* [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming
2026-10-14 16:14 [PATCH perf-tools-next v4 0/5] perf ftrace: Support inlined functions and display enhancements in function graph tracer Aaron Tomlin
@ 2026-10-14 16:14 ` Aaron Tomlin
2026-10-14 16:26 ` sashiko-bot
2026-10-14 16:14 ` [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments Aaron Tomlin
` (3 subsequent siblings)
4 siblings, 1 reply; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 16:14 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
atomlin, linux-perf-users, linux-kernel
In __cmd_ftrace(), incoming trace data from trace_pipe was historically
buffered in a fixed 4096-byte array allocated directly on the stack
frame. Furthermore, reads were written directly to stdout via fwrite()
in arbitrary chunk sizes, rather than as discrete, well-delimited
trace lines.
Refactor __cmd_ftrace() to employ dynamic heap allocation for the read
buffer alongside a dynamic struct strbuf to accumulate streamed
characters into whole lines. Pre-allocating the strbuf ensures that
line processing incurs zero heap reallocations during steady-state
polling, while the stack frame of __cmd_ftrace() is reduced by over 96%
(down to ~160 bytes). Robust error and EOF detection on stdout and the
trace stream ensures polling terminates cleanly upon pipeline or pager
exit.
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
tools/perf/builtin-ftrace.c | 65 +++++++++++++++++++++++++++++--------
1 file changed, 52 insertions(+), 13 deletions(-)
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index 6017493ff179..efd5343dc9ad 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -41,7 +41,10 @@
#include "util/units.h"
#include "util/parse-sublevel-options.h"
+#include "util/strbuf.h"
+
#define DEFAULT_TRACER "function_graph"
+#define TRACE_BUF_SIZE 4096
static volatile sig_atomic_t workload_exec_errno;
static volatile sig_atomic_t done;
@@ -738,7 +741,8 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
{
char *trace_file;
int trace_fd;
- char buf[4096];
+ char *buf = NULL;
+ struct strbuf linebuf = STRBUF_INIT;
struct pollfd pollfd = {
.events = POLLIN,
};
@@ -767,10 +771,18 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
setup_pager();
+ buf = malloc(TRACE_BUF_SIZE);
+ if (!buf) {
+ pr_err("failed to allocate trace buffer\n");
+ goto out_reset;
+ }
+ strbuf_init(&linebuf, 512);
+ strbuf_setlen(&linebuf, 0);
+
trace_file = get_tracing_instance_file("trace_pipe");
if (!trace_file) {
pr_err("failed to open trace_pipe\n");
- goto out_reset;
+ goto out_free;
}
trace_fd = open(trace_file, O_RDONLY);
@@ -779,7 +791,7 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
if (trace_fd < 0) {
pr_err("failed to open trace_pipe\n");
- goto out_reset;
+ goto out_free;
}
fcntl(trace_fd, F_SETFL, O_NONBLOCK);
@@ -810,20 +822,30 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
break;
if (pollfd.revents & POLLIN) {
- int n = read(trace_fd, buf, sizeof(buf));
- if (n < 0)
- break;
- if (fwrite(buf, n, 1, stdout) != 1)
+ int n = read(trace_fd, buf, TRACE_BUF_SIZE);
+
+ if (n <= 0)
break;
+ for (int i = 0; i < n; i++) {
+ if (buf[i] == '\n') {
+ if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
+ break;
+ strbuf_setlen(&linebuf, 0);
+ } else {
+ if (strbuf_addch(&linebuf, buf[i]) < 0)
+ goto out_close_fd;
+ }
+ }
/* flush output since stdout is in full buffering mode due to pager */
- fflush(stdout);
+ if (fflush(stdout) < 0 || ferror(stdout))
+ break;
}
}
write_tracing_file("tracing_on", "0");
if (workload_exec_errno) {
- const char *emsg = str_error_r(workload_exec_errno, buf, sizeof(buf));
+ const char *emsg = str_error_r(workload_exec_errno, buf, TRACE_BUF_SIZE);
/* flush stdout first so below error msg appears at the end. */
fflush(stdout);
pr_err("workload failed: %s\n", emsg);
@@ -831,16 +853,33 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
}
/* read remaining buffer contents */
- while (true) {
- int n = read(trace_fd, buf, sizeof(buf));
+ while (!ferror(stdout)) {
+ int n = read(trace_fd, buf, TRACE_BUF_SIZE);
+
if (n <= 0)
break;
- if (fwrite(buf, n, 1, stdout) != 1)
- break;
+ for (int i = 0; i < n; i++) {
+ if (buf[i] == '\n') {
+ if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
+ break;
+ strbuf_setlen(&linebuf, 0);
+ } else {
+ if (strbuf_addch(&linebuf, buf[i]) < 0)
+ goto out_close_fd;
+ }
+ }
+ }
+
+ if (!ferror(stdout) && linebuf.len > 0) {
+ fprintf(stdout, "%s\n", linebuf.buf);
+ strbuf_setlen(&linebuf, 0);
}
out_close_fd:
close(trace_fd);
+out_free:
+ free(buf);
+ strbuf_release(&linebuf);
out_reset:
exit_tracing_instance();
out:
--
2.55.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming
2026-10-14 16:14 ` [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming Aaron Tomlin
@ 2026-10-14 16:26 ` sashiko-bot
2026-10-14 17:41 ` Aaron Tomlin
0 siblings, 1 reply; 13+ messages in thread
From: sashiko-bot @ 2026-10-14 16:26 UTC (permalink / raw)
To: Aaron Tomlin; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf: premature termination on EAGAIN during ftrace polling
--
commit 0da8f6d83b353c321a754b6791e275b195595b54
Author: Aaron Tomlin <atomlin@atomlin.com>
perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming
This commit optimizes __cmd_ftrace() by replacing a fixed stack buffer
with dynamic heap allocation and a strbuf to accumulate streamed characters
into whole lines. This reduces stack usage significantly and adds error
and EOF detection on stdout and the trace stream.
> diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
> index 6017493ff1797..efd5343dc9adc 100644
> --- a/tools/perf/builtin-ftrace.c
> +++ b/tools/perf/builtin-ftrace.c
[ ... ]
> @@ -810,20 +822,30 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
> break;
>
> if (pollfd.revents & POLLIN) {
> - int n = read(trace_fd, buf, sizeof(buf));
> - if (n < 0)
> - break;
> - if (fwrite(buf, n, 1, stdout) != 1)
> + int n = read(trace_fd, buf, TRACE_BUF_SIZE);
> +
> + if (n <= 0)
> break;
[Severity: Medium]
Since trace_pipe is opened in O_NONBLOCK mode, can this lead to premature
termination of the perf ftrace tracing session?
If a spurious wakeup occurs for poll(), or if a non-fatal signal interrupts
the syscall, read() returns -1 with errno == EAGAIN or EINTR. Unconditionally
breaking out of the loop here stops tracing instead of retrying the read.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161457.373253-1-atomlin@atomlin.com?part=1
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming
2026-10-14 16:26 ` sashiko-bot
@ 2026-10-14 17:41 ` Aaron Tomlin
0 siblings, 0 replies; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 17:41 UTC (permalink / raw)
To: sashiko-reviews; +Cc: linux-perf-users
On Wed, Oct 14, 2026 at 04:26:52PM +0000, sashiko-bot@kernel.org wrote:
> [Severity: Medium]
> Since trace_pipe is opened in O_NONBLOCK mode, can this lead to premature
> termination of the perf ftrace tracing session?
>
> If a spurious wakeup occurs for poll(), or if a non-fatal signal
> interrupts the syscall, read() returns -1 with errno == EAGAIN or EINTR.
> Unconditionally breaking out of the loop here stops tracing instead of
> retrying the read.
Yes. Because trace_fd is in O_NONBLOCK mode, spurious wakeups from poll()
can result in read() returning -1 with EAGAIN or EWOULDBLOCK, and non-fatal
signals cause read() or poll() to return -1 with EINTR. Unconditionally
breaking on (n <= 0) aborted tracing prematurely. I will address this in
the next iteration.
--
Aaron Tomlin
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments
2026-10-14 16:14 [PATCH perf-tools-next v4 0/5] perf ftrace: Support inlined functions and display enhancements in function graph tracer Aaron Tomlin
2026-10-14 16:14 ` [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming Aaron Tomlin
@ 2026-10-14 16:14 ` Aaron Tomlin
2026-10-14 16:24 ` sashiko-bot
2026-10-14 16:14 ` [PATCH perf-tools-next v4 3/5] perf ftrace: Support display of inlined functions in function graph tracer Aaron Tomlin
` (2 subsequent siblings)
4 siblings, 1 reply; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 16:14 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
atomlin, linux-perf-users, linux-kernel
When tracing with the Linux kernel's function graph tracer, enabling
funcgraph-retaddr records the return address of each function entry as
a comment in the trace stream (e.g. /* <-load_elf_phdrs+0x6c/0xb0 */).
While valuable for tracing execution origins, these trailing comments
can add considerable visual clutter to the call graph, particularly
when examining deeply nested call trees or when synthesising higher-level
abstractions.
Introduce support for filtering out return address comments from
function graph trace output. Provide a standalone --filter-retaddr
flag.
Key aspects of this implementation:
1. Return address parsing and filtering
Implement ftrace_filter_retaddr() in tools/perf/util/ftrace.c
to locate return address comments and strip them in-place with
memmove(3).
Additionally, introduce ftrace_parse_retaddr() to parse caller
symbol names and offsets across diverse output styles (standard
format, return values, and bracketed addresses), establishing
the parsing foundation for subsequent inlined callchain
resolution.
2. Command-line interface
Expose --filter-retaddr in
tools/perf/builtin-ftrace.c, updating the documentation in
tools/perf/Documentation/perf-ftrace.txt accordingly.
3. Automated verification
Add a dedicated unit test suite ("Ftrace return address
processing") in tools/perf/tests/ftrace.c to validate comment
parsing and string filtering across all supported formats.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
tools/perf/Documentation/perf-ftrace.txt | 4 ++
tools/perf/builtin-ftrace.c | 8 +++
tools/perf/tests/Build | 1 +
tools/perf/tests/builtin-test.c | 1 +
tools/perf/tests/ftrace.c | 80 ++++++++++++++++++++++
tools/perf/tests/tests.h | 1 +
tools/perf/util/Build | 1 +
tools/perf/util/ftrace.c | 87 ++++++++++++++++++++++++
tools/perf/util/ftrace.h | 5 ++
9 files changed, 188 insertions(+)
create mode 100644 tools/perf/tests/ftrace.c
create mode 100644 tools/perf/util/ftrace.c
diff --git a/tools/perf/Documentation/perf-ftrace.txt b/tools/perf/Documentation/perf-ftrace.txt
index 3f3808e513fe..e8105083e67c 100644
--- a/tools/perf/Documentation/perf-ftrace.txt
+++ b/tools/perf/Documentation/perf-ftrace.txt
@@ -134,6 +134,10 @@ OPTIONS for 'perf ftrace trace'
- depth=<n> - Set max depth for function graph tracer to follow.
- tail - Print function name at the end.
+--filter-retaddr::
+ Filter out function return address comments (`/* <-caller+offset */`)
+ from function_graph output.
