* Re: [PATCH v3 03/17] verification/rvgen: Improve rv_dir discovery in RVGenerator
From: Nam Cao @ 2026-07-02 13:53 UTC (permalink / raw)
To: Gabriele Monaco, linux-trace-kernel, linux-kernel, Steven Rostedt,
Gabriele Monaco
Cc: Thomas Weissschuh, Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <20260625121440.116317-4-gmonaco@redhat.com>
Gabriele Monaco <gmonaco@redhat.com> writes:
> The RVGenerator class can find the RV directory (kernel/trace/rv) in the
> kernel tree to do some auto patching. This works by assuming PWD is
> either the kernel tree or tools/verification, which isn't always the
> case (e.g. when running from selftests).
>
> Make discovery more robust by relying on the absolute path of the
> current script and traversing backwards the right number of times.
> This should work from any location if rvgen is in the kernel tree.
Agree.
> + # find the kernel tree root relative to this file's location
> + current_dir = os.path.dirname(os.path.abspath(__file__))
> + kernel_root = os.path.abspath(os.path.join(current_dir, "../../../.."))
The "../../../.." makes me sad.
We can find the git project root instead. For example:
def getGitRoot():
return subprocess.Popen(['git', 'rev-parse', '--show-toplevel'], stdout=subprocess.PIPE).communicate()[0].rstrip().decode('utf-8')
(stolen from https://stackoverflow.com/questions/22081209/find-the-root-of-the-git-repository-where-the-file-lives)
But that's not important, up to you.
Nam
^ permalink raw reply
* Re: [PATCH v3 07/17] rv: Add KUnit stub to rv_react() and rv_*_task_monitor_slot()
From: Nam Cao @ 2026-07-02 13:59 UTC (permalink / raw)
To: Gabriele Monaco, linux-trace-kernel, linux-kernel, Steven Rostedt,
Gabriele Monaco, Masami Hiramatsu
Cc: Thomas Weissschuh, Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <20260625121440.116317-8-gmonaco@redhat.com>
Gabriele Monaco <gmonaco@redhat.com> writes:
> Add KUNIT_STATIC_STUB_REDIRECT to allow those functions to be stubbed in
> a KUnit test. This is useful to catch reaction without creating a custom
> reactor and going through the effort of setting it from a test.
> rv_{get/put}_task_monitor_slot() rely on a lock, but this isn't
> necessary during a unit test, so simply skip the calls.
>
> Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
^ permalink raw reply
* Re: [PATCH v3 03/17] verification/rvgen: Improve rv_dir discovery in RVGenerator
From: Thomas Weissschuh @ 2026-07-02 14:00 UTC (permalink / raw)
To: Nam Cao
Cc: Gabriele Monaco, linux-trace-kernel, linux-kernel, Steven Rostedt,
Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <87y0ftijkw.fsf@yellow.woof>
On Thu, Jul 02, 2026 at 03:53:35PM +0200, Nam Cao wrote:
> Gabriele Monaco <gmonaco@redhat.com> writes:
> > The RVGenerator class can find the RV directory (kernel/trace/rv) in the
> > kernel tree to do some auto patching. This works by assuming PWD is
> > either the kernel tree or tools/verification, which isn't always the
> > case (e.g. when running from selftests).
> >
> > Make discovery more robust by relying on the absolute path of the
> > current script and traversing backwards the right number of times.
> > This should work from any location if rvgen is in the kernel tree.
>
> Agree.
>
> > + # find the kernel tree root relative to this file's location
> > + current_dir = os.path.dirname(os.path.abspath(__file__))
> > + kernel_root = os.path.abspath(os.path.join(current_dir, "../../../.."))
>
>
> The "../../../.." makes me sad.
>
> We can find the git project root instead. For example:
>
> def getGitRoot():
> return subprocess.Popen(['git', 'rev-parse', '--show-toplevel'], stdout=subprocess.PIPE).communicate()[0].rstrip().decode('utf-8')
>
> (stolen from https://stackoverflow.com/questions/22081209/find-the-root-of-the-git-repository-where-the-file-lives)
>
> But that's not important, up to you.
Relying on git is problematic as the git directory might be missing.
People might use the sources from a tarball or use funky container setups.
Thomas
^ permalink raw reply
* Re: [PATCH v3 08/17] rv: Export task monitor slot and react symbols
From: Nam Cao @ 2026-07-02 14:00 UTC (permalink / raw)
To: Gabriele Monaco, linux-trace-kernel, linux-kernel, Steven Rostedt,
Gabriele Monaco, Masami Hiramatsu
Cc: Thomas Weissschuh, Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <20260625121440.116317-9-gmonaco@redhat.com>
Gabriele Monaco <gmonaco@redhat.com> writes:
> Export rv_get_task_monitor_slot, rv_put_task_monitor_slot, and rv_react
> to GPL modules so they can be accessed by KUnit and future monitors
> built as kernel modules.
>
> Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
^ permalink raw reply
* Re: [PATCH v3 03/17] verification/rvgen: Improve rv_dir discovery in RVGenerator
From: Gabriele Monaco @ 2026-07-02 14:01 UTC (permalink / raw)
To: Nam Cao, linux-trace-kernel, linux-kernel, Steven Rostedt
Cc: Thomas Weissschuh, Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <87y0ftijkw.fsf@yellow.woof>
On Thu, 2026-07-02 at 15:53 +0200, Nam Cao wrote:
> Gabriele Monaco <gmonaco@redhat.com> writes:
> > The RVGenerator class can find the RV directory (kernel/trace/rv) in the
> > kernel tree to do some auto patching. This works by assuming PWD is
> > either the kernel tree or tools/verification, which isn't always the
> > case (e.g. when running from selftests).
