Re: [PATCH v7 27/59] perf syscall-counts: Port syscall-counts to use python module

sashiko-bot
2026-04-25T23:09:37Z

Sashiko AI review found 2 potential issue(s):
- [Medium] Exact string matching for `raw_syscalls:sys_enter` fails when event modifiers are used.
- [Medium] Incorrect thread lookup using process ID instead of thread ID causes wrong `comm` resolution.
--

commit e1c06b28a740c4df695988f86705f8c023b5bea3
Author: Ian Rogers <irogers@google.com>

perf syscall-counts: Port syscall-counts to use python module

Rewrite tools/perf/scripts/python/syscall-counts.py to use the python
module and various style changes. By avoiding the overheads in the
perf script execution the performance improves by more than 4x.

> diff --git a/tools/perf/python/syscall-counts.py b/tools/perf/python/syscall-counts.py
> new file mode 100755
> index 000000000000..ef2bd8c7b24c
> --- /dev/null
> +++ b/tools/perf/python/syscall-counts.py

[ ... ]

> +def process_event(sample):
> + """Process a single sample event."""
> + event_name = str(sample.evsel)
> + if event_name == "evsel(raw_syscalls:sys_enter)":

Will this exact string match fail if the event is recorded with a modifier?

If the event has a modifier like :k, str(sample.evsel) will include it
(e.g., evsel(raw_syscalls:sys_enter:k)). This would cause the exact equality
check to fail, and the events would be silently dropped, unlike the
subsequent startswith check for evsel(syscalls:sys_enter_ which correctly
handles suffixes.

> + sc_id = getattr(sample, "id", -1)
> + elif event_name.startswith("evsel(syscalls:sys_enter_"):
> + sc_id = getattr(sample, "__syscall_nr", None)
> + if sc_id is None:
> + sc_id = getattr(sample, "nr", -1)
> + else:
> + return
> +
> + if sc_id == -1:
> + return
> +
> + comm = "unknown"
> + try:
> + if session:
> + proc = session.find_thread(sample.sample_pid)

Does passing the process ID here misattribute events from child threads?

In perf, sample.pid (or sample_pid) represents the thread group leader ID
(TGID/process ID), while sample.tid represents the actual thread ID.

Passing the process ID means the script retrieves the comm of the main thread,
misattributing events from child threads that may have distinct names set via
prctl(PR_SET_NAME).

Should this use the thread ID (e.g., sample.sample_tid) to accurately resolve
the thread and its comm?

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260425224951.174663-1-irogers@google.com?part=27