+
OPTIONS for 'perf ftrace latency'
---------------------------------
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index efd5343dc9ad..b8ab76912a0e 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -828,6 +828,8 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
break;
for (int i = 0; i < n; i++) {
if (buf[i] == '\n') {
+ if (ftrace->filter_retaddr)
+ ftrace_filter_retaddr(linebuf.buf);
if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
break;
strbuf_setlen(&linebuf, 0);
@@ -860,6 +862,8 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
break;
for (int i = 0; i < n; i++) {
if (buf[i] == '\n') {
+ if (ftrace->filter_retaddr)
+ ftrace_filter_retaddr(linebuf.buf);
if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
break;
strbuf_setlen(&linebuf, 0);
@@ -871,6 +875,8 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
}
if (!ferror(stdout) && linebuf.len > 0) {
+ if (ftrace->filter_retaddr)
+ ftrace_filter_retaddr(linebuf.buf);
fprintf(stdout, "%s\n", linebuf.buf);
strbuf_setlen(&linebuf, 0);
}
@@ -1836,6 +1842,8 @@ int cmd_ftrace(int argc, const char **argv)
"Size of per cpu buffer, needs to use a B, K, M or G suffix.", parse_buffer_size),
OPT_BOOLEAN(0, "inherit", &ftrace.inherit,
"Trace children processes"),
+ OPT_BOOLEAN_SET(0, "filter-retaddr", &ftrace.filter_retaddr, &ftrace.filter_retaddr_set,
+ "Filter out funcgraph return address comments"),
OPT_INTEGER('D', "delay", &ftrace.target.initial_delay,
"Number of milliseconds to wait before starting tracing after program start"),
OPT_PARENT(common_options),
diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build
index 395f2866094a..136138932fcb 100644
--- a/tools/perf/tests/Build
+++ b/tools/perf/tests/Build
@@ -72,6 +72,7 @@ perf-test-y += hwmon_pmu.o
perf-test-y += tool_pmu.o
perf-test-y += subcmd-help.o
perf-test-y += kallsyms-split.o
+perf-test-y += ftrace.o
ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc riscv))
perf-test-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index d2f594921e25..9663f48afb92 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -137,6 +137,7 @@ static struct test_suite *generic_tests[] = {
&suite__perf_hooks,
&suite__unit_number__scnprint,
&suite__mem2node,
+ &suite__ftrace,
&suite__time_utils,
&suite__jit_write_elf,
&suite__pfm,
diff --git a/tools/perf/tests/ftrace.c b/tools/perf/tests/ftrace.c
new file mode 100644
index 000000000000..596cecee844e
--- /dev/null
+++ b/tools/perf/tests/ftrace.c
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/compiler.h>
+#include <linux/kernel.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "tests.h"
+#include "debug.h"
+#include "util/ftrace.h"
+
+static int test_parse_retaddr(void)
+{
+ char sym[128];
+ u64 offset = 0;
+
+ /* Standard format */
+ TEST_ASSERT_VAL("parse standard retaddr",
+ ftrace_parse_retaddr("kernel_read() { /* <-load_elf_phdrs+0x6c/0xb0 */",
+ sym, sizeof(sym), &offset));
+ TEST_ASSERT_EQUAL("sym name", strcmp(sym, "load_elf_phdrs"), 0);
+ TEST_ASSERT_VAL("offset", offset == 0x6c);
+
+ /* With return value */
+ TEST_ASSERT_VAL("parse retaddr with ret",
+ ftrace_parse_retaddr(
+ "__cond_resched(); /* <-load_elf_phdrs+0x6c/0xb0 ret=0x0 */",
+ sym, sizeof(sym), &offset));
+ TEST_ASSERT_EQUAL("sym name", strcmp(sym, "load_elf_phdrs"), 0);
+ TEST_ASSERT_VAL("offset", offset == 0x6c);
+
+ /* Bracketed address */
+ TEST_ASSERT_VAL("parse bracketed retaddr",
+ ftrace_parse_retaddr("foo() { /* <-[0xffffffff818534c8] bar+0x20/0x40 */",
+ sym, sizeof(sym), &offset));
+ TEST_ASSERT_EQUAL("sym name", strcmp(sym, "bar"), 0);
+ TEST_ASSERT_VAL("offset", offset == 0x20);
+
+ /* No return address */
+ TEST_ASSERT_VAL("no retaddr",
+ !ftrace_parse_retaddr("do_filp_open();", sym, sizeof(sym), &offset));
+
+ return TEST_OK;
+}
+
+static int test_filter_retaddr(void)
+{
+ char line1[] = "kernel_read() { /* <-load_elf_phdrs+0x6c/0xb0 */";
+ char line2[] = "__cond_resched(); /* <-load_elf_phdrs+0x6c/0xb0 ret=0x0 */";
+ char line3[] = "do_filp_open();";
+
+ ftrace_filter_retaddr(line1);
+ TEST_ASSERT_EQUAL("filter standard retaddr", strcmp(line1, "kernel_read() {"), 0);
+
+ ftrace_filter_retaddr(line2);
+ TEST_ASSERT_EQUAL("filter retaddr with ret", strcmp(line2, "__cond_resched();"), 0);
+
+ ftrace_filter_retaddr(line3);
+ TEST_ASSERT_EQUAL("filter line without retaddr unchanged",
+ strcmp(line3, "do_filp_open();"), 0);
+
+ return TEST_OK;
+}
+
+static int test__ftrace(struct test_suite *test __maybe_unused, int subtest __maybe_unused)
+{
+ int ret;
+
+ ret = test_parse_retaddr();
+ if (ret != TEST_OK)
+ return ret;
+
+ ret = test_filter_retaddr();
+ if (ret != TEST_OK)
+ return ret;
+
+ return TEST_OK;
+}
+
+DEFINE_SUITE("Ftrace return address processing", ftrace);
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 9c96f33483d1..1aec32e094c8 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -163,6 +163,7 @@ DECLARE_SUITE(perf_hooks);
DECLARE_SUITE(unit_number__scnprint);
DECLARE_SUITE(mem2node);
DECLARE_SUITE(maps);
+DECLARE_SUITE(ftrace);
DECLARE_SUITE(time_utils);
DECLARE_SUITE(jit_write_elf);
DECLARE_SUITE(api_io);
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index 2c1f880c4c47..5b082d09006d 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -169,6 +169,7 @@ perf-util-y += list_sort.o
perf-util-y += mutex.o
perf-util-y += sharded_mutex.o
perf-util-y += intel-tpebs.o
+perf-util-y += ftrace.o
perf-util-$(CONFIG_PERF_BPF_SKEL) += bpf_counter.o
perf-util-$(CONFIG_PERF_BPF_SKEL) += bpf_counter_cgroup.o
diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
new file mode 100644
index 000000000000..344d36293f5c
--- /dev/null
+++ b/tools/perf/util/ftrace.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/compiler.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include "util/ftrace.h"
+
+/**
+ * ftrace_parse_retaddr - Parse return address comment from trace line
+ * @str: The trace line containing the comment
+ * @sym_name: Buffer to store the parsed symbol name
+ * @sym_len: Length of the @sym_name buffer
+ * @offset: Pointer to store the parsed offset
+ *
+ * Extract the function name and offset from a funcgraph-retaddr comment
+ * (e.g. "<-load_elf_phdrs+0x6c/0xb0").
+ *
+ * Return: true if successfully parsed, false otherwise.
+ */
+bool ftrace_parse_retaddr(const char *str, char *sym_name, size_t sym_len, u64 *offset)
+{
+ const char *p = strstr(str, "<-");
+ const char *plus;
+ const char *bracket;
+ char *endptr;
+ size_t name_len;
+
+ if (!p)
+ return false;
+
+ p += 2;
+ while (*p == ' ')
+ p++;
+
+ if (*p == '[') {
+ bracket = strchr(p, ']');
+ if (bracket)
+ p = bracket + 1;
+ while (*p == ' ')
+ p++;
+ }
+
+ plus = strchr(p, '+');
+ if (!plus)
+ return false;
+
+ name_len = plus - p;
+ if (name_len == 0 || name_len >= sym_len)
+ return false;
+
+ memcpy(sym_name, p, name_len);
+ sym_name[name_len] = '\0';
+
+ *offset = strtoull(plus + 1, &endptr, 16);
+ return true;
+}
+
+/**
+ * ftrace_filter_retaddr - Remove return address comment from trace line
+ * @str: The trace line to modify
+ *
+ * Find and strip the funcgraph-retaddr comment from the trace line
+ * in-place, removing trailing spaces where applicable.
+ */
+void ftrace_filter_retaddr(char *str)
+{
+ char *start = strstr(str, "/* <-");
+ char *end;
+
+ if (!start)
+ return;
+
+ end = strstr(start, "*/");
+ if (!end)
+ return;
+
+ end += 2; /* skip end-of-comment delimiter */
+
+ /* Also backtrack any spaces before comment */
+ while (start > str && *(start - 1) == ' ')
+ start--;
+
+ memmove(start, end, strlen(end) + 1);
+}
diff --git a/tools/perf/util/ftrace.h b/tools/perf/util/ftrace.h
index 950f2efafad2..50216d3fef64 100644
--- a/tools/perf/util/ftrace.h
+++ b/tools/perf/util/ftrace.h
@@ -39,6 +39,8 @@ struct perf_ftrace {
int graph_verbose;
int graph_thresh;
int graph_tail;
+ bool filter_retaddr;
+ bool filter_retaddr_set;
};
struct filter_entry {
@@ -93,4 +95,7 @@ perf_ftrace__latency_cleanup_bpf(struct perf_ftrace *ftrace __maybe_unused)
#endif /* HAVE_BPF_SKEL */
+bool ftrace_parse_retaddr(const char *str, char *sym_name, size_t sym_len, u64 *offset);
+void ftrace_filter_retaddr(char *str);
+
#endif /* __PERF_FTRACE_H__ */
--
2.55.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments
2026-10-14 16:14 ` [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments Aaron Tomlin
@ 2026-10-14 16:24 ` sashiko-bot
2026-10-14 18:13 ` Aaron Tomlin
0 siblings, 1 reply; 13+ messages in thread
From: sashiko-bot @ 2026-10-14 16:24 UTC (permalink / raw)
To: Aaron Tomlin; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] perf: build failure due to unused variable 'endptr'
--
commit 8db97766d362752b2eec14b113b39acd9e702f2a
Author: Aaron Tomlin <atomlin@atomlin.com>
perf ftrace: Support filtering return address comments
This commit introduces support for filtering out return address comments from
function graph trace output in perf ftrace. It adds the --filter-retaddr flag
and implements the parsing and filtering logic.
> diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
> new file mode 100644
> index 0000000000000..344d36293f5ca
> --- /dev/null
> +++ b/tools/perf/util/ftrace.c
[ ... ]
> +bool ftrace_parse_retaddr(const char *str, char *sym_name, size_t sym_len, u64 *offset)
> +{
> + const char *p = strstr(str, "<-");
> + const char *plus;
> + const char *bracket;
> + char *endptr;
> + size_t name_len;
[ ... ]
> + memcpy(sym_name, p, name_len);
> + sym_name[name_len] = '\0';
> +
> + *offset = strtoull(plus + 1, &endptr, 16);
[Severity: Low]
Will this cause a build failure due to an unused variable?
The tools/perf build system enables -Werror by default, which elevates
-Wunused-but-set-variable to a build failure. The local variable endptr
is written to by strtoull() but is never subsequently read or evaluated.
Could we pass NULL to strtoull() instead to resolve this and avoid breaking
the build?
> + return true;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161457.373253-1-atomlin@atomlin.com?part=2
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments
2026-10-14 16:24 ` sashiko-bot
@ 2026-10-14 18:13 ` Aaron Tomlin
0 siblings, 0 replies; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 18:13 UTC (permalink / raw)
To: sashiko-reviews; +Cc: linux-perf-users
On Wed, Oct 14, 2026 at 04:24:14PM +0000, sashiko-bot@kernel.org wrote:
> [Severity: Low]
> Will this cause a build failure due to an unused variable?
>
> The tools/perf build system enables -Werror by default, which elevates
> -Wunused-but-set-variable to a build failure. The local variable endptr
> is written to by strtoull() but is never subsequently read or evaluated.
>
> Could we pass NULL to strtoull() instead to resolve this and avoid
> breaking the build?
Indeed. This will be resolved in the next iteration.
--
Aaron Tomlin
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH perf-tools-next v4 3/5] perf ftrace: Support display of inlined functions in function graph tracer
2026-10-14 16:14 [PATCH perf-tools-next v4 0/5] perf ftrace: Support inlined functions and display enhancements in function graph tracer Aaron Tomlin
2026-10-14 16:14 ` [PATCH perf-tools-next v4 1/5] perf ftrace: Optimise __cmd_ftrace() stack frame with strbuf streaming Aaron Tomlin
2026-10-14 16:14 ` [PATCH perf-tools-next v4 2/5] perf ftrace: Support filtering return address comments Aaron Tomlin
@ 2026-10-14 16:14 ` Aaron Tomlin
2026-10-14 16:27 ` sashiko-bot
2026-10-14 16:14 ` [PATCH perf-tools-next v4 4/5] perf ftrace: Support omitting execution duration " Aaron Tomlin
2026-10-14 16:14 ` [PATCH perf-tools-next v4 5/5] perf ftrace: Filter extraneous functions " Aaron Tomlin
4 siblings, 1 reply; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 16:14 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
atomlin, linux-perf-users, linux-kernel
The Linux kernel's function graph tracer operates at the machine
instruction level via compiler instrumentation
(-fpatchable-function-entry), recording entry and return events for
physical function calls. Consequently, functions inlined by the compiler
are invisible in the resulting call graph, as no discrete call or return
instructions are emitted for them. While technically expected, this
omission frequently obscures the logical execution flow when analysing
kernel subsystems heavily reliant upon inlining.
Address this by introducing the --inline option to perf ftrace for the
function_graph tracer.
When the kernel is configured with CONFIG_FUNCTION_GRAPH_RETADDR=y, the
funcgraph-retaddr trace option records the caller's return address on
each function entry, manifested in the trace stream as a comment
(e.g. /* <-irq_work_queue_on+0x81/0xa0 */). By interrogating DWARF debug
information from the kernel image (vmlinux) utilising libdw, perf ftrace
resolves this return address to its inlined callchain and synthesises the
intermediate inlined frames directly into the streamed call graph.
Key aspects of this implementation:
1. Inlined frame presentation
Synthesised inlined functions are rendered with an explicit
/* (inline) */ annotation at both entry and exit:
# CPU DURATION FUNCTION CALLS
# | | | | | | |
0) | wake_up_new_task() {
0) | activate_task() { /* (inline) */
0) 1.234 us | enqueue_task();
0) | } /* activate_task (inline) */
0) 2.567 us | }
This affords immediate visual clarity to the reader upon
entering an inlined scope, without necessitating a search for
the closing delimiter.
2. Call graph reconstruction and dynamic stack tracking
Maintains a per-CPU stack tracking real and inlined frames,
synthesising entry and exit delimiters to accurately reconstruct
the execution hierarchy. Inlined frames are structured strictly
root-to-leaf and validated against the active stack to prevent
un-traced callers from attaching orphan inlines. Bare closing
braces without trailing function names (the default when
funcgraph-tail is disabled) are correctly matched against
preceding frames on the stack. Context column alignment, including
task comm-pid delimiters in verbose mode, is preserved when
generating prefixes for synthesised inline frames. Furthermore,
stack depth saturation guards ensure that inlined frame depth
tracking remains clamped and indentation cannot drift even under
deep call trees exceeding FTRACE_MAX_STACK.
3. Option handling and diagnostics
Adds -k or --vmlinux to designate an explicit debug image, and
provides clear diagnostic guidance should --inline be invoked on
a kernel lacking CONFIG_FUNCTION_GRAPH_RETADDR. Automatically
enables return address comment filtering unless explicitly
requested.