> >
> > Make discovery more robust by relying on the absolute path of the
> > current script and traversing backwards the right number of times.
> > This should work from any location if rvgen is in the kernel tree.
>
> Agree.
>
> > + # find the kernel tree root relative to this file's location
> > + current_dir = os.path.dirname(os.path.abspath(__file__))
> > + kernel_root = os.path.abspath(os.path.join(current_dir,
> > "../../../.."))
>
>
> The "../../../.." makes me sad.
>
> We can find the git project root instead. For example:
>
> def getGitRoot():
> return subprocess.Popen(['git', 'rev-parse', '--show-toplevel'],
> stdout=subprocess.PIPE).communicate()[0].rstrip().decode('utf-8')
>
> (stolen from
> https://stackoverflow.com/questions/22081209/find-the-root-of-the-git-repository-where-the-file-lives
> )
>
> But that's not important, up to you.
Mmh good point, but what if we're running from a tarball?
I could still fall back to something that uses directory parents (maybe
something arguably nicer like
os.path.join(current_dir, *([".."] * 4))
But that may not be more readable..
Thanks,
Gabriele
^ permalink raw reply
* Re: [RFC PATCH 2/4] tracing/probes: Compile all fetchargs into a single BPF program per event
From: Steven Rostedt @ 2026-07-02 14:04 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Masami Hiramatsu, Shuah Khan, Mathieu Desnoyers, LKML,
linux-trace-kernel, open list:KERNEL SELFTEST FRAMEWORK, bpf
In-Reply-To: <CAADnVQLUniyTM64gHrLzgjWiNZTB82tT0LCxh8D29YfXG7cZ6w@mail.gmail.com>
On Wed, 1 Jul 2026 17:01:01 -0700
Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> The whole feature you're trying to do is imo reinvention of the wheel.
> bpf could do that kind of filtering years ago.
> I don't buy the excuse that embedded environments without any
> kind of user space needs this facility.
And what embedded environments do you work with?
Feel free to go to Embedded Recipes and talk with developers there.
-- Steve
^ permalink raw reply
* Re: [PATCH v3 17/17] selftests/verification: Add selftests for deadline and stall monitors
From: Gabriele Monaco @ 2026-07-02 14:05 UTC (permalink / raw)
To: Wen Yang
Cc: Nam Cao, Thomas Weissschuh, Tomas Glozar, John Kacur,
linux-trace-kernel, linux-kernel, Steven Rostedt, Shuah Khan,
linux-kselftest
In-Reply-To: <5ca104ab-cffb-4090-9af6-06d173e8069f@linux.dev>
On Mon, 2026-06-29 at 00:58 +0800, Wen Yang wrote:
> > +echo nop > monitors/stall/reactors
> > +echo 0 > monitors/stall/enable
> > +
> > +echo 1000 > $THRESHOLD
>
> A little worried:
> If the system had a different value configured before the test ran,
> this silently changes system state for anything running after it.
Yeah that's a valid concern, I could restore the initial value, but to make it
absolutely safe I should also trap and restore it even if the test exits
prematurely (e.g. on failure or signal).
It shouldn't add too much complexity.
Thanks,
Gabriele
^ permalink raw reply
* Re: [PATCH v3 03/17] verification/rvgen: Improve rv_dir discovery in RVGenerator
From: Thomas Weissschuh @ 2026-07-02 14:09 UTC (permalink / raw)
To: Gabriele Monaco
Cc: Nam Cao, linux-trace-kernel, linux-kernel, Steven Rostedt,
Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <4dc81b777bb8daaf4687c0d9db7ce740abd0a825.camel@redhat.com>
On Thu, Jul 02, 2026 at 04:01:21PM +0200, Gabriele Monaco wrote:
> On Thu, 2026-07-02 at 15:53 +0200, Nam Cao wrote:
> > Gabriele Monaco <gmonaco@redhat.com> writes:
> > > The RVGenerator class can find the RV directory (kernel/trace/rv) in the
> > > kernel tree to do some auto patching. This works by assuming PWD is
> > > either the kernel tree or tools/verification, which isn't always the
> > > case (e.g. when running from selftests).
> > >
> > > Make discovery more robust by relying on the absolute path of the
> > > current script and traversing backwards the right number of times.
> > > This should work from any location if rvgen is in the kernel tree.
> >
> > Agree.
> >
> > > + # find the kernel tree root relative to this file's location
> > > + current_dir = os.path.dirname(os.path.abspath(__file__))
> > > + kernel_root = os.path.abspath(os.path.join(current_dir,
> > > "../../../.."))
> >
> >
> > The "../../../.." makes me sad.
> >
> > We can find the git project root instead. For example:
> >
> > def getGitRoot():
> > return subprocess.Popen(['git', 'rev-parse', '--show-toplevel'],
> > stdout=subprocess.PIPE).communicate()[0].rstrip().decode('utf-8')
> >
> > (stolen from
> > https://stackoverflow.com/questions/22081209/find-the-root-of-the-git-repository-where-the-file-lives
> > )
> >
> > But that's not important, up to you.
>
> Mmh good point, but what if we're running from a tarball?
