_KUNIT_TEST
+ tristate "refcount trace kunit test" if !KUNIT_ALL_TESTS
+ depends on REFCOUNT_TRACE_FINAL_PUT && KUNIT && TRACEPOINTS
+ default KUNIT_ALL_TESTS
+ help
+ This option enables the KUnit test suite for the refcount_final_put
+ tracepoint.
+
+ If unsure, say N.
+
config BITREVERSE
tristate
diff --git a/lib/tests/Makefile b/lib/tests/Makefile
index 7e9c2fa52e35..1ef41c0b6a0c 100644
--- a/lib/tests/Makefile
+++ b/lib/tests/Makefile
@@ -57,5 +57,6 @@ obj-$(CONFIG_USERCOPY_KUNIT_TEST) += usercopy_kunit.o
obj-$(CONFIG_UTIL_MACROS_KUNIT) += util_macros_kunit.o
obj-$(CONFIG_RATELIMIT_KUNIT_TEST) += test_ratelimit.o
obj-$(CONFIG_UUID_KUNIT_TEST) += uuid_kunit.o
+obj-$(CONFIG_REFCOUNT_TRACE_KUNIT_TEST) += refcount_trace_kunit.o
obj-$(CONFIG_TEST_RUNTIME_MODULE) += module/
diff --git a/lib/tests/refcount_trace_kunit.c b/lib/tests/refcount_trace_kunit.c
new file mode 100644
index 000000000000..a57e9e4cfa42
--- /dev/null
+++ b/lib/tests/refcount_trace_kunit.c
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/kernel.h>
+#include <kunit/test.h>
+#include <linux/compiler_attributes.h>
+#include <linux/wait_bit.h>
+#include <linux/instruction_pointer.h>
+#include <linux/kallsyms.h>
+#include <linux/jiffies.h>
+#include <linux/percpu-refcount.h>
+#include <linux/refcount.h>
+#include <linux/types.h>
+#include <linux/atomic.h>
+#include <trace/events/refcount.h>
+
+struct data {
+ unsigned long caller;
+ unsigned long ip;
+ const void *obj;
+ atomic_t count;
+};
+
+struct data capture;
+
+const void *chk_obj;
+
+#define test_init() \
+ do { \
+ KUNIT_EXPECT_FALSE( \
+ test, register_trace_refcount_final_put(probe, NULL)); \
+ \
+ atomic_set_release(&capture.count, 0); \
+ \
+ chk_obj = &obj; \
+ } while (0)
+
+
+#define test_exit() \
+ do { \
+ /* wait for probe completion */ \
+ int notimeout = wait_var_event_timeout( \
+ &capture.count, \
+ atomic_read_acquire(&capture.count), \
+ msecs_to_jiffies(10000) \
+ ); \
+ \
+ unregister_trace_refcount_final_put(probe, NULL); \
+ tracepoint_synchronize_unregister(); \
+ \
+ KUNIT_ASSERT_TRUE(test, notimeout); \
+ \
+ KUNIT_EXPECT_EQ(test, atomic_read_acquire(&capture.count), 1); \
+ \
+ KUNIT_EXPECT_TRUE(test, __kernel_text_address(capture.caller)); \
+ KUNIT_EXPECT_TRUE(test, __kernel_text_address(capture.ip)); \
+ \
+ KUNIT_EXPECT_PTR_EQ(test, capture.obj, &obj); \
+ } while (0)
+
+static void probe(
+ void *ignore,
+ unsigned long caller,
+ unsigned long ip,
+ const void *obj)
+{
+ //prevent non test func final_puts from changing captured values
+ if (chk_obj != obj)
+ return;
+
+ capture.caller = caller;
+ capture.ip = ip;
+ capture.obj = obj;
+
+ atomic_inc_return_release(&capture.count); //increase count
+}
+
+static void test_refcount_sub_and_test(struct kunit *test)
+{
+ refcount_t obj;
+
+ test_init();
+ refcount_set(&obj, 2);