4. Automated verification
Expands the unit test suite in tools/perf/tests/ftrace.c to
validate DWARF inline symbol resolution, comment filtering
toggles, bare closing braces handling, and stack saturation
recovery.
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
tools/perf/Documentation/perf-ftrace.txt | 17 +-
tools/perf/builtin-ftrace.c | 58 ++-
tools/perf/tests/ftrace.c | 343 +++++++++++-
tools/perf/util/ftrace.c | 632 ++++++++++++++++++++++-
tools/perf/util/ftrace.h | 11 +
5 files changed, 1043 insertions(+), 18 deletions(-)
diff --git a/tools/perf/Documentation/perf-ftrace.txt b/tools/perf/Documentation/perf-ftrace.txt
index e8105083e67c..445c8ccc22d2 100644
--- a/tools/perf/Documentation/perf-ftrace.txt
+++ b/tools/perf/Documentation/perf-ftrace.txt
@@ -134,9 +134,24 @@ OPTIONS for 'perf ftrace trace'
- depth=<n> - Set max depth for function graph tracer to follow.
- tail - Print function name at the end.
+--inline::
+ Show inlined functions in function_graph tracer. This requires
+ kernel support for the funcgraph-retaddr option and a vmlinux with
+ debug symbols. Inlined functions are displayed in the call graph
+ hierarchy, and their inlined status is indicated with `/* (inline) */`
+ on entry and exit, e.g. `func() { /* (inline) */` and `} /* func (inline) */`.
+ By default, raw return address comments (`/* <-caller+offset */`)
+ are hidden in the output; specify `--graph-opts retaddr` to show them.
+
--filter-retaddr::
Filter out function return address comments (`/* <-caller+offset */`)
- from function_graph output.
+ from function_graph output. This is enabled by default when `--inline`
+ is used; use `--no-filter-retaddr` to disable it.
+
+-k::
+--vmlinux=::
+ Path to the vmlinux file containing debug symbols for resolving
+ inlined functions.
OPTIONS for 'perf ftrace latency'
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index b8ab76912a0e..2707d3d62bca 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -574,9 +574,14 @@ static int set_tracing_funcgraph_retval(struct perf_ftrace *ftrace)
static int set_tracing_funcgraph_retaddr(struct perf_ftrace *ftrace)
{
- if (ftrace->graph_retaddr) {
- if (write_tracing_option_file("funcgraph-retaddr", "1") < 0)
+ if (ftrace->graph_retaddr || ftrace->use_inline) {
+ if (write_tracing_option_file("funcgraph-retaddr", "1") < 0) {
+ if (ftrace->use_inline) {
+ pr_err("failed to set funcgraph-retaddr option in tracing\n");
+ pr_err("Hint: ensure kernel is compiled with CONFIG_FUNCTION_GRAPH_RETADDR=y\n");
+ }
return -1;
+ }
}
return 0;
@@ -769,6 +774,9 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
goto out_reset;
}
+ if (perf_ftrace__setup_inlines(ftrace) < 0)
+ goto out_reset;
+
setup_pager();
buf = malloc(TRACE_BUF_SIZE);
@@ -828,9 +836,11 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
break;
for (int i = 0; i < n; i++) {
if (buf[i] == '\n') {
- if (ftrace->filter_retaddr)
- ftrace_filter_retaddr(linebuf.buf);
- if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
+ if (ftrace_process_fgraph_line(ftrace,
+ linebuf.buf,
+ stdout) < 0)
+ goto out_close_fd;
+ if (ferror(stdout))
break;
strbuf_setlen(&linebuf, 0);
} else {
@@ -862,9 +872,11 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
break;
for (int i = 0; i < n; i++) {
if (buf[i] == '\n') {
- if (ftrace->filter_retaddr)
- ftrace_filter_retaddr(linebuf.buf);
- if (fprintf(stdout, "%s\n", linebuf.buf) < 0)
+ if (ftrace_process_fgraph_line(ftrace,
+ linebuf.buf,
+ stdout) < 0)
+ goto out_close_fd;
+ if (ferror(stdout))
break;
strbuf_setlen(&linebuf, 0);
} else {
@@ -875,9 +887,9 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
}
if (!ferror(stdout) && linebuf.len > 0) {
- if (ftrace->filter_retaddr)
- ftrace_filter_retaddr(linebuf.buf);
- fprintf(stdout, "%s\n", linebuf.buf);
+ if (ftrace_process_fgraph_line(ftrace, linebuf.buf,
+ stdout) < 0)
+ goto out_close_fd;
strbuf_setlen(&linebuf, 0);
}
@@ -887,6 +899,7 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace)
free(buf);
strbuf_release(&linebuf);
out_reset:
+ perf_ftrace__cleanup_inlines(ftrace);
exit_tracing_instance();
out:
return (done && !workload_exec_errno) ? 0 : -1;
@@ -1842,8 +1855,13 @@ int cmd_ftrace(int argc, const char **argv)
"Size of per cpu buffer, needs to use a B, K, M or G suffix.", parse_buffer_size),
OPT_BOOLEAN(0, "inherit", &ftrace.inherit,
"Trace children processes"),
- OPT_BOOLEAN_SET(0, "filter-retaddr", &ftrace.filter_retaddr, &ftrace.filter_retaddr_set,
- "Filter out funcgraph return address comments"),
+ OPT_BOOLEAN(0, "inline", &ftrace.use_inline,
+ "Show inlined functions in function_graph tracer"),
+ OPT_BOOLEAN_SET(0, "filter-retaddr", &ftrace.filter_retaddr,
+ &ftrace.filter_retaddr_set,
+ "Filter out funcgraph return address comments (default with --inline)"),
+ OPT_STRING('k', "vmlinux", &symbol_conf.vmlinux_name, "file",
+ "vmlinux pathname"),
OPT_INTEGER('D', "delay", &ftrace.target.initial_delay,
"Number of milliseconds to wait before starting tracing after program start"),
OPT_PARENT(common_options),
@@ -1959,6 +1977,20 @@ int cmd_ftrace(int argc, const char **argv)
switch (subcmd) {
case PERF_FTRACE_TRACE:
+ if (ftrace.use_inline) {
+ if (ftrace.tracer && strcmp(ftrace.tracer, "function_graph") != 0) {
+ pr_err("Error: --inline option is only supported with function_graph tracer\n");
+ ret = -EINVAL;
+ goto out_delete_filters;
+ }
+ ftrace.tracer = "function_graph";
+ }
+ if (!ftrace.filter_retaddr_set) {
+ if (ftrace.use_inline && !ftrace.graph_retaddr)
+ ftrace.filter_retaddr = true;
+ else
+ ftrace.filter_retaddr = false;
+ }
cmd_func = __cmd_ftrace;
break;
case PERF_FTRACE_LATENCY:
diff --git a/tools/perf/tests/ftrace.c b/tools/perf/tests/ftrace.c
index 596cecee844e..eacdee1dde86 100644
--- a/tools/perf/tests/ftrace.c
+++ b/tools/perf/tests/ftrace.c
@@ -7,6 +7,10 @@
#include <unistd.h>
#include "tests.h"
#include "debug.h"
+#include "dso.h"
+#include "machine.h"
+#include "map.h"
+#include "symbol.h"
#include "util/ftrace.h"
static int test_parse_retaddr(void)
@@ -62,6 +66,331 @@ static int test_filter_retaddr(void)
return TEST_OK;
}
+#define TEST_CHECK(text, cond) \
+do { \
+ if (!(cond)) { \
+ pr_debug("FAILED %s:%d %s\n", __FILE__, __LINE__, text); \
+ ret = TEST_FAIL; \
+ goto out_cleanup; \
+ } \
+} while (0)
+
+static int test_inline_processing(void)
+{
+ static const char line_entry[] = " 0) | wake_up_new_task() {";
+ static const char line_enqueue[] =
+ " 0) | enqueue_task() { /* <-wake_up_new_task+0x1d1/0x3e0 */";
+ static const char line_exit_enqueue[] = " 0) + 10.000 us | } /* enqueue_task */";
+ static const char line_exit_task[] = " 0) + 20.000 us | } /* wake_up_new_task */";
+ static const char line_bare_enqueue[] = " 0) + 10.000 us | }";
+ static const char line_bare_task[] = " 0) + 20.000 us | }";
+ static const char line_unmatched[] = " 0) + 5.000 us | } /* unrelated_func */";
+ static const char line_verbose_entry[] =
+ " 1234.567890 | 0) bash-1234 | | wake_up_new_task() {";
+ static const char line_verbose_enqueue[] =
+ " 1234.567890 | 0) bash-1234 | | enqueue_task() { /* <-wake_up_new_task+0x1d1/0x3e0 */";
+ static const char line_verbose_exit_enqueue[] =
+ " 1234.567890 | 0) bash-1234 | 1.234 us | } /* enqueue_task */";
+ static const char line_verbose_exit_task[] =
+ " 1234.567890 | 0) bash-1234 | 2.567 us | } /* wake_up_new_task */";
+ static const char line_verbose_inline_entry[] =
+ " 1234.567890 | 0) bash-1234 | | activate_task() { /* (inline) */";
+ static const char line_verbose_inline_exit[] =
+ " 1234.567890 | 0) bash-1234 | | } /* activate_task (inline) */";
+ struct perf_ftrace ftrace;
+ char *out_buf = NULL;
+ size_t out_len = 0;
+ FILE *out;
+ const char *unmatched_pos;
+ const char *inline_exit_pos;
+ int ret = TEST_OK;
+
+ memset(&ftrace, 0, sizeof(ftrace));
+ ftrace.use_inline = true;
+ ftrace.filter_retaddr = 1; /* Default when --graph-opts retaddr is not specified */
+ ftrace.tracer = "function_graph";
+
+ /* If vmlinux is present, test resolving symbols */
+ if (access("vmlinux", R_OK) == 0) {
+ symbol_conf.vmlinux_name = "vmlinux";
+ symbol_conf.ignore_vmlinux_buildid = true;
+ ret = perf_ftrace__setup_inlines(&ftrace);
+ if (ret < 0 || !ftrace.machine) {
+ ret = TEST_SKIP;
+ goto out_cleanup;
+ }
+
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ /* Feed simulated function graph trace lines */
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_task, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ pr_debug("Processed output:\n%s\n", out_buf);
+
+ /* Verify activate_task entry with inline hint */
+ TEST_CHECK("contains activate_task entry with inline hint",
+ strstr(out_buf, "activate_task() { /* (inline) */") != NULL);
+
+ /* Verify activate_task exit with inline hint */
+ TEST_CHECK("contains activate_task exit with inline hint",
+ strstr(out_buf, "} /* activate_task (inline) */") != NULL);
+
+ /* Verify return address comment was filtered out by default */
+ TEST_CHECK("retaddr comment filtered out",
+ strstr(out_buf, "/* <-wake_up_new_task") == NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Now test with filter_retaddr = 0 (user specified --graph-opts retaddr) */
+ ftrace.filter_retaddr = 0;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_task, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ /* Verify return address comment IS preserved when filter_retaddr = 0 */
+ TEST_CHECK("retaddr comment preserved when requested",
+ strstr(out_buf, "/* <-wake_up_new_task") != NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Test with bare closing braces (funcgraph-tail disabled by default) */
+ ftrace.filter_retaddr = 1;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_bare_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_bare_task, out);
+
+ fclose(out);
+
+ TEST_CHECK("bare braces inline entry",
+ strstr(out_buf, "activate_task() { /* (inline) */") != NULL);
+ TEST_CHECK("bare braces inline exit",
+ strstr(out_buf, "} /* activate_task (inline) */") != NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Test that unmatched exit events do not pop active inlined frames */
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_enqueue, out);
+ /* Unmatched exit event while activate_task is still active */
+ ftrace_process_fgraph_line(&ftrace, line_unmatched, out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_task, out);
+
+ fclose(out);
+
+ unmatched_pos = strstr(out_buf, "} /* unrelated_func */");
+ inline_exit_pos = strstr(out_buf, "} /* activate_task (inline) */");
+
+ TEST_CHECK("unmatched exit present", unmatched_pos != NULL);
+ TEST_CHECK("inline exit present", inline_exit_pos != NULL);
+ TEST_CHECK("inline exit not prematurely popped before unmatched exit",
+ inline_exit_pos > unmatched_pos);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Test recovery when an intermediate real function exit event is dropped */
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_enqueue, out);
+ /* line_exit_enqueue is dropped; outer wake_up_new_task exits directly */
+ ftrace_process_fgraph_line(&ftrace, line_exit_task, out);
+
+ fclose(out);
+
+ TEST_CHECK("inline exit synthesized despite dropped callee exit",
+ strstr(out_buf, "} /* activate_task (inline) */") != NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Test that callers not on active stack do not synthesise inlines */
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_entry, out);
+ /* housekeeping_any_cpu called by untraced ring_buffer_unlock_commit */
+ ftrace_process_fgraph_line(&ftrace,
+ " 0) | housekeeping_any_cpu(); /* <-ring_buffer_unlock_commit+0x1a0/0x1f0 */",
+ out);
+ ftrace_process_fgraph_line(&ftrace, line_exit_task, out);
+
+ fclose(out);
+
+ TEST_CHECK("untraced caller inlines not synthesised",