>
> I could still fall back to something that uses directory parents (maybe
> something arguably nicer like
>
> os.path.join(current_dir, *([".."] * 4))
>
> But that may not be more readable..
current_dir = pathlib.Path(__file__).abspath()
kernel_root = current_dir.parents[4]
pathlib is generally nicer than os.path.
Thomas
^ permalink raw reply
* Re: [PATCH v3 03/17] verification/rvgen: Improve rv_dir discovery in RVGenerator
From: Nam Cao @ 2026-07-02 14:16 UTC (permalink / raw)
To: Gabriele Monaco, linux-trace-kernel, linux-kernel, Steven Rostedt,
Gabriele Monaco
Cc: Thomas Weissschuh, Tomas Glozar, John Kacur, Wen Yang
In-Reply-To: <20260625121440.116317-4-gmonaco@redhat.com>
Gabriele Monaco <gmonaco@redhat.com> writes:
> The RVGenerator class can find the RV directory (kernel/trace/rv) in the
> kernel tree to do some auto patching. This works by assuming PWD is
> either the kernel tree or tools/verification, which isn't always the
> case (e.g. when running from selftests).
>
> Make discovery more robust by relying on the absolute path of the
> current script and traversing backwards the right number of times.
> This should work from any location if rvgen is in the kernel tree.
>
> Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
With or without Thomas's suggestion:
Reviewed-by: Nam Cao <namcao@linutronix.de>
^ permalink raw reply
* Re: [PATCH] tracing: Warn when an event dereferences a pointer in TP_printk()
From: Vinod Koul @ 2026-07-02 15:37 UTC (permalink / raw)
To: Steven Rostedt
Cc: LKML, Linux Trace Kernel, Masami Hiramatsu, Mathieu Desnoyers,
Martin Kaiser, Frank Li
In-Reply-To: <20260630184836.74d477b6@gandalf.local.home>
On 30-06-26, 18:48, Steven Rostedt wrote:
> From: Steven Rostedt <rostedt@goodmis.org>
>
> Currently on boot up and when modules are loaded, the trace event
> infrastructure will examine the TP_printk's of every event looking to see
> if it dereferences pointers on the ring buffer via printk formats like
> "%pB" and such. What it doesn't do is check if the arguments themselves
> do a dereference from a pointer.
>
> This was brought with a fix[1] to the fsl_edma event that had in the
> arguments of the TP_printk(): "__entry->edma->membase"
>
> The __entry->edma is a pointer saved in the ring buffer. The dereference
> from TP_printk() happens when the user reads the "trace" file which can be
> seconds, minutes, hours, days, weeks, or even months later! There is no
> guarantee that the __entry->edma pointer will still be pointing to what it
> was when it was recorded, and could crash the kernel when a user reads the
> event.
>
> Add logic to the test_event_printk() that also checks for this case and
> warn if the event dereferences a pointer from the ring buffer.
Reviewed-by: Vinod Koul <vkoul@kernel.org>
--
~Vinod
^ permalink raw reply
* Re: [PATCHv5 00/13] uprobes/x86: Fix red zone issue for optimized uprobes
From: Andrii Nakryiko @ 2026-07-02 16:20 UTC (permalink / raw)
To: Jiri Olsa
Cc: Oleg Nesterov, Peter Zijlstra, Ingo Molnar, Masami Hiramatsu,
Andrii Nakryiko, bpf, linux-trace-kernel
In-Reply-To: <akZJZth3-fVUhADl@krava>
On Thu, Jul 2, 2026 at 4:20 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Wed, Jul 01, 2026 at 04:13:26PM -0700, Andrii Nakryiko wrote:
> > On Wed, Jul 1, 2026 at 4:13 AM Jiri Olsa <jolsa@kernel.org> wrote:
> > >
> > > hi,
> > > Andrii reported an issue with optimized uprobes [1] that can clobber
> > > redzone area with call instruction storing return address on stack
> > > where user code may keep temporary data without adjusting rsp.
> > >
> > > Fixing this by moving the optimized uprobes on top of 10-bytes nop
> > > instruction, so we can squeeze another instruction to escape the
> > > redzone area before doing the call.
> > >
> > > Note we need upstream update first for patch 3 (github.com/libbpf/usdt),
> > > if we decide to take this change.