+
+ KUNIT_EXPECT_FALSE(test, refcount_dec_and_test(&obj));
+ KUNIT_EXPECT_TRUE(test, refcount_dec_and_test(&obj));
+
+ test_exit();
+}
+
+static void test_refcount_dec_if_one(struct kunit *test)
+{
+ refcount_t obj;
+
+ test_init();
+ refcount_set(&obj, 2);
+
+ KUNIT_EXPECT_FALSE(test, refcount_dec_and_test(&obj));
+ KUNIT_EXPECT_TRUE(test, refcount_dec_if_one(&obj));
+
+ test_exit();
+}
+static void dummy_release(struct percpu_ref *ref) {}
+
+static void test_percpu_ref_put_many(struct kunit *test)
+{
+ struct percpu_ref obj;
+
+ test_init();
+
+ KUNIT_ASSERT_FALSE(test, percpu_ref_init(&obj, dummy_release, 0, GFP_KERNEL));
+
+ percpu_ref_get(&obj);
+ percpu_ref_get(&obj);
+
+ percpu_ref_put(&obj);
+ percpu_ref_put(&obj);
+
+ percpu_ref_switch_to_atomic_sync(&obj);
+
+ percpu_ref_put(&obj);
+
+ test_exit();
+ percpu_ref_exit(&obj);
+}
+
+static struct kunit_case refcount_trace_test_cases[] = {
+ KUNIT_CASE(test_refcount_sub_and_test),
+ KUNIT_CASE(test_refcount_dec_if_one),
+ KUNIT_CASE(test_percpu_ref_put_many),
+ {}
+};
+
+static struct kunit_suite refcount_trace_test_suite = {
+ .name = "refcount-trace",
+ .test_cases = refcount_trace_test_cases
+};
+
+kunit_test_suites(&refcount_trace_test_suite);
+
+MODULE_AUTHOR("Eugene Mavick <m@mavick.dev>");
+MODULE_DESCRIPTION("KUnit test for ref_trace");
+MODULE_LICENSE("GPL");
--
2.51.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 5/5] MAINTAINERS: add entries for refcount_final_put trace
2026-08-13 3:49 [PATCH v5 0/5] tracing: add refcount_final_put tracing Eugene Mavick
` (3 preceding siblings ...)
2026-08-13 3:49 ` [PATCH v5 4/5] kunit: add test for refcount_final_put Eugene Mavick
@ 2026-08-13 3:49 ` Eugene Mavick
4 siblings, 0 replies; 6+ messages in thread
From: Eugene Mavick @ 2026-08-13 3:49 UTC (permalink / raw)
To: Will Deacon, Peter Zijlstra, Boqun Feng, Mark Rutland, Gary Guo,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Andrew Morton, Dennis Zhou, Tejun Heo, Christoph Lameter,
Dmitry Vyukov, Andrey Konovalov, Alexander Potapenko, Marco Elver,
Andrey Ryabinin
Cc: linux-kernel, linux-trace-kernel, linux-mm, kasan-dev,
Eugene Mavick
Add new files added in the patch series to MAINTAINERS
Signed-off-by: Eugene Mavick <m@mavick.dev>
---
MAINTAINERS | 3 +++
1 file changed, 3 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 10e8253181d3..c37e4cd0e4ff 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4210,7 +4210,10 @@ S: Maintained
F: Documentation/atomic_*.txt
F: arch/*/include/asm/atomic*.h
F: include/*/atomic*.h
+F: include/linux/refcount_trace.h
F: include/linux/refcount.h
+F: lib/refcount_trace.c
+F: lib/tests/refcount_trace_kunit.c
F: scripts/atomic/
F: rust/kernel/sync/atomic.rs
F: rust/kernel/sync/atomic/
--
2.51.2
^ permalink raw reply related [flat|nested] 6+ messages in thread