+ strstr(out_buf, "rb_wakeups") == NULL &&
+ strstr(out_buf, "rb_irq_work_queue") == NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* Test verbose mode prefix formatting for synthesised inlines */
+ ftrace.graph_verbose = true;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_verbose_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_exit_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_exit_task, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ TEST_CHECK("verbose inline entry preserves comm-pid",
+ strstr(out_buf, line_verbose_inline_entry) != NULL);
+ TEST_CHECK("verbose inline exit preserves comm-pid",
+ strstr(out_buf, line_verbose_inline_exit) != NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+ ftrace.graph_verbose = false;
+ }
+
+out_cleanup:
+ free(out_buf);
+ perf_ftrace__cleanup_inlines(&ftrace);
+ return ret;
+}
+#undef TEST_CHECK
+
+static int test_stack_saturation(void)
+{
+ struct perf_ftrace ftrace;
+ char *out_buf = NULL;
+ size_t out_len = 0;
+ FILE *out;
+ int i;
+
+ memset(&ftrace, 0, sizeof(ftrace));
+ ftrace.use_inline = true;
+ ftrace_cpu_states__clear();
+
+ out = open_memstream(&out_buf, &out_len);
+ if (!out)
+ return TEST_FAIL;
+
+ /* Push more than FTRACE_MAX_STACK (256) frames */
+ for (i = 0; i < 300; i++)
+ ftrace_process_fgraph_line(&ftrace, " 0) | sub_func() {", out);
+
+ /* Pop all 300 frames */
+ for (i = 0; i < 300; i++)
+ ftrace_process_fgraph_line(&ftrace, " 0) | }", out);
+
+ /* Feed one more function entry - it must have base indentation (no indentation drift) */
+ ftrace_process_fgraph_line(&ftrace, " 0) | base_func() {", out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ /* Verify base_func starts at standard 2 spaces indentation without drift */
+ TEST_ASSERT_VAL("no indentation drift after stack saturation",
+ strstr(out_buf, "| base_func() {") != NULL);
+
+ free(out_buf);
+ return TEST_OK;
+}
+
+static int test_column_layouts(void)
+{
+ static const struct {
+ const char *desc;
+ bool verbose;
+ const char *in;
+ const char *expected;
+ } cases[] = {
+ {
+ "default layout", false,
+ " 7) | wake_up_new_task() { /* <-kernel_clone+0x160/0x510 */",
+ " 7) | wake_up_new_task() {\n",
+ },
+ {
+ "verbose layout", true,
+ " 1234.567890 | 7) bash-1234 | | wake_up_new_task() { /* <-kernel_clone+0x160/0x510 */",
+ " 1234.567890 | 7) bash-1234 | | wake_up_new_task() {\n",
+ },
+ };
+ struct perf_ftrace ftrace;
+ char *out_buf = NULL;
+ size_t out_len = 0;
+ FILE *out;
+ size_t i;
+
+ for (i = 0; i < ARRAY_SIZE(cases); i++) {
+ memset(&ftrace, 0, sizeof(ftrace));
+ ftrace.use_inline = true;
+ ftrace.filter_retaddr = true;
+ ftrace.graph_verbose = cases[i].verbose;
+
+ out = open_memstream(&out_buf, &out_len);
+ if (!out)
+ return TEST_FAIL;
+
+ ftrace_process_fgraph_line(&ftrace, cases[i].in, out);
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ if (strcmp(out_buf, cases[i].expected)) {
+ pr_debug("%s: expected '%s', got '%s'\n",
+ cases[i].desc, cases[i].expected, out_buf);
+ free(out_buf);
+ return TEST_FAIL;
+ }
+ free(out_buf);
+ out_buf = NULL;
+ }
+
+ return TEST_OK;
+}
+
static int test__ftrace(struct test_suite *test __maybe_unused, int subtest __maybe_unused)
{
int ret;
@@ -74,7 +403,19 @@ static int test__ftrace(struct test_suite *test __maybe_unused, int subtest __ma
if (ret != TEST_OK)
return ret;
+ ret = test_stack_saturation();
+ if (ret != TEST_OK)
+ return ret;
+
+ ret = test_column_layouts();
+ if (ret != TEST_OK)
+ return ret;
+
+ ret = test_inline_processing();
+ if (ret != TEST_OK)
+ return ret;
+
return TEST_OK;
}
-DEFINE_SUITE("Ftrace return address processing", ftrace);
+DEFINE_SUITE("Ftrace inline processing", ftrace);
diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
index 344d36293f5c..8a7f8f6eead1 100644
--- a/tools/perf/util/ftrace.c
+++ b/tools/perf/util/ftrace.c
@@ -1,13 +1,82 @@
// SPDX-License-Identifier: GPL-2.0
-#include <linux/compiler.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
+/*
+ * ftrace.c - Ftrace utilities and inlined function processing
+ *
+ * Copyright (C) 2026 Aaron Tomlin <atomlin@atomlin.com>
+ */
#include <stdio.h>
#include <stdlib.h>
+#include <errno.h>
#include <string.h>
#include <ctype.h>
+#include <stdbool.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include "debug.h"
+#include "dso.h"
+#include "machine.h"
+#include "map.h"
+#include "srcline.h"
+#include "symbol.h"
#include "util/ftrace.h"
+#define FTRACE_MAX_CPUS 4096
+#define FTRACE_MAX_STACK 256
+#define FTRACE_MAX_INLINES 32
+
+struct ftrace_stack_frame {
+ char *name;
+ bool inlined;
+ int indent;
+};
+
+struct ftrace_cpu_state {
+ struct ftrace_stack_frame stack[FTRACE_MAX_STACK];
+ int depth;
+ int inlined_depth;
+};
+
+static struct ftrace_cpu_state *ftrace_cpu_states[FTRACE_MAX_CPUS];
+
+/**
+ * ftrace_cpu_states__clear - Free allocated CPU stack states
+ *
+ * Free all memory associated with the per-CPU stack tracking states
+ * used for inlined function resolution, including the strings
+ * allocated for stack frames.
+ */
+void ftrace_cpu_states__clear(void)
+{
+ int i, j;
+
+ for (i = 0; i < FTRACE_MAX_CPUS; i++) {
+ if (ftrace_cpu_states[i]) {
+ for (j = 0; j < ftrace_cpu_states[i]->depth; j++)
+ free(ftrace_cpu_states[i]->stack[j].name);
+ free(ftrace_cpu_states[i]);
+ ftrace_cpu_states[i] = NULL;
+ }
+ }
+}
+
+/**
+ * get_cpu_state - Get or allocate stack state for a given CPU
+ * @cpu: The CPU number
+ *
+ * Return: A pointer to the CPU's stack state, or NULL on error or
+ * out-of-bounds CPU index.
+ */
+static struct ftrace_cpu_state *get_cpu_state(int cpu)
+{
+ if (cpu < 0 || cpu >= FTRACE_MAX_CPUS)
+ return NULL;
+
+ if (!ftrace_cpu_states[cpu])
+ ftrace_cpu_states[cpu] = zalloc(sizeof(struct ftrace_cpu_state));
+
+ return ftrace_cpu_states[cpu];
+}
+
/**
* ftrace_parse_retaddr - Parse return address comment from trace line
* @str: The trace line containing the comment
@@ -85,3 +154,560 @@ void ftrace_filter_retaddr(char *str)
memmove(start, end, strlen(end) + 1);
}
+
+/**
+ * ftrace_resolve_inlines - Resolve inlined functions for a return address
+ * @machine: Perf machine context
+ * @sym_name: Name of the caller function
+ * @offset: Instruction offset within the caller function
+ * @inlined_names: Array to store the resolved inline function names
+ * @max_inlines: Maximum number of inline frames to resolve
+ *
+ * Use DWARF debug information from the kernel image to resolve a caller's
+ * return address to its inlined callchain.
+ *
+ * Return: The number of inline functions successfully resolved.
+ */
+int ftrace_resolve_inlines(struct machine *machine,
+ const char *sym_name, u64 offset,
+ const char **inlined_names, int max_inlines)
+{
+ struct map *map = NULL;
+ struct symbol *sym;
+ struct dso *dso;
+ struct inline_node *node;
+ struct inline_list *ilist;
+ u64 ip, addr;
+ int count = 0;
+
+ if (!machine)
+ return 0;
+
+ sym = machine__find_kernel_symbol_by_name(machine, sym_name, &map);
+ if (!sym || !map)
+ return 0;
+
+ dso = map__dso(map);
+ if (!dso) {
+ map__put(map);
+ return 0;
+ }
+
+ ip = sym->start + offset;
+ addr = map__rip_2objdump(map, ip);
+
+ node = inlines__tree_find(dso__inlined_nodes(dso), addr);
+ if (!node) {
+ node = dso__parse_addr_inlines(dso, addr, sym);
+ if (node)
+ inlines__tree_insert(dso__inlined_nodes(dso), node);
+ }
+
+ if (!node) {
+ map__put(map);
+ return 0;
+ }
+
+ list_for_each_entry_reverse(ilist, &node->val, list) {
+ if (ilist->symbol && symbol__inlined(ilist->symbol)) {
+ if (count < max_inlines) {
+ char *name = strdup(ilist->symbol->name);
+
+ if (name)
+ inlined_names[count++] = name;
+ }
+ }
+ }
+
+ map__put(map);
+ return count;
+}
+
+/**
+ * extract_entry_func_name - Extract the function name from an entry record
+ * @str: The trace line's function column string
+ * @buf: Buffer to store the extracted name
+ * @size: Size of the @buf
+ *
+ * Parse the function name out of an entry trace record by stripping away
+ * parentheses or braces.
+ */
+static void extract_entry_func_name(const char *str, char *buf, size_t size)
+{
+ size_t i = 0;
+
+ while (*str && *str != '(' && *str != '{' && !isspace(*str) && i < size - 1)
+ buf[i++] = *str++;
+ buf[i] = '\0';
+}
+
+/**
+ * extract_exit_func_name - Extract the function name from an exit record
+ * @str: The trace line's function column string
+ * @buf: Buffer to store the extracted name
+ * @size: Size of the @buf
+ *
+ * Parse the original function name out of the trailing comment in an
+ * exit trace record.
+ */
+static void extract_exit_func_name(const char *str, char *buf, size_t size)
+{
+ const char *p = strchr(str, '}');
+ size_t i = 0;
+
+ buf[0] = '\0';
+ if (!p)
+ return;
+
+ p = strstr(p, "/*");
+ if (!p)
+ return;
+
+ p = skip_spaces(p + 2);
+ while (*p && !isspace(*p) && *p != '*' && *p != '/' && i < size - 1)
+ buf[i++] = *p++;
+ buf[i] = '\0';
+}
+
+/**
+ * make_blank_prefix - Create a blank prefix mirroring a trace record's context
+ * @line: The original trace record
+ * @pipe_char: Pointer to the final delimiter character of the context columns
+ * @buf: Buffer to store the blank prefix
+ * @size: Size of the @buf
+ *
+ * Generate a prefix matching the context columns of @line (e.g. CPU, duration)
+ * but with the duration field replaced by spaces.
+ */
+static void make_blank_prefix(const struct perf_ftrace *ftrace, const char *line,
+ const char *pipe_char, char *buf, size_t size)
+{
+ size_t len = pipe_char - line + 1;
+ const char *start_delim = NULL;
+ char *c;
+
+ if (len >= size)
+ len = size - 1;
+
+ memcpy(buf, line, len);
+ buf[len] = '\0';
+
+ if (*pipe_char == '|') {
+ if (ftrace->graph_verbose) {
+ /* In verbose mode, duration starts after the comm-pid '|' */
+ for (const char *p = pipe_char - 1; p >= line; p--) {
+ if (*p == '|') {
+ start_delim = p;
+ break;
+ }
+ }
+ } else {
+ /* In default mode, duration starts after CPU ')' */
+ start_delim = strchr(line, ')');
+ }
+
+ if (start_delim && start_delim < pipe_char) {
+ for (c = buf + (start_delim - line) + 1; c < buf + (pipe_char - line); c++)
+ *c = ' ';
+ }
+ }
+}
+
+/**
+ * find_func_column - Locate the function call column in a trace record
+ * @ftrace: Perf ftrace context
+ * @line: The trace record to parse
+ * @cpu: Pointer to store the CPU number
+ *
+ * Locate the context columns that precede the function call column of a
+ * function_graph trace record. Depending on the funcgraph-* options set
+ * up by perf, a record looks like:
+ *
+ * [ abstime |] CPU) [ comm-pid |] [ duration |] func
+ *
+ * The abstime and comm-pid columns are only present with --graph-opts
+ * verbose.
+ *
+ * Return: A pointer to the last character of the context columns (the final
+ * '|' delimiter). Returns NULL if @line is not a trace record.
+ */
+static const char *find_func_column(const struct perf_ftrace *ftrace,
+ const char *line, int *cpu)
+{
+ const char *p = line;
+ char *endptr;
+ long val;
+
+ if (ftrace->graph_verbose) {
+ p = strchr(p, '|');
+ if (!p)
+ return NULL;
+ p++;
+ }
+
+ p = skip_spaces(p);
+ val = strtol(p, &endptr, 10);
+ if (endptr == p || *endptr != ')')
+ return NULL;
+ p = endptr;
+
+ if (ftrace->graph_verbose) {
+ p = strchr(p, '|');
+ if (!p)
+ return NULL;
+ }
+
+ p = strchr(p + 1, '|');
+ if (!p)
+ return NULL;
+
+ *cpu = (int)val;
+ return p;
+}
+
+/**
+ * print_line - Output a trace line verbatim, filtering return addresses if needed
+ * @ftrace: Perf ftrace context
+ * @line: The trace line to output
+ * @out: File stream to output to
+ *
+ * Output @line to @out. If ftrace->filter_retaddr is set, return address
+ * comments are filtered out first.
+ *
+ * Return: 0 on success, or a negative error code (e.g. -ENOMEM) on failure.