> > >
> > > thanks,
> > > jirka
> > >
> > >
> > > v1: https://lore.kernel.org/bpf/20260514135342.22130-1-jolsa@kernel.org/
> > > v2: https://lore.kernel.org/bpf/20260518105957.123445-1-jolsa@kernel.org/
> > > v3: https://lore.kernel.org/bpf/20260521124411.31133-1-jolsa@kernel.org/
> > > v4: https://lore.kernel.org/bpf/20260526205840.173790-1-jolsa@kernel.org/
> > >
> > > v5 changes:
> > > - several selftests changes and reviewed-by tags [Jakub]
> > > - add more comments in int3_update_unoptimize [Andrii]
> > > - several other minor changes and acks [Oleg]
> > > - move insn_decode out of uprobe_init_insn to simplify the code
> > > - align uprobe_red_zone_test to 64 to make sure nop10 is not on page boundary
> > >
> > > v4 changes:
> > > - do not use 2nd int3 (ont +5 offset) because the call instruction
> > > is allways the same for the given nop10 address [Andrii/Peter]
> > > - unmap unused trampoline vma after unsuccesfull optimization [sashiko]
> > > - small change to patch#2 moved user_64bit_mode earlier in the path
> > > and pass/use mm_struct pointer directly from arch_uprobe_optimize
> > > instead of gettting current->mm
> > > Andrii, keeping your ack, please shout otherwise
> > >
> > > v3 changes:
> > > - use nop10 update suggested by Peter in [2]
> > > - remove struct uprobe_trampoline object, use vma objects directly instead
> > > - selftests fixes [sashiko]
> > > - ack from Andrii
> > >
> > > v2 changes:
> > > - several selftest fixes [sashiko]
> > > - consolidate is_lea_insn and is_call_insn insto single check [Jakub Sitnicki]
> > > - use proper mm_struct object in __in_uprobe_trampoline check [sashiko]
> > > - allow to copy uprobe trampolines vma objects on fork [sashiko]
> > > - change uprobe syscall detection error from -ENXIO to -EPROTO [Andrii]
> > > - added fork/clone tests
> > > - I kept the selftest changes and nop5->nop10 changes in separate
> > > commits for easier review, we can squash them later if we want to keep
> > > bisect working properly
> > >
> > >
> > > [1] https://lore.kernel.org/bpf/20260509003146.976844-1-andrii@kernel.org/
> > > [2] https://lore.kernel.org/bpf/20260518104306.GU3102624@noisy.programming.kicks-ass.net/#t
> > > ---
> >
> > ASAN-enabled test_progs runs are not happy in CI, can you please check?
>
> I failed to release link in test_uprobe_fork_optimized, fix is below
> I can send new version or separate fix
yeah, please fix the test, adjust comments as pointed out by AI and
send v6. Seems like Peter wants to pick it up through tip, I don't
mind.
>
>
> also there's 2 things to solve/discuss once kernel changes are acked:
> - selftest changes depend on:
> selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch
> that is taken from libbpf/usdt, I pushed the PR in here [1]
>
merged that one, we are good
> - as bots complained the patchset breaks bisection, because kernel
> changes break selftests.. not sure what's prefered solution, as for
> me I'd keep it that way rather than mixing kernel/user space changes
I think it's fine to keep them separate
>
> thanks,
> jirka
>
>
> [1] https://github.com/libbpf/usdt/pull/16
> ---
> diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c b/tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c
> index eb067f029a9f..e193206fc5d2 100644
> --- a/tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c
> +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c
> @@ -988,7 +988,6 @@ static noreturn int child_func(void *arg)
> static void test_uprobe_fork_optimized(bool clone_vm)
> {
> struct uprobe_syscall_executed *skel = NULL;
> - struct bpf_link *link = NULL;
> unsigned long offset;
> int pid, status, err;
> char stack[65535];
> @@ -1001,9 +1000,9 @@ static void test_uprobe_fork_optimized(bool clone_vm)
> if (!ASSERT_OK_PTR(skel, "open_and_load"))
> goto cleanup;
>
> - link = bpf_program__attach_uprobe_opts(skel->progs.test_uprobe,
> - -1, "/proc/self/exe", offset, NULL);
> - if (!ASSERT_OK_PTR(link, "attach_uprobe"))
> + skel->links.test_uprobe = bpf_program__attach_uprobe_opts(skel->progs.test_uprobe,
> + -1, "/proc/self/exe", offset, NULL);
> + if (!ASSERT_OK_PTR(skel->links.test_uprobe, "attach_uprobe"))
> goto cleanup;
>
> skel->bss->pid = getpid();
^ permalink raw reply
* Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()
From: Thierry Reding @ 2026-07-02 16:41 UTC (permalink / raw)
To: Will Deacon
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Jonathan Hunter,
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, Sowjanya Komatineni, Luca Ceresoli,
Mikko Perttunen, Yury Norov, Rasmus Villemoes, Russell King,
Alexander Gordeev, Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, Andrew Morton,
David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Marek Szyprowski, Robin Murphy, Sumit Semwal, Benjamin Gaignard,
Brian Starkey, John Stultz, T.J. Mercier, Christian König,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Catalin Marinas, Thierry Reding, devicetree, linux-tegra,
linux-kernel, dri-devel, linux-media, linux-arm-kernel,
linux-s390, linux-mm, iommu, linaro-mm-sig, linux-trace-kernel,
Thierry Reding, Chun Ng
In-Reply-To: <akZkuwktaXFTrASP@orome>
[-- Attachment #1: Type: text/plain, Size: 2127 bytes --]
On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote:
> On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote:
> > On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote:
> > > From: Chun Ng <chunn@nvidia.com>
> > >
> > > Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits
> > > on a kernel-linear-map range.
> >
> > That sounds like a really terrible idea. Why is this necessary and how
> > does it interact with things like load_unaligned_zeropad()?
>
> This is necessary because once the memory controller has walled off the
> new memory region the CPU must not access it under any circumstances or
> it'll cause the CPU to lock up (I think technically it'll hit an SError
> but in practice that just means it'll freeze, as far as I can tell).
>
> Probably doesn't interact well at all with load_unaligned_zeropad().
>
> > I think you should unmap the memory from the linear map and memremap()
> > it instead.
>
> Given that the memory can never be accessed by the CPU after the memory
> controller locks it down, I don't think we'll even need memremap(). The
> only thing we really need is the sg_table we hand out via the DMA BUFs
> so that they can be used by device drivers to program their DMA engines
> internally.
>
> Looking through some of the architecture code around this, shouldn't we
> simply be using set_memory_encrypted() and set_memory_decrypted() for
> this? While they might've been created for slightly other use-cases,
> they seem to be doing exactly what we want (i.e. remove the page range
> from the linear mapping and flushing it, or restoring the valid bit and
> standard permissions, respectively).
Ah... I guess we can't do it because we're not in a realm world and so
the early checks in __set_memory_enc_dec() would return early and turn
it into a no-op.
How about if I extract a common helper and provide set_memory_p() and
set_memory_np() in terms of those. Those are available on x86 and
PowerPC as well, so fairly standard. I suppose at that point we're
closer to set_memory_valid().
Thierry
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* [RFC PATCH 0/1] psi: Introduce in-kernel PSI auto monitor feature
From: Pintu Kumar Agarwal @ 2026-07-02 17:16 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel, hannes, surenb, rostedt,
mhiramat, peterz, mathieu.desnoyers, mingo, juri.lelli,
vincent.guittot, dietmar.eggemann, bsegall, mgorman, vschneid,
kprateek.nayak, pintu.agarwal, pintu.ping, nathan, ojeda, nsc,
gary, tglx, thomas.weissschuh, aliceryhl, dianders, linux.amoon,
rdunlap, akpm, shuah
Hi all,
This RFC introduces an in-kernel PSI auto monitor aimed at improving
root-cause visibility for resource pressure events in Linux systems.
Motivation:
PSI already provides an excellent mechanism to detect CPU, memory and
I/O pressure and includes trigger-based notifications via pollable
interfaces. However, it deliberately avoids attributing pressure to
individual tasks.
In real-world systems, this creates a gap: when a PSI trigger fires,
users still need to determine *which tasks caused the stall* by combining
multiple tools (top, meminfo, vmstat, perf, tracing, etc.), often after
the event has already passed.
This process becomes particularly difficult during:
- transient bursts of pressure
- system boot or early initialization before user space
- PREEMPT_RT or latency-sensitive workloads
- heavily loaded embedded systems where user space is delayed
- small resource-constraints minimal system
- production system where most debugging interface are disabled
Proposal:
This patch introduces an optional in-kernel PSI auto monitor that:
- periodically samples PSI signals
- detects threshold breaches
- captures top contributing tasks at that moment
- emits trace events and kernel logs for analysis
The design goal is **low-latency attribution at the source of truth**,
without relying on user-space daemons or polling loops.
Why in-kernel?
While similar logic can be implemented in user space, there are inherent
limitations:
- scheduling delays under high pressure
- risk of missing short-lived spikes
- dependency on continuous polling or daemons
- difficulty deploying in early boot or minimal environments
In contrast, the in-kernel approach:
- observes PSI signals without scheduling latency
- captures contributors exactly at threshold breach
- works during early boot and degraded system states
- avoids duplicating logic across multiple user-space tools
- easy configurable even in runtime
- captures all sorts of information during same timestamp
Design Highlights:
- Does not modify PSI fast paths
- Optional (CONFIG_PSI_AUTO_MONITOR)
- Runtime configurable thresholds and interval
- Uses existing kernel accounting (task runtime, RSS, I/O stats)
- Provides structured tracepoints for post-processing
- Lightweight and intended for diagnostic use
- Idea is similar to, when OOM occurs dump contending tasks
Reviews and Assistance:
The core idea is mine.
However, I have taken few assistance from AI for review and enhancement.
I have done extensive review and suggestion using ChatGPT and Copilot.
The commit message and this cover letter were also prepared by Copilot.
I have done self-review and corrective actions accordingly.
Experimental Validation:
The feature has been evaluated on multiple ARM64 platforms (Cortex-A53,
A55) across different kernels and storage setups.
Extensive experiments has been carried out with multiple workloads.
Some tools and logs are shared here:
https://github.com/pintuk/KERNEL/tree/master/PSI_WORK
Test scenarios include:
- CPU/memory/IO stress workloads both on eMMC and NAND
- system boot tracing (no external tools)
- mixed workloads (stress-ng, workqueues, user/kernel threads, processes)
- PREEMPT_RT cyclictest correlation with real workloads
Results show:
- consistent identification of top resource contributors
- improved root-cause visibility compared to user-space-only methods
- ability to capture transient hotspots during boot and runtime
- correlation of latency spikes with system pressure
Papers and Reference:
The paper is presented in Open Source Summit India - 2026:
https://ossindia2026.sched.com/event/2KNI4/introducing-in-kernel-psi-auto-monitor-feature-pintu-kumar-agarwal-qualcomm?iframe=yes&w=100%&sidebar=yes&bg=no
https://hosted-files.sched.co/ossindia2026/19/OSS-IND-26-PSI-Auto-Monitor.pdf
The initial idea was also presented in LPC-2024:
https://lpc.events/event/18/contributions/1884/attachments/1439/3069/LPC2024_PIntu_PSI.pdf
Open Questions (RFC):
Feedback is especially appreciated on:
- whether this functionality belongs in-kernel vs user-space
- interface choice (sysfs vs tracefs/debugfs alternatives)
- scoring heuristic (CPU/RSS/IO weighting)
- potential reuse or extension of existing PSI interfaces
- cgroup-aware extensions for future work
Future Work:
- finer-grained PSI window integration
- IRQ pressure support
- cgroup-based attribution
- improved tracing/export interfaces
- optional integration with user-space analysis tools
Thanks for your time, and I’d really appreciate feedback.