+ */
+static int print_line(struct perf_ftrace *ftrace, const char *line, FILE *out)
+{
+ char *filtered;
+
+ if (!ftrace->filter_retaddr) {
+ fprintf(out, "%s\n", line);
+ return 0;
+ }
+
+ filtered = strdup(line);
+ if (!filtered) {
+ pr_err("Not enough memory\n");
+ return -ENOMEM;
+ }
+
+ ftrace_filter_retaddr(filtered);
+ fprintf(out, "%s\n", filtered);
+ free(filtered);
+ return 0;
+}
+
+/**
+ * ftrace_process_fgraph_line - Process and output a function graph trace line
+ * @ftrace: Perf ftrace context
+ * @line: The trace line to process
+ * @out: File stream to output to
+ *
+ * Process a trace line from the function_graph tracer. If --inline is set,
+ * this function parses the return address comment, resolves it to its
+ * inlined callchain, and synthesises intermediate frames into the streamed
+ * call graph.
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FILE *out)
+{
+ char caller_sym[128];
+ char blank_prefix[128];
+ const char *inlined_names[FTRACE_MAX_INLINES];
+ const char *pipe_char;
+ const char *after_pipe;
+ const char *func_start;
+ struct ftrace_cpu_state *cs;
+ u64 caller_offset = 0;
+ int num_inlines = 0;
+ int cpu = -1;
+ int leading_spaces;
+ int extra_indent;
+ int caller_idx;
+ int active_inlines;
+ int common;
+ int match_idx;
+ int i;
+ bool is_exit;
+ bool has_open_brace;
+ bool has_semicolon;
+ bool has_retaddr = false;
+
+ if (!ftrace->use_inline)
+ return print_line(ftrace, line, out);
+
+ pipe_char = find_func_column(ftrace, line, &cpu);
+ if (!pipe_char)
+ return print_line(ftrace, line, out);
+
+ cs = get_cpu_state(cpu);
+ if (!cs)
+ return print_line(ftrace, line, out);
+
+ make_blank_prefix(ftrace, line, pipe_char, blank_prefix, sizeof(blank_prefix));
+
+ after_pipe = pipe_char + 1;
+ func_start = skip_spaces(after_pipe);
+ leading_spaces = func_start - after_pipe;
+
+ if (*func_start == '\0')
+ return print_line(ftrace, line, out);
+
+ is_exit = (*func_start == '}');
+
+ if (is_exit) {
+ char exit_name[128];
+
+ extract_exit_func_name(func_start, exit_name, sizeof(exit_name));
+
+ /* Find matching frame on stack */
+ match_idx = -1;
+ for (i = cs->depth - 1; i >= 0; i--) {
+ if (!cs->stack[i].inlined) {
+ if (exit_name[0] == '\0' ||
+ (cs->stack[i].name &&
+ strcmp(cs->stack[i].name, exit_name) == 0)) {
+ match_idx = i;
+ break;
+ }
+ }
+ }
+
+ if (match_idx >= 0) {
+ /* Close all inlined and orphaned frames above match_idx */
+ while (cs->depth > 0 && cs->depth - 1 > match_idx) {
+ struct ftrace_stack_frame *top = &cs->stack[cs->depth - 1];
+
+ if (top->inlined) {
+ int exit_indent = top->indent;
+
+ if (cs->inlined_depth > 0)
+ cs->inlined_depth--;
+ fprintf(out, "%s%*s} /* %s (inline) */\n",
+ blank_prefix, exit_indent, "", top->name);
+ }
+ free(top->name);
+ cs->depth--;
+ }
+
+ /* Pop the matched real frame */
+ if (cs->depth > 0 && match_idx == cs->depth - 1 &&
+ !cs->stack[cs->depth - 1].inlined) {
+ free(cs->stack[cs->depth - 1].name);
+ cs->depth--;
+ }
+
+ extra_indent = cs->inlined_depth * 2;
+ } else {
+ extra_indent = 0;
+ }
+
+ fprintf(out, "%.*s%*s%s\n",
+ (int)(pipe_char - line + 1), line,
+ leading_spaces + extra_indent, "", func_start);
+ return 0;
+ }
+
+ /* It's an entry or a leaf call */
+ has_open_brace = (strchr(func_start, '{') != NULL);
+ has_semicolon = (strchr(func_start, ';') != NULL);
+
+ if (ftrace_parse_retaddr(func_start, caller_sym, sizeof(caller_sym), &caller_offset)) {
+ has_retaddr = true;
+ num_inlines = ftrace_resolve_inlines(ftrace->machine, caller_sym,
+ caller_offset, inlined_names,
+ FTRACE_MAX_INLINES);
+ }
+
+ /* Determine which inlined frames are currently open above the caller */
+ caller_idx = -1;
+ if (has_retaddr) {
+ for (i = cs->depth - 1; i >= 0; i--) {
+ if (!cs->stack[i].inlined && cs->stack[i].name &&
+ strcmp(cs->stack[i].name, caller_sym) == 0) {
+ caller_idx = i;
+ break;
+ }
+ }
+
+ /* If caller is not on the tracked stack, do not synthesise inlines */
+ if (caller_idx < 0) {
+ for (i = 0; i < num_inlines; i++)
+ free((void *)inlined_names[i]);
+ num_inlines = 0;
+ }
+ }
+
+ active_inlines = 0;
+ if (caller_idx >= 0) {
+ for (i = caller_idx + 1; i < cs->depth; i++) {
+ if (cs->stack[i].inlined)
+ active_inlines++;
+ else
+ break;
+ }
+ }
+
+ /* Find common prefix of inlined functions */
+ common = 0;
+ if (caller_idx >= 0) {
+ while (common < active_inlines && common < num_inlines &&
+ cs->stack[caller_idx + 1 + common].name &&
+ !strcmp(cs->stack[caller_idx + 1 + common].name,
+ inlined_names[common])) {
+ common++;
+ }
+ }
+
+ /* Close inlined frames that are no longer active */
+ while (active_inlines > common && cs->depth > 0) {
+ if (cs->stack[cs->depth - 1].inlined) {
+ struct ftrace_stack_frame *top = &cs->stack[cs->depth - 1];
+ int exit_indent = top->indent;
+
+ if (cs->inlined_depth > 0)
+ cs->inlined_depth--;
+ fprintf(out, "%s%*s} /* %s (inline) */\n",
+ blank_prefix, exit_indent, "", top->name);
+ free(top->name);
+ cs->depth--;
+ active_inlines--;
+ } else {
+ break;
+ }
+ }
+
+ /* Open new inlined frames */
+ for (i = common; i < num_inlines; i++) {
+ int entry_indent = leading_spaces + cs->inlined_depth * 2;
+
+ if (!inlined_names[i]) {
+ pr_err("Not enough memory\n");
+ for (int j = 0; j < num_inlines; j++)
+ free((void *)inlined_names[j]);
+ return -ENOMEM;
+ }
+ if (cs->depth >= FTRACE_MAX_STACK)
+ break;
+
+ fprintf(out, "%s%*s%s() { /* (inline) */\n",
+ blank_prefix, entry_indent, "", inlined_names[i]);
+ cs->stack[cs->depth].name = strdup(inlined_names[i]);
+ if (!cs->stack[cs->depth].name) {
+ pr_err("Not enough memory\n");
+ for (int j = 0; j < num_inlines; j++)
+ free((void *)inlined_names[j]);
+ return -ENOMEM;
+ }
+ cs->stack[cs->depth].inlined = true;
+ cs->stack[cs->depth].indent = entry_indent;
+ cs->depth++;
+ cs->inlined_depth++;
+ }
+
+ /* Print current line with updated indentation */
+ extra_indent = cs->inlined_depth * 2;
+
+ if (ftrace->filter_retaddr) {
+ char *filtered = strdup(func_start);
+
+ if (filtered) {
+ ftrace_filter_retaddr(filtered);
+ fprintf(out, "%.*s%*s%s\n",
+ (int)(pipe_char - line + 1), line,
+ leading_spaces + extra_indent, "", filtered);
+ free(filtered);
+ } else {
+ pr_err("Not enough memory\n");
+ for (i = 0; i < num_inlines; i++)
+ free((void *)inlined_names[i]);
+ return -ENOMEM;
+ }
+ } else {
+ fprintf(out, "%.*s%*s%s\n",
+ (int)(pipe_char - line + 1), line,
+ leading_spaces + extra_indent, "", func_start);
+ }
+
+ /* If non-leaf entry, push onto stack */
+ if (has_open_brace && !has_semicolon) {
+ char entry_name[128];
+
+ extract_entry_func_name(func_start, entry_name, sizeof(entry_name));
+ if (cs->depth < FTRACE_MAX_STACK) {
+ cs->stack[cs->depth].name = strdup(entry_name);
+ if (!cs->stack[cs->depth].name) {
+ pr_err("Not enough memory\n");
+ for (i = 0; i < num_inlines; i++)
+ free((void *)inlined_names[i]);
+ return -ENOMEM;
+ }
+ cs->stack[cs->depth].inlined = false;
+ cs->stack[cs->depth].indent = leading_spaces + extra_indent;
+ cs->depth++;
+ }
+ }
+
+ for (i = 0; i < num_inlines; i++)
+ free((void *)inlined_names[i]);
+ return 0;
+}
+
+/**
+ * perf_ftrace__setup_inlines - Initialise symbol resolution for inlines
+ * @ftrace: Perf ftrace context
+ *
+ * Initialise symbol tracking and load the kernel image (vmlinux) for
+ * DWARF debug information parsing.
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+int perf_ftrace__setup_inlines(struct perf_ftrace *ftrace)
+{
+ struct map *kmap;
+
+ if (!ftrace->use_inline)
+ return 0;
+
+ symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL);
+ symbol_conf.inline_name = true;
+ if (symbol_conf.vmlinux_name)
+ symbol_conf.ignore_vmlinux_buildid = true;
+
+ if (symbol__init(NULL) < 0) {
+ pr_warning("Failed to initialize symbols for inlined functions\n");
+ return -1;
+ }
+
+ ftrace->machine = machine__new_host(NULL);
+ if (!ftrace->machine) {
+ pr_warning("Failed to create host machine for symbols\n");
+ return -1;
+ }
+
+ if (symbol_conf.vmlinux_name) {
+ kmap = machine__kernel_map(ftrace->machine);
+ if (kmap)
+ dso__load_vmlinux(map__dso(kmap), kmap, symbol_conf.vmlinux_name, false);
+ } else {
+ machine__load_vmlinux_path(ftrace->machine);
+ }
+
+ return 0;
+}
+
+/**
+ * perf_ftrace__cleanup_inlines - Clean up resources used for inline resolution
+ * @ftrace: Perf ftrace context
+ *
+ * Free the machine context and the CPU stack tracking states.
+ */
+void perf_ftrace__cleanup_inlines(struct perf_ftrace *ftrace)
+{
+ if (ftrace->machine) {
+ machine__delete(ftrace->machine);
+ ftrace->machine = NULL;
+ }
+ ftrace_cpu_states__clear();
+}
diff --git a/tools/perf/util/ftrace.h b/tools/perf/util/ftrace.h
index 50216d3fef64..4140902d9de6 100644
--- a/tools/perf/util/ftrace.h
+++ b/tools/perf/util/ftrace.h
@@ -41,6 +41,8 @@ struct perf_ftrace {
int graph_tail;
bool filter_retaddr;
bool filter_retaddr_set;
+ bool use_inline;
+ struct machine *machine;
};
struct filter_entry {
@@ -95,7 +97,16 @@ perf_ftrace__latency_cleanup_bpf(struct perf_ftrace *ftrace __maybe_unused)
#endif /* HAVE_BPF_SKEL */
+struct machine;
+
bool ftrace_parse_retaddr(const char *str, char *sym_name, size_t sym_len, u64 *offset);
void ftrace_filter_retaddr(char *str);
+int ftrace_resolve_inlines(struct machine *machine,
+ const char *sym_name, u64 offset,
+ const char **inlined_names, int max_inlines);
+int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FILE *out);
+void ftrace_cpu_states__clear(void);
+int perf_ftrace__setup_inlines(struct perf_ftrace *ftrace);
+void perf_ftrace__cleanup_inlines(struct perf_ftrace *ftrace);
#endif /* __PERF_FTRACE_H__ */
--
2.55.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 3/5] perf ftrace: Support display of inlined functions in function graph tracer
2026-10-14 16:14 ` [PATCH perf-tools-next v4 3/5] perf ftrace: Support display of inlined functions in function graph tracer Aaron Tomlin
@ 2026-10-14 16:27 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-10-14 16:27 UTC (permalink / raw)
To: Aaron Tomlin; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] perf: buffer overflow in make_blank_prefix() due to unclamped loop bounds
- [Medium] perf ftrace: parser stack desynchronization on FTRACE_MAX_STACK saturation
- [Low] perf/ftrace: stale real frames prevent inactive inlines from being popped
--
commit 74f9ce28f357fc14d2ef1925d4b8504c439b4901
Author: Aaron Tomlin <atomlin@atomlin.com>
perf ftrace: Support display of inlined functions in function graph tracer
This commit introduces the --inline option to perf ftrace for the
function_graph tracer. It leverages DWARF debug information from the
kernel image to resolve return addresses to their inlined callchains and
synthesizes intermediate frames directly into the streamed call graph.
diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
--- a/tools/perf/util/ftrace.c
+++ b/tools/perf/util/ftrace.c
[ ... ]
> +static void make_blank_prefix(const struct perf_ftrace *ftrace, const char *line,
> + const char *pipe_char, char *buf, size_t size)
> +{
> + size_t len = pipe_char - line + 1;
> + const char *start_delim = NULL;
> + char *c;
> +
> + if (len >= size)
> + len = size - 1;
> +
> + memcpy(buf, line, len);
> + buf[len] = '\0';
> +
> + if (*pipe_char == '|') {
[ ... ]
> + if (start_delim && start_delim < pipe_char) {
> + for (c = buf + (start_delim - line) + 1; c < buf + (pipe_char - line); c++)
> + *c = ' ';
[Severity: Medium]
Does this code overflow the buf array?