Regards,
Pintu Kumar Agarwal
Pintu Kumar Agarwal (1):
psi: Introduce in-kernel PSI auto monitor feature
include/trace/events/psi_monitor.h | 53 +++++
init/Kconfig | 16 ++
kernel/sched/build_utility.c | 4 +
kernel/sched/psi_monitor.c | 307 +++++++++++++++++++++++++++++
4 files changed, 380 insertions(+)
create mode 100644 include/trace/events/psi_monitor.h
create mode 100644 kernel/sched/psi_monitor.c
--
2.34.1
^ permalink raw reply
* [RFC PATCH 1/1] psi: Introduce in-kernel PSI auto monitor feature
From: Pintu Kumar Agarwal @ 2026-07-02 17:16 UTC (permalink / raw)
To: linux-kernel, linux-trace-kernel, hannes, surenb, rostedt,
mhiramat, peterz, mathieu.desnoyers, mingo, juri.lelli,
vincent.guittot, dietmar.eggemann, bsegall, mgorman, vschneid,
kprateek.nayak, pintu.agarwal, pintu.ping, nathan, ojeda, nsc,
gary, tglx, thomas.weissschuh, aliceryhl, dianders, linux.amoon,
rdunlap, akpm, shuah
In-Reply-To: <20260702171606.527077-1-pintu.agarwal@oss.qualcomm.com>
Pressure Stall Information (PSI) provides accurate detection of CPU,
memory and I/O contention and supports event notifications via trigger
windows and poll-based interfaces. However, PSI intentionally does not
attribute pressure to individual tasks. As a result, developers must
reconstruct root cause in user space by correlating multiple tools,
logs, or tracing data after the fact.
In practice, this becomes difficult under severe pressure conditions,
where systems are already degraded and user-space observers may be
delayed or miss the critical window entirely.
Moreover, we need to gather information before the situation occurs
and not after the problem arises.
This patch introduces an optional in-kernel PSI auto monitor that
captures contributing tasks at the exact moment configured PSI
thresholds are breached. The monitor periodically samples PSI state and,
upon sustained pressure, records the top contending tasks based on a
lightweight composite score derived from CPU runtime, RSS and I/O
activity.
Key design points:
- No modifications to PSI fast paths
- No dependency on user-space daemons or continuous polling
- Uses existing kernel accounting and tracepoints
- Provides structured trace events for integration with tracing tools
- Runtime configurable thresholds and sampling interval
The goal is not to replace existing PSI mechanisms or user-space
components such as oomd, but to complement them by providing
low-latency, in-context attribution data at the point of pressure.
Experimental results across multiple platforms and workloads,
including real time scenarios, show improved accuracy and reduced time
to root-cause identification, especially in transient and high-pressure
conditions such as system boot and stress workloads.
This patch is submitted as RFC to gather feedback on:
- suitability of in-kernel attribution vs user-space approaches
- interface choice (sysfs vs trace-based control)
- dmesg logging when threshold hit, just like OOM messages
- some avg10 monitoring as default choice
- default threshold values and tasks count
- scoring methodology and configurability
- potential integration with existing PSI infrastructure
Signed-off-by: Pintu Kumar Agarwal <pintu.agarwal@oss.qualcomm.com>
Assisted-by: Copilot:Auto
Assisted-by: ChatGPT:GPT-5.5
---
include/trace/events/psi_monitor.h | 53 +++++
init/Kconfig | 16 ++
kernel/sched/build_utility.c | 4 +
kernel/sched/psi_monitor.c | 307 +++++++++++++++++++++++++++++
4 files changed, 380 insertions(+)
create mode 100644 include/trace/events/psi_monitor.h
create mode 100644 kernel/sched/psi_monitor.c
diff --git a/include/trace/events/psi_monitor.h b/include/trace/events/psi_monitor.h
new file mode 100644
index 000000000000..cf99f5994472
--- /dev/null
+++ b/include/trace/events/psi_monitor.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Tracepoints for PSI automatic monitor
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM psi_monitor
+
+#if !defined(_TRACE_PSI_MONITOR_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_PSI_MONITOR_H
+
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(psi_monitor_top_task,
+
+ TP_PROTO(pid_t pid, const char *comm,
+ unsigned long cpu_ms,
+ unsigned long rss_kb,
+ unsigned long io_kb,
+ u64 score),
+
+ TP_ARGS(pid, comm, cpu_ms, rss_kb, io_kb, score),
+
+ TP_STRUCT__entry(
+ __field(pid_t, pid)
+ __string(comm, comm)
+ __field(unsigned long, cpu_ms)
+ __field(unsigned long, rss_kb)
+ __field(unsigned long, io_kb)
+ __field(u64, score)
+ ),
+
+ TP_fast_assign(
+ __entry->pid = pid;
+ __assign_str(comm);
+ __entry->cpu_ms = cpu_ms;
+ __entry->rss_kb = rss_kb;
+ __entry->io_kb = io_kb;
+ __entry->score = score;
+ ),
+
+ TP_printk("pid=%d comm=%s cpu_ms=%lu rss_kb=%lu io_kb=%lu score=%llu",
+ __entry->pid, __get_str(comm),
+ __entry->cpu_ms, __entry->rss_kb,
+ __entry->io_kb,
+ (unsigned long long)__entry->score)
+);
+
+#endif /* _TRACE_PSI_MONITOR_H */
+
+/* This must be outside the header guard */
+#include <trace/define_trace.h>
diff --git a/init/Kconfig b/init/Kconfig
index 5230d4879b1c..074693f76b17 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -757,6 +757,22 @@ config PSI_DEFAULT_DISABLED
Say N if unsure.
+config PSI_AUTO_MONITOR
+ bool "In-kernel automatic PSI monitor with sysfs + weighted scoring"
+ depends on PSI && TASK_XACCT && TASK_IO_ACCOUNTING && TRACEPOINTS
+ default n
+ help
+ Enables a kernel-internal PSI observer that periodically checks CPU,
+ memory, and I/O pressure via a delayed workqueue. When thresholds
+ are breached, it ranks tasks by weighted RSS, I/O, and CPU usage,
+ then logs top-N tasks via printk and emits trace events.
+
+ Thresholds, poll interval and weights are tunable at runtime via:
+ /sys/kernel/psi_monitor/
+
+ Say N if unsure.
+
+
endmenu # "CPU/Task time and stats accounting"
config CPU_ISOLATION
diff --git a/kernel/sched/build_utility.c b/kernel/sched/build_utility.c
index e2cf3b08d4e9..30e9800ce947 100644
--- a/kernel/sched/build_utility.c
+++ b/kernel/sched/build_utility.c
@@ -104,3 +104,7 @@
#ifdef CONFIG_SCHED_AUTOGROUP
# include "autogroup.c"
#endif
+
+#ifdef CONFIG_PSI_AUTO_MONITOR
+# include "psi_monitor.c"
+#endif
diff --git a/kernel/sched/psi_monitor.c b/kernel/sched/psi_monitor.c
new file mode 100644
index 000000000000..e929a0c05494
--- /dev/null
+++ b/kernel/sched/psi_monitor.c
@@ -0,0 +1,307 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * PSI Automatic Monitor with Weighted Task Ranking + Tracepoints
+ *
+ * Periodically samples system PSI (CPU, memory, IO) and, when any
+ * configured threshold is exceeded, ranks tasks using a composite
+ * score based on RSS, I/O activity and CPU time, then logs the
+ * top-N tasks via printk and a tracepoint.
+ *
+ * Sysfs interface:
+ * /sys/kernel/psi_monitor/cpu_thresh (percentage)
+ * /sys/kernel/psi_monitor/mem_thresh (percentage)
+ * /sys/kernel/psi_monitor/io_thresh (percentage)
+ * /sys/kernel/psi_monitor/monitor_interval_ms (milliseconds)
+ * /sys/kernel/psi_monitor/rss_weight
+ * /sys/kernel/psi_monitor/io_weight
+ * /sys/kernel/psi_monitor/cpu_weight
+ *
+ * Author: Pintu Kumar Agarwal
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/sched/signal.h>
+#include <linux/sched/loadavg.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <linux/workqueue.h>
+#include <linux/psi_types.h>
+#include <linux/kobject.h>
+#include <linux/sort.h>
+#include <linux/jiffies.h>
+#include <linux/time64.h>
+#include <linux/sched/cputime.h>
+
+/* Create tracepoints defined in include/trace/events/psi_monitor.h */
+#define CREATE_TRACE_POINTS
+#include <linux/psi.h>
+#include <trace/events/psi_monitor.h>
+
+
+/* Sysfs tunables */
+static unsigned int cpu_thresh = 80; /* in percent */
+static unsigned int mem_thresh = 80; /* in percent */
+static unsigned int io_thresh = 80; /* in percent */
+static unsigned int monitor_interval_ms = 10000;
+
+/* scoring weights */
+static unsigned int rss_weight = 2;
+static unsigned int io_weight = 1;
+static unsigned int cpu_weight = 5;
+
+static struct delayed_work psi_work;
+static struct kobject *psi_kobj;
+
+#define TOP_N 20
+
+struct task_info {
+ struct task_struct *task;
+ unsigned long rss; /* pages */
+ unsigned long io_kb; /* kB */
+ unsigned long cpu_ms; /* ms */
+ u64 score;
+};
+
+/*
+ * psi_avg10_percent() - derive a rough integer percentage from avg10
+ * for a given PSI state (e.g. PSI_CPU_SOME, PSI_MEM_SOME, PSI_IO_SOME).
+ *
+ * psi_group.avg[state][0] is the avg10 window in fixed-point notation.
+ * The conversion here is approximate but monotonic, which is sufficient
+ * for thresholding and ranking in this internal monitor.
+ */
+static unsigned long psi_avg10_percent(int state)
+{
+ u64 avg10;
+
+ if (state < 0 || state >= NR_PSI_STATES)
+ return 0;
+
+ avg10 = READ_ONCE(psi_system.avg[state][0]);
+ if (!avg10)
+ return 0;
+
+ /* Convert back from loadavg-style fixed-point to an approximate % */
+ /* Just consider the integer value and ignore fraction */
+ return LOAD_INT(avg10);
+}
+
+static int compare_score_desc(const void *a, const void *b)
+{
+ const struct task_info *ta = a;
+ const struct task_info *tb = b;
+
+ if (tb->score > ta->score)
+ return 1;
+ if (tb->score < ta->score)
+ return -1;
+ return 0;
+}
+
+static void log_top_tasks(void)
+{
+ struct task_info tasks[TOP_N];
+ struct task_struct *p, *t;
+ int count = 0;
+ int i;
+
+ rcu_read_lock();
+ for_each_process_thread(p, t) {
+ struct mm_struct *mm;
+ unsigned long rss = 0;
+ unsigned long io_kb = 0;
+ unsigned long cpu_ms = 0;
+ u64 score;
+
+ /* Ignore tasks that are not on run queue or idle */
+ if (!t->on_rq && !is_idle_task(t))
+ continue;
+
+ mm = get_task_mm(t);
+
+ /* mm could be NULL for kernel threads */
+ if (mm) {
+ rss = mm ? get_mm_rss(mm) : 0;
+ mmput_async(mm);
+ }
+
+ /*
+ * Approximate I/O activity: sum of read + write bytes.