The buf array is populated from a fixed 128-byte array (blank_prefix) in the
caller. The earlier memcpy is safely clamped to size - 1, but this loop bound
uses the unclamped distance pipe_char - line.
If a trace line has an exceptionally long prefix (such as from a long comm
string or malformed input), could pipe_char - line exceed the buffer size and
cause out-of-bounds writes on the stack?
> + }
> + }
> +}
[ ... ]
> +int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FILE *out)
> +{
[ ... ]
> + if (is_exit) {
> + char exit_name[128];
> +
> + extract_exit_func_name(func_start, exit_name, sizeof(exit_name));
> +
> + /* Find matching frame on stack */
> + match_idx = -1;
> + for (i = cs->depth - 1; i >= 0; i--) {
> + if (!cs->stack[i].inlined) {
> + if (exit_name[0] == '\0' ||
> + (cs->stack[i].name &&
> + strcmp(cs->stack[i].name, exit_name) == 0)) {
> + match_idx = i;
> + break;
> + }
> + }
> + }
[Severity: Medium]
Can this cause parser stack desynchronization on deep call stacks?
If a trace contains more than FTRACE_MAX_STACK (256) nested frames, the
push logic correctly drops them to prevent overflowing the stack tracking.
However, when these untracked frames exit, their trace lines often contain
bare closing braces, which results in exit_name[0] == '\0'.
Will this unconditionally match the topmost valid non-inlined frame on the
stack and pop it prematurely, permanently desynchronizing the stack state
and breaking inline resolution for subsequent callers?
[ ... ]
> + /* Close inlined frames that are no longer active */
> + while (active_inlines > common && cs->depth > 0) {
> + if (cs->stack[cs->depth - 1].inlined) {
> + struct ftrace_stack_frame *top = &cs->stack[cs->depth - 1];
> + int exit_indent = top->indent;
> +
> + if (cs->inlined_depth > 0)
> + cs->inlined_depth--;
> + fprintf(out, "%s%*s} /* %s (inline) */\n",
> + blank_prefix, exit_indent, "", top->name);
> + free(top->name);
> + cs->depth--;
> + active_inlines--;
> + } else {
> + break;
> + }
> + }
[Severity: Low]
Can stale real frames prevent inactive inlined frames from being popped?
If a function exit event is dropped (for example, due to a ring buffer
overwrite), the corresponding real frame remains on the stack. When the next
entry event is processed and we attempt to close inactive inlined frames above
the caller, the loop breaks immediately upon encountering this stale real frame.
Does this leave the inactive inlines stuck on the stack, corrupting the
nesting and indentation of subsequent call graph output?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161457.373253-1-atomlin@atomlin.com?part=3
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH perf-tools-next v4 4/5] perf ftrace: Support omitting execution duration in function graph tracer
2026-10-14 16:14 [PATCH perf-tools-next v4 0/5] perf ftrace: Support inlined functions and display enhancements in function graph tracer Aaron Tomlin
` (2 preceding siblings ...)
2026-10-14 16:14 ` [PATCH perf-tools-next v4 3/5] perf ftrace: Support display of inlined functions in function graph tracer Aaron Tomlin
@ 2026-10-14 16:14 ` Aaron Tomlin
2026-10-14 16:22 ` sashiko-bot
2026-10-14 16:14 ` [PATCH perf-tools-next v4 5/5] perf ftrace: Filter extraneous functions " Aaron Tomlin
4 siblings, 1 reply; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 16:14 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
atomlin, linux-perf-users, linux-kernel
The Linux kernel's function graph tracer displays the execution duration
of completed functions by default via the funcgraph-duration trace
option. Whilst informative, in scenarios where the user is solely
interested in the call graph topology, call flow sequence, or inlined
hierarchy, the duration column can add visual clutter and widen each
trace line.
Introduce support for omitting function duration by exposing the
noduration sub-option under --graph-opts. Consistent with the existing
nosleep-time and noirqs sub-options, it accepts an optional value, so
noduration=0 explicitly retains the duration column; when specified
more than once, the last occurrence takes effect. When enabled, perf
ftrace configures the kernel's tracing instance option
funcgraph-duration to 0, and restores it to 1 upon resetting tracing
options.
Because the profile subcommand fundamentally requires function execution
duration to compute timing statistics and call counts, combining
noduration with perf ftrace profile is rejected with an explicit error.
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
tools/perf/Documentation/perf-ftrace.txt | 1 +
tools/perf/builtin-ftrace.c | 34 ++++++++++++-
tools/perf/tests/ftrace.c | 64 ++++++++++++++++++++++--
tools/perf/util/ftrace.c | 18 +++++--
tools/perf/util/ftrace.h | 1 +
5 files changed, 109 insertions(+), 9 deletions(-)
diff --git a/tools/perf/Documentation/perf-ftrace.txt b/tools/perf/Documentation/perf-ftrace.txt
index 445c8ccc22d2..a50f3bae86b2 100644
--- a/tools/perf/Documentation/perf-ftrace.txt
+++ b/tools/perf/Documentation/perf-ftrace.txt
@@ -129,6 +129,7 @@ OPTIONS for 'perf ftrace trace'
- retaddr - Show function return address.
- nosleep-time - Measure on-CPU time only for function_graph tracer.
- noirqs - Ignore functions that happen inside interrupt.
+ - noduration - Do not print function duration.
- verbose - Show process names, PIDs, timestamps, etc.
- thresh=<n> - Setup trace duration threshold in microseconds.
- depth=<n> - Set max depth for function graph tracer to follow.
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index 2707d3d62bca..1c86e0a711bd 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -299,6 +299,7 @@ static void reset_tracing_options(struct perf_ftrace *ftrace __maybe_unused)
write_tracing_option_file("func_stack_trace", "0");
write_tracing_option_file("sleep-time", "1");
write_tracing_option_file("funcgraph-irqs", "1");
+ write_tracing_option_file("funcgraph-duration", "1");
write_tracing_option_file("funcgraph-proc", "0");
write_tracing_option_file("funcgraph-abstime", "0");
write_tracing_option_file("funcgraph-tail", "0");
@@ -598,6 +599,26 @@ static int set_tracing_funcgraph_irqs(struct perf_ftrace *ftrace)
return 0;
}
+/**
+ * set_tracing_funcgraph_duration - Set funcgraph-duration tracing option
+ * @ftrace: Perf ftrace context
+ *
+ * Configure the kernel's funcgraph-duration tracing option based on the
+ * ftrace->graph_noduration flag.
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+static int set_tracing_funcgraph_duration(struct perf_ftrace *ftrace)
+{
+ if (!ftrace->graph_noduration)
+ return 0;
+
+ if (write_tracing_option_file("funcgraph-duration", "0") < 0)
+ return -1;
+
+ return 0;
+}
+
static int set_tracing_funcgraph_verbose(struct perf_ftrace *ftrace)
{
if (!ftrace->graph_verbose)
@@ -707,6 +728,11 @@ static int set_tracing_options(struct perf_ftrace *ftrace)
return -1;
}
+ if (set_tracing_funcgraph_duration(ftrace) < 0) {
+ pr_err("failed to set tracing option funcgraph-duration\n");
+ return -1;
+ }
+
if (set_tracing_funcgraph_verbose(ftrace) < 0) {
pr_err("failed to set tracing option funcgraph-proc/funcgraph-abstime\n");
return -1;
@@ -1760,6 +1786,7 @@ static int parse_graph_tracer_opts(const struct option *opt,
{ .name = "retaddr", .value_ptr = &ftrace->graph_retaddr },
{ .name = "nosleep-time", .value_ptr = &ftrace->graph_nosleep_time },
{ .name = "noirqs", .value_ptr = &ftrace->graph_noirqs },
+ { .name = "noduration", .value_ptr = &ftrace->graph_noduration },
{ .name = "verbose", .value_ptr = &ftrace->graph_verbose },
{ .name = "thresh", .value_ptr = &ftrace->graph_thresh },
{ .name = "depth", .value_ptr = &ftrace->graph_depth },
@@ -1849,7 +1876,7 @@ int cmd_ftrace(int argc, const char **argv)
OPT_CALLBACK('g', "nograph-funcs", &ftrace.nograph_funcs, "func",
"Set nograph filter on given functions", parse_filter_func),
OPT_CALLBACK(0, "graph-opts", &ftrace, "options",
- "Graph tracer options, available options: args,retval,retval-hex,retaddr,nosleep-time,noirqs,verbose,thresh=<n>,depth=<n>",
+ "Graph tracer options, available options: args,retval,retval-hex,retaddr,nosleep-time,noirqs,noduration,verbose,thresh=<n>,depth=<n>,tail",
parse_graph_tracer_opts),
OPT_CALLBACK('m', "buffer-size", &ftrace.percpu_buffer_size, "size",
"Size of per cpu buffer, needs to use a B, K, M or G suffix.", parse_buffer_size),
@@ -2056,6 +2083,11 @@ int cmd_ftrace(int argc, const char **argv)
cmd_func = __cmd_latency;
break;
case PERF_FTRACE_PROFILE:
+ if (ftrace.graph_noduration) {
+ pr_err("Error: 'noduration' option cannot be used with profile\n");
+ ret = -EINVAL;
+ goto out_delete_filters;
+ }
cmd_func = __cmd_profile;
break;
case PERF_FTRACE_NONE:
diff --git a/tools/perf/tests/ftrace.c b/tools/perf/tests/ftrace.c
index eacdee1dde86..24b5bd4a1e03 100644
--- a/tools/perf/tests/ftrace.c
+++ b/tools/perf/tests/ftrace.c
@@ -97,6 +97,18 @@ static int test_inline_processing(void)
" 1234.567890 | 0) bash-1234 | | activate_task() { /* (inline) */";
static const char line_verbose_inline_exit[] =
" 1234.567890 | 0) bash-1234 | | } /* activate_task (inline) */";
+ static const char line_verbose_nodur_entry[] =
+ " 1234.567890 | 0) bash-1234 | wake_up_new_task() {";
+ static const char line_verbose_nodur_enqueue[] =
+ " 1234.567890 | 0) bash-1234 | enqueue_task() { /* <-wake_up_new_task+0x1d1/0x3e0 */";
+ static const char line_verbose_nodur_exit_enqueue[] =
+ " 1234.567890 | 0) bash-1234 | } /* enqueue_task */";
+ static const char line_verbose_nodur_exit_task[] =
+ " 1234.567890 | 0) bash-1234 | } /* wake_up_new_task */";
+ static const char line_verbose_nodur_inline_entry[] =
+ " 1234.567890 | 0) bash-1234 | activate_task() { /* (inline) */";
+ static const char line_verbose_nodur_inline_exit[] =
+ " 1234.567890 | 0) bash-1234 | } /* activate_task (inline) */";
struct perf_ftrace ftrace;
char *out_buf = NULL;
size_t out_len = 0;
@@ -292,6 +304,33 @@ static int test_inline_processing(void)
free(out_buf);
out_buf = NULL;
ftrace.graph_verbose = false;
+
+ /* Test verbose noduration prefix formatting for synthesised inlines */
+ ftrace.graph_verbose = true;
+ ftrace.graph_noduration = true;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_cleanup;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_verbose_nodur_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_nodur_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_nodur_exit_enqueue, out);
+ ftrace_process_fgraph_line(&ftrace, line_verbose_nodur_exit_task, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ TEST_CHECK("verbose noduration inline entry preserves comm-pid",
+ strstr(out_buf, line_verbose_nodur_inline_entry) != NULL);
+ TEST_CHECK("verbose noduration inline exit preserves comm-pid",
+ strstr(out_buf, line_verbose_nodur_inline_exit) != NULL);
+
+ free(out_buf);
+ out_buf = NULL;
+ ftrace.graph_verbose = false;
+ ftrace.graph_noduration = false;
}
out_cleanup:
@@ -343,20 +382,36 @@ static int test_column_layouts(void)
{
static const struct {
const char *desc;
- bool verbose;
+ bool noduration;
+ bool verbose;
const char *in;
const char *expected;
} cases[] = {
{
- "default layout", false,
+ "default layout", false, false,
" 7) | wake_up_new_task() { /* <-kernel_clone+0x160/0x510 */",
" 7) | wake_up_new_task() {\n",
},
{
- "verbose layout", true,
+ "noduration layout", true, false,
+ " 7) housekeeping_any_cpu(); /* <-ring_buffer_unlock_commit+0x1a0/0x1f0 */",
+ " 7) housekeeping_any_cpu();\n",
+ },
+ {
+ "verbose layout", false, true,
" 1234.567890 | 7) bash-1234 | | wake_up_new_task() { /* <-kernel_clone+0x160/0x510 */",
" 1234.567890 | 7) bash-1234 | | wake_up_new_task() {\n",
},
+ {
+ "verbose noduration layout", true, true,
+ " 1234.567890 | 7) bash-1234 | wake_up_new_task() { /* <-kernel_clone+0x160/0x510 */",
+ " 1234.567890 | 7) bash-1234 | wake_up_new_task() {\n",
+ },
+ {
+ "noduration context switch marker", true, false,
+ " 7) bash-1234 => sh-5678",
+ " 7) bash-1234 => sh-5678\n",
+ },
};
struct perf_ftrace ftrace;
char *out_buf = NULL;
@@ -368,7 +423,8 @@ static int test_column_layouts(void)
memset(&ftrace, 0, sizeof(ftrace));
ftrace.use_inline = true;
ftrace.filter_retaddr = true;
- ftrace.graph_verbose = cases[i].verbose;
+ ftrace.graph_noduration = cases[i].noduration;
+ ftrace.graph_verbose = cases[i].verbose;
out = open_memstream(&out_buf, &out_len);
if (!out)
diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
index 8a7f8f6eead1..0602e2cc1793 100644
--- a/tools/perf/util/ftrace.c
+++ b/tools/perf/util/ftrace.c
@@ -292,6 +292,9 @@ static void make_blank_prefix(const struct perf_ftrace *ftrace, const char *line
memcpy(buf, line, len);
buf[len] = '\0';
+ if (ftrace->graph_noduration)
+ return;
+
if (*pipe_char == '|') {
if (ftrace->graph_verbose) {
/* In verbose mode, duration starts after the comm-pid '|' */
@@ -326,10 +329,12 @@ static void make_blank_prefix(const struct perf_ftrace *ftrace, const char *line
* [ abstime |] CPU) [ comm-pid |] [ duration |] func
*
* The abstime and comm-pid columns are only present with --graph-opts
- * verbose.
+ * verbose, whereas the duration column, and thus its '|' delimiter, is
+ * omitted with --graph-opts noduration.
*
* Return: A pointer to the last character of the context columns (the final
- * '|' delimiter). Returns NULL if @line is not a trace record.
+ * '|' delimiter, or the CPU ')' when no delimiter follows it). Returns NULL
+ * if @line is not a trace record (e.g. a header or a context switch marker).
*/
static const char *find_func_column(const struct perf_ftrace *ftrace,
const char *line, int *cpu)
@@ -357,9 +362,14 @@ static const char *find_func_column(const struct perf_ftrace *ftrace,
return NULL;
}
- p = strchr(p + 1, '|');
- if (!p)
+ if (!ftrace->graph_noduration) {
+ p = strchr(p + 1, '|');
+ if (!p)
+ return NULL;
+ } else if (strstr(p, " => ")) {
+ /* Context switch marker: " CPU) comm-pid => comm-pid" */
return NULL;
+ }
*cpu = (int)val;
return p;
diff --git a/tools/perf/util/ftrace.h b/tools/perf/util/ftrace.h
index 4140902d9de6..d202a09d112f 100644
--- a/tools/perf/util/ftrace.h
+++ b/tools/perf/util/ftrace.h
@@ -36,6 +36,7 @@ struct perf_ftrace {
int graph_retaddr;
int graph_nosleep_time;
int graph_noirqs;
+ int graph_noduration;
int graph_verbose;
int graph_thresh;
int graph_tail;
--
2.55.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 4/5] perf ftrace: Support omitting execution duration in function graph tracer
2026-10-14 16:14 ` [PATCH perf-tools-next v4 4/5] perf ftrace: Support omitting execution duration " Aaron Tomlin
@ 2026-10-14 16:22 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-10-14 16:22 UTC (permalink / raw)
To: Aaron Tomlin; +Cc: linux-perf-users
> The Linux kernel's function graph tracer displays the execution duration
> of completed functions by default via the funcgraph-duration trace
> option. Whilst informative, in scenarios where the user is solely
> interested in the call graph topology, call flow sequence, or inlined
> hierarchy, the duration column can add visual clutter and widen each
> trace line.
>
> Introduce support for omitting function duration by exposing the
> noduration sub-option under --graph-opts. Consistent with the existing
> nosleep-time and noirqs sub-options, it accepts an optional value, so
> noduration=0 explicitly retains the duration column; when specified
> more than once, the last occurrence takes effect. When enabled, perf
> ftrace configures the kernel's tracing instance option
> funcgraph-duration to 0, and restores it to 1 upon resetting tracing
> options.
>
> Because the profile subcommand fundamentally requires function execution
> duration to compute timing statistics and call counts, combining
> noduration with perf ftrace profile is rejected with an explicit error.
>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161457.373253-1-atomlin@atomlin.com?part=4
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH perf-tools-next v4 5/5] perf ftrace: Filter extraneous functions in function graph tracer
2026-10-14 16:14 [PATCH perf-tools-next v4 0/5] perf ftrace: Support inlined functions and display enhancements in function graph tracer Aaron Tomlin
` (3 preceding siblings ...)
2026-10-14 16:14 ` [PATCH perf-tools-next v4 4/5] perf ftrace: Support omitting execution duration " Aaron Tomlin
@ 2026-10-14 16:14 ` Aaron Tomlin
2026-10-14 16:26 ` sashiko-bot
4 siblings, 1 reply; 13+ messages in thread
From: Aaron Tomlin @ 2026-10-14 16:14 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
atomlin, linux-perf-users, linux-kernel
When tracing with the function graph tracer using a targeted filter
(-G or --graph-funcs), users occasionally observe unrelated functions in
the trace output:
1. Top-level functions (e.g. most notably
finish_task_switch.isra.0()) appearing before or alongside the
requested target function. This occurs because clearing and
rewriting set_graph_function creates a transient window where
remote CPUs still observe an empty filter (tracing all
functions) before RCU synchronisation completes, coupled with
perf ftrace sleeping in poll() on trace_pipe right as tracing
starts.
2. Detached/orphan calls inside the target callgraph (e.g.
housekeeping_any_cpu() and arch_irq_work_raise()) appearing as
child frames under the target function. These routines are
invoked by rb_wakeups() to notify perf's poll() on trace_pipe
whenever an event is committed, and execute while the target
function is on the CPU.
Resolve both issues deterministically in userspace:
1. Track active target callgraph state per CPU in
tools/perf/util/ftrace.c. Any entry not matching the requested
-G targets is suppressed along with its nested children until
its scope exits. When a target function is matched (at root or
nested depths), record its root depth; for leaf target calls,
immediately reset the filter state upon completion to ensure
subsequent sibling functions remain suppressed.
2. Within an active target callgraph, validate that child entries
descend from an active frame on the target stack using their
return addresses (CONFIG_FUNCTION_GRAPH_RETADDR). Any detached
calls originating outside the target hierarchy (such as
ring-buffer wakeups) are suppressed along with their subtrees.
For example:
# tracer: function_graph
#
# CPU FUNCTION CALLS
# | | | | |
3) activate_task() {
3) enqueue_task() {
3) psi_enqueue() { /* (inline) */
3) arch_static_branch_jump() { /* (inline) */
3) enqueue_task_fair() {
3) enqueue_hierarchy() { /* (inline) */
3) update_curr();
3) enqueue_entity() {
3) account_entity_enqueue() { /* (inline) */
3) account_llc_enqueue();
3) } /* account_entity_enqueue (inline) */
3) }
3) } /* enqueue_hierarchy (inline) */
3) place_entity() {
3) avg_vruntime();
3) }
3) __enqueue_entity();
3) dl_server_start();
3) }
3) } /* arch_static_branch_jump (inline) */
3) } /* psi_enqueue (inline) */
3) sched_info_enqueue() { /* (inline) */
3) psi_task_change() {
3) psi_write_begin() { /* (inline) */
3) psi_flags_change();
3) } /* psi_write_begin (inline) */
3) psi_group_change() {
3) record_times();
3) }
3) }
3) } /* sched_info_enqueue (inline) */
3) }
3) }
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
tools/perf/tests/ftrace.c | 273 ++++++++++++++++++++++++++++++++++++++
tools/perf/util/ftrace.c | 176 +++++++++++++++++++++++-
2 files changed, 443 insertions(+), 6 deletions(-)
diff --git a/tools/perf/tests/ftrace.c b/tools/perf/tests/ftrace.c
index 24b5bd4a1e03..1ae81b3efc2e 100644
--- a/tools/perf/tests/ftrace.c
+++ b/tools/perf/tests/ftrace.c
@@ -447,6 +447,275 @@ static int test_column_layouts(void)
return TEST_OK;
}
+static int test_graph_target_filter(void)
+{
+ static const char line_idle[] = " 7) 3.000 us | sched_idle_set_state();";
+ static const char line_sw_entry[] = " 6) | finish_task_switch.isra.0() {";
+ static const char line_sw_child[] = " 6) 1.000 us | _raw_spin_unlock();";
+ static const char line_sw_exit[] = " 6) 2.000 us | }";
+ static const char line_tgt_entry[] = " 2) | activate_task() {";
+ static const char line_tgt_child[] = " 2) 1.500 us | enqueue_task();";
+ static const char line_tgt_exit[] = " 2) 2.500 us | }";
+ struct perf_ftrace ftrace;
+ struct filter_entry *entry;
+ struct filter_entry *pos, *tmp;
+ char *out_buf = NULL;
+ size_t out_len = 0;
+ FILE *out;
+ int ret = TEST_OK;
+
+ memset(&ftrace, 0, sizeof(ftrace));
+ INIT_LIST_HEAD(&ftrace.graph_funcs);
+
+ entry = malloc(sizeof(*entry) + strlen("activate_task") + 1);
+ if (!entry)
+ return TEST_FAIL;
+ strcpy(entry->name, "activate_task");
+ list_add_tail(&entry->list, &ftrace.graph_funcs);
+
+ /* 1. Test without --inline */
+ ftrace.use_inline = false;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_idle, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_exit, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_exit, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ if (strstr(out_buf, "sched_idle_set_state")) {
+ pr_debug("FAILED: sched_idle_set_state not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "finish_task_switch")) {
+ pr_debug("FAILED: finish_task_switch not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "_raw_spin_unlock")) {
+ pr_debug("FAILED: _raw_spin_unlock not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "activate_task() {")) {
+ pr_debug("FAILED: activate_task entry missing\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "enqueue_task();")) {
+ pr_debug("FAILED: enqueue_task child missing\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* 2. Test with --inline */
+ ftrace.use_inline = true;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_idle, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_exit, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_exit, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ pr_debug("Target filter output with --inline:\n%s\n", out_buf);
+
+ if (strstr(out_buf, "finish_task_switch")) {
+ pr_debug("FAILED: finish_task_switch not suppressed with --inline\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "activate_task() {")) {
+ pr_debug("FAILED: activate_task entry missing with --inline\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* 3. Test suppressing detached orphan calls within target graph */
+ ftrace.use_inline = true;
+ ftrace.filter_retaddr = 1;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_tgt_entry, out);
+ /* Leaf orphan call from ring_buffer_unlock_commit */
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | housekeeping_any_cpu(); /* <-ring_buffer_unlock_commit+0x1a0/0x1f0 */",
+ out);
+ /* Non-leaf orphan call from irq_work_queue_on */
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | arch_irq_work_raise() { /* <-irq_work_queue_on+0x81/0xa0 */",
+ out);
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | apic_wait_icr_idle() { /* (inline) */",
+ out);
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | x2apic_send_IPI_self();",
+ out);
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | } /* apic_wait_icr_idle (inline) */",
+ out);
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) 1.000 us | }",
+ out);
+ /* Genuine child call from activate_task */
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) | enqueue_task() { /* <-activate_task+0x1d1/0x3e0 */",
+ out);
+ ftrace_process_fgraph_line(&ftrace,
+ " 2) 1.500 us | }",
+ out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_exit, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ pr_debug("Orphan call filter output:\n%s\n", out_buf);
+
+ if (strstr(out_buf, "housekeeping_any_cpu")) {
+ pr_debug("FAILED: housekeeping_any_cpu orphan not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "arch_irq_work_raise")) {
+ pr_debug("FAILED: arch_irq_work_raise orphan not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "x2apic_send_IPI_self")) {
+ pr_debug("FAILED: x2apic_send_IPI_self not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "enqueue_task() {")) {
+ pr_debug("FAILED: genuine enqueue_task missing\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* 4. Test targeted leaf call at depth > 0 resetting filter */
+ ftrace.use_inline = false;
+ list_for_each_entry_safe(pos, tmp, &ftrace.graph_funcs, list) {
+ list_del(&pos->list);
+ free(pos);
+ }
+ entry = malloc(sizeof(*entry) + strlen("enqueue_task") + 1);
+ if (!entry) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ strcpy(entry->name, "enqueue_task");
+ list_add_tail(&entry->list, &ftrace.graph_funcs);
+
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_sw_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_exit, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ if (strstr(out_buf, "finish_task_switch")) {
+ pr_debug("FAILED: finish_task_switch not suppressed\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "enqueue_task();")) {
+ pr_debug("FAILED: targeted leaf enqueue_task missing\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "_raw_spin_unlock")) {
+ pr_debug("FAILED: sibling _raw_spin_unlock not suppressed after leaf target\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ free(out_buf);
+ out_buf = NULL;
+
+ /* 5. Test targeted leaf call at depth > 0 with inlines resetting filter */
+ ftrace.use_inline = true;
+ out = open_memstream(&out_buf, &out_len);
+ if (!out) {
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ ftrace_process_fgraph_line(&ftrace, line_sw_entry, out);
+ ftrace_process_fgraph_line(&ftrace, line_tgt_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_child, out);
+ ftrace_process_fgraph_line(&ftrace, line_sw_exit, out);
+
+ fclose(out);
+ ftrace_cpu_states__clear();
+
+ if (strstr(out_buf, "finish_task_switch")) {
+ pr_debug("FAILED: finish_task_switch not suppressed with inlines\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (!strstr(out_buf, "enqueue_task();")) {
+ pr_debug("FAILED: targeted leaf enqueue_task missing with inlines\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+ if (strstr(out_buf, "_raw_spin_unlock")) {
+ pr_debug("FAILED: sibling _raw_spin_unlock leaked with inlines\n");
+ ret = TEST_FAIL;
+ goto out_free_filter;
+ }
+
+ free(out_buf);
+ out_buf = NULL;
+
+out_free_filter:
+ if (out_buf)
+ free(out_buf);
+ list_for_each_entry_safe(pos, tmp, &ftrace.graph_funcs, list) {
+ list_del(&pos->list);
+ free(pos);
+ }
+ return ret;
+}
+
static int test__ftrace(struct test_suite *test __maybe_unused, int subtest __maybe_unused)
{
int ret;
@@ -467,6 +736,10 @@ static int test__ftrace(struct test_suite *test __maybe_unused, int subtest __ma
if (ret != TEST_OK)
return ret;
+ ret = test_graph_target_filter();
+ if (ret != TEST_OK)
+ return ret;
+
ret = test_inline_processing();
if (ret != TEST_OK)
return ret;
diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
index 0602e2cc1793..2b065293bfb9 100644
--- a/tools/perf/util/ftrace.c
+++ b/tools/perf/util/ftrace.c
@@ -34,6 +34,9 @@ struct ftrace_cpu_state {
struct ftrace_stack_frame stack[FTRACE_MAX_STACK];
int depth;
int inlined_depth;
+ bool in_target;
+ int target_root_depth;
+ int orphan_depth;
};
static struct ftrace_cpu_state *ftrace_cpu_states[FTRACE_MAX_CPUS];
@@ -407,6 +410,39 @@ static int print_line(struct perf_ftrace *ftrace, const char *line, FILE *out)
return 0;
}
+static inline bool ftrace_has_graph_funcs(const struct perf_ftrace *ftrace)
+{
+ return ftrace->graph_funcs.next != NULL && !list_empty(&ftrace->graph_funcs);
+}
+
+/**
+ * ftrace_is_graph_func - Check if a function matches the graph_funcs target filter
+ * @ftrace: Perf ftrace context
+ * @func_name: The function name to test
+ *
+ * Return: true if ftrace->graph_funcs is empty or @func_name matches a
+ * target filter, false otherwise.
+ */
+static bool ftrace_is_graph_func(const struct perf_ftrace *ftrace, const char *func_name)
+{
+ struct filter_entry *pos;
+
+ if (!ftrace_has_graph_funcs(ftrace))
+ return true;
+
+ list_for_each_entry(pos, &ftrace->graph_funcs, list) {
+ size_t len = strlen(pos->name);
+
+ if (strcmp(pos->name, func_name) == 0)
+ return true;
+ if (!strncmp(pos->name, func_name, len) &&
+ (func_name[len] == '\0' || func_name[len] == '.'))
+ return true;
+ }
+
+ return false;
+}
+
/**
* ftrace_process_fgraph_line - Process and output a function graph trace line
* @ftrace: Perf ftrace context
@@ -443,8 +479,9 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
bool has_open_brace;
bool has_semicolon;
bool has_retaddr = false;
+ bool has_filter = ftrace_has_graph_funcs(ftrace);
- if (!ftrace->use_inline)
+ if (!has_filter && !ftrace->use_inline)
return print_line(ftrace, line, out);
pipe_char = find_func_column(ftrace, line, &cpu);
@@ -469,6 +506,11 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
if (is_exit) {
char exit_name[128];
+ if (cs->orphan_depth > 0) {
+ cs->orphan_depth--;
+ return 0;
+ }
+
extract_exit_func_name(func_start, exit_name, sizeof(exit_name));
/* Find matching frame on stack */
@@ -494,8 +536,9 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
if (cs->inlined_depth > 0)
cs->inlined_depth--;
- fprintf(out, "%s%*s} /* %s (inline) */\n",
- blank_prefix, exit_indent, "", top->name);
+ if (!has_filter || cs->in_target)
+ fprintf(out, "%s%*s} /* %s (inline) */\n",
+ blank_prefix, exit_indent, "", top->name);
}
free(top->name);
cs->depth--;
@@ -513,9 +556,21 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
extra_indent = 0;
}
- fprintf(out, "%.*s%*s%s\n",
- (int)(pipe_char - line + 1), line,
- leading_spaces + extra_indent, "", func_start);
+ if (!has_filter || cs->in_target) {
+ if (!ftrace->use_inline) {
+ print_line(ftrace, line, out);
+ } else {
+ fprintf(out, "%.*s%*s%s\n",
+ (int)(pipe_char - line + 1), line,
+ leading_spaces + extra_indent, "", func_start);
+ }
+ }
+
+ if (has_filter && cs->in_target && cs->depth <= cs->target_root_depth) {
+ cs->in_target = false;
+ cs->target_root_depth = 0;
+ cs->orphan_depth = 0;
+ }
return 0;
}
@@ -523,6 +578,93 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
has_open_brace = (strchr(func_start, '{') != NULL);
has_semicolon = (strchr(func_start, ';') != NULL);
+ if (cs->orphan_depth > 0) {
+ if (has_open_brace && !has_semicolon)
+ cs->orphan_depth++;
+ return 0;
+ }
+
+ if (has_filter) {
+ if (cs->depth == 0 || !cs->in_target) {
+ char entry_name[128];
+
+ extract_entry_func_name(func_start, entry_name, sizeof(entry_name));
+ if (ftrace_is_graph_func(ftrace, entry_name)) {
+ cs->in_target = true;
+ cs->target_root_depth = cs->depth;
+ cs->orphan_depth = 0;
+ } else if (cs->depth == 0) {
+ cs->in_target = false;
+ cs->orphan_depth = 0;
+ }
+ }
+
+ if (!cs->in_target) {
+ /* Non-matching call tree; track depth if entering scope, suppress output */
+ if (has_open_brace && !has_semicolon) {
+ char entry_name[128];
+
+ extract_entry_func_name(func_start, entry_name, sizeof(entry_name));
+ if (cs->depth < FTRACE_MAX_STACK) {
+ cs->stack[cs->depth].name = strdup(entry_name);
+ if (!cs->stack[cs->depth].name) {
+ pr_err("Not enough memory\n");
+ return -ENOMEM;
+ }
+ cs->stack[cs->depth].inlined = false;
+ cs->stack[cs->depth].indent = leading_spaces;
+ cs->depth++;
+ }
+ }
+ return 0;
+ }
+ }
+
+ if (!ftrace->use_inline) {
+ if (has_filter && cs->in_target && cs->depth > cs->target_root_depth) {
+ if (ftrace_parse_retaddr(func_start, caller_sym,
+ sizeof(caller_sym), &caller_offset)) {
+ caller_idx = -1;
+ for (i = cs->depth - 1; i >= 0; i--) {
+ if (!cs->stack[i].inlined && cs->stack[i].name &&
+ strcmp(cs->stack[i].name, caller_sym) == 0) {
+ caller_idx = i;
+ break;
+ }
+ }
+ if (caller_idx < cs->target_root_depth) {
+ if (has_open_brace && !has_semicolon)
+ cs->orphan_depth = 1;
+ return 0;
+ }
+ }
+ }
+
+ if (has_open_brace && !has_semicolon) {
+ char entry_name[128];
+
+ extract_entry_func_name(func_start, entry_name, sizeof(entry_name));
+ if (cs->depth < FTRACE_MAX_STACK) {
+ cs->stack[cs->depth].name = strdup(entry_name);
+ if (!cs->stack[cs->depth].name) {
+ pr_err("Not enough memory\n");
+ return -ENOMEM;
+ }
+ cs->stack[cs->depth].inlined = false;
+ cs->stack[cs->depth].indent = leading_spaces;
+ cs->depth++;
+ }
+ }
+ print_line(ftrace, line, out);
+ if (has_filter && cs->in_target && cs->depth <= cs->target_root_depth &&
+ has_semicolon && !has_open_brace) {
+ cs->in_target = false;
+ cs->target_root_depth = 0;
+ cs->orphan_depth = 0;
+ }
+ return 0;
+ }
+
if (ftrace_parse_retaddr(func_start, caller_sym, sizeof(caller_sym), &caller_offset)) {
has_retaddr = true;
num_inlines = ftrace_resolve_inlines(ftrace->machine, caller_sym,
@@ -549,6 +691,21 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
}
}
+ /*
+ * When inside a target graph filter, child functions must descend
+ * from an active frame on the target stack. Suppress detached
+ * calls originating outside the target hierarchy.
+ */
+ if (has_filter && cs->in_target && cs->depth > cs->target_root_depth) {
+ if (has_retaddr && caller_idx < cs->target_root_depth) {
+ if (has_open_brace && !has_semicolon)
+ cs->orphan_depth = 1;
+ for (i = 0; i < num_inlines; i++)
+ free((void *)inlined_names[i]);
+ return 0;
+ }
+ }
+
active_inlines = 0;
if (caller_idx >= 0) {
for (i = caller_idx + 1; i < cs->depth; i++) {
@@ -659,6 +816,13 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
}
}
+ if (has_filter && cs->in_target && cs->depth <= cs->target_root_depth &&
+ has_semicolon && !has_open_brace) {
+ cs->in_target = false;
+ cs->target_root_depth = 0;
+ cs->orphan_depth = 0;
+ }
+
for (i = 0; i < num_inlines; i++)
free((void *)inlined_names[i]);
return 0;
--
2.55.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH perf-tools-next v4 5/5] perf ftrace: Filter extraneous functions in function graph tracer
2026-10-14 16:14 ` [PATCH perf-tools-next v4 5/5] perf ftrace: Filter extraneous functions " Aaron Tomlin
@ 2026-10-14 16:26 ` sashiko-bot
0 siblings, 0 replies; 13+ messages in thread
From: sashiko-bot @ 2026-10-14 16:26 UTC (permalink / raw)
To: Aaron Tomlin; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] perf/ftrace: filter state leak on leaf functions with inlines
- [Medium] perf: stack buffer overflow in make_blank_prefix()
--
commit 5c319821fcd67517723413eff78ea02ad9a706a1
Author: Aaron Tomlin <atomlin@atomlin.com>
perf ftrace: Filter extraneous functions in function graph tracer
This commit introduces a mechanism to track active callgraph state per CPU in
the perf ftrace function graph tracer. It suppresses unrelated top-level
functions and detached orphan calls from the trace output when using a
targeted filter.
> diff --git a/tools/perf/util/ftrace.c b/tools/perf/util/ftrace.c
> --- a/tools/perf/util/ftrace.c
> +++ b/tools/perf/util/ftrace.c
[ ... ]
> @@ -443,8 +479,9 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
> bool has_open_brace;
> bool has_semicolon;
> bool has_retaddr = false;
> + bool has_filter = ftrace_has_graph_funcs(ftrace);
>
> - if (!ftrace->use_inline)
> + if (!has_filter && !ftrace->use_inline)
> return print_line(ftrace, line, out);
>
> pipe_char = find_func_column(ftrace, line, &cpu);
[Severity: Medium]
Shortly after this in ftrace_process_fgraph_line(), make_blank_prefix() is
called and provided with the 128-byte blank_prefix array from the stack:
if (start_delim && start_delim < pipe_char) {
for (c = buf + (start_delim - line) + 1; c < buf + (pipe_char - line); c++)
*c = ' ';
}
Can this loop in make_blank_prefix() write out of bounds?
The loop blindly writes space characters up to buf + (pipe_char - line). If
the trace line prefix before pipe_char exceeds 128 characters, it appears
this will write past the end of the blank_prefix stack buffer without
clamping to the size of the destination.
[ ... ]
> @@ -549,6 +691,21 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
> }
> }
>
> + /*
> + * When inside a target graph filter, child functions must descend
> + * from an active frame on the target stack. Suppress detached
> + * calls originating outside the target hierarchy.
> + */
> + if (has_filter && cs->in_target && cs->depth > cs->target_root_depth) {
> + if (has_retaddr && caller_idx < cs->target_root_depth) {
> + if (has_open_brace && !has_semicolon)
> + cs->orphan_depth = 1;
> + for (i = 0; i < num_inlines; i++)
> + free((void *)inlined_names[i]);
> + return 0;
> + }
> + }
> +
[Severity: Medium]
Because cs->depth is inflated by the inline frames for a leaf target function,
the filter state check later on fails and leaves cs->in_target set to true.
When that happens, does this block cause subsequent sibling functions to
incorrectly return early, entirely skipping the logic that would normally
close the stale inline frames?
[ ... ]
> @@ -659,6 +816,13 @@ int ftrace_process_fgraph_line(struct perf_ftrace *ftrace, const char *line, FIL
> }
> }
>
> + if (has_filter && cs->in_target && cs->depth <= cs->target_root_depth &&
> + has_semicolon && !has_open_brace) {
> + cs->in_target = false;
> + cs->target_root_depth = 0;
> + cs->orphan_depth = 0;
> + }
> +
> for (i = 0; i < num_inlines; i++)
> free((void *)inlined_names[i]);
> return 0;
[Severity: Medium]
Does this reset condition fail for leaf functions when ftrace->use_inline is
true?
If a targeted leaf function resolves to inline frames,
ftrace_process_fgraph_line() pushes the inline frames onto cs->stack and
increments cs->depth. Because cs->depth is inflated by num_inlines, the
check against cs->target_root_depth will be false, leaving in_target
permanently true for leaf calls with inlines.
Could this leak the filter state, causing subsequent sibling functions to be
incorrectly evaluated as being inside the target graph, leading to malformed
or missing trace lines?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161457.373253-1-atomlin@atomlin.com?part=5
^ permalink raw reply [flat|nested] 13+ messages in thread