+ * This uses the task_io_accounting fields in task_struct.
+ * Values are best-effort and need not be perfectly accurate
+ * for our ranking purpose.
+ */
+ io_kb = (t->ioac.read_bytes + t->ioac.write_bytes) >> 10;
+
+ /*
+ * Approximate CPU usage via task_sched_runtime(), converted
+ * to milliseconds. This is cumulative since task start, but
+ * is still useful for comparing hotspots at a given point.
+ */
+ cpu_ms = (unsigned long)(task_sched_runtime(t) / NSEC_PER_MSEC);
+
+ score = (u64)rss_weight * (u64)rss +
+ (u64)io_weight * (u64)io_kb +
+ (u64)cpu_weight * (u64)cpu_ms;
+
+ if (count < TOP_N) {
+ tasks[count].task = t;
+ tasks[count].rss = rss;
+ tasks[count].io_kb = io_kb;
+ tasks[count].cpu_ms = cpu_ms;
+ tasks[count].score = score;
+ count++;
+ } else {
+ /* Maintain a simple streaming top-N: replace smallest */
+ int min_idx = 0;
+ int j;
+
+ for (j = 1; j < TOP_N; j++) {
+ if (tasks[j].score < tasks[min_idx].score)
+ min_idx = j;
+ }
+
+ if (score > tasks[min_idx].score) {
+ tasks[min_idx].task = t;
+ tasks[min_idx].rss = rss;
+ tasks[min_idx].io_kb = io_kb;
+ tasks[min_idx].cpu_ms = cpu_ms;
+ tasks[min_idx].score = score;
+ }
+ }
+ }
+ rcu_read_unlock();
+
+ sort(tasks, count, sizeof(struct task_info), compare_score_desc, NULL);
+
+ pr_info("psi_monitor: logging top %d tasks under pressure:\n", count);
+
+ for (i = 0; i < count; i++) {
+ struct task_struct *ts = tasks[i].task;
+ unsigned long rss_kb = tasks[i].rss << (PAGE_SHIFT - 10);
+ char name[128] = {0,};
+
+ if (ts->flags & PF_WQ_WORKER)
+ wq_worker_comm(name, sizeof(name), ts);
+ else
+ scnprintf(name, sizeof(name) - 1, ts->comm);
+
+ trace_psi_monitor_top_task(ts->pid, name,
+ tasks[i].cpu_ms,
+ rss_kb,
+ tasks[i].io_kb,
+ tasks[i].score);
+
+ pr_info("psi_monitor: pid=%d comm=%s psi_flag=%d oncpu=%d cputime(ms)=%lu rss(kB)=%lu io(kB)=%lu score=%llu\n",
+ ts->pid, name, ts->psi_flags, task_cpu(ts),
+ tasks[i].cpu_ms, rss_kb, tasks[i].io_kb,
+ (unsigned long long)tasks[i].score);
+ }
+}
+
+static void psi_monitor_fn(struct work_struct *work)
+{
+ unsigned long cpu_pct, mem_pct, io_pct;
+ bool trigger = false;
+
+ cpu_pct = psi_avg10_percent(PSI_CPU_SOME);
+ mem_pct = psi_avg10_percent(PSI_MEM_SOME);
+ io_pct = psi_avg10_percent(PSI_IO_SOME);
+
+ if (cpu_pct >= cpu_thresh || mem_pct >= mem_thresh ||
+ io_pct >= io_thresh)
+ trigger = true;
+
+ if (trigger) {
+ pr_info("psi_monitor: pressure high: cpu=%lu%% mem=%lu%% io=%lu%% (thresh cpu=%u mem=%u io=%u)\n",
+ cpu_pct, mem_pct, io_pct,
+ cpu_thresh, mem_thresh, io_thresh);
+ log_top_tasks();
+ }
+
+ queue_delayed_work(system_wq, &psi_work,
+ msecs_to_jiffies(monitor_interval_ms));
+}
+
+/* Sysfs helpers */
+#define PSI_ATTR_RW(_name) \
+static ssize_t _name##_show(struct kobject *kobj, \
+ struct kobj_attribute *attr, char *buf) \
+{ \
+ return sysfs_emit(buf, "%u\n", _name); \
+} \
+static ssize_t _name##_store(struct kobject *kobj, \
+ struct kobj_attribute *attr, \
+ const char *buf, size_t count) \
+{ \
+ unsigned int val; \
+ if (kstrtouint(buf, 10, &val)) \
+ return -EINVAL; \
+ _name = val; \
+ return count; \
+} \
+static struct kobj_attribute _name##_attr = __ATTR_RW(_name)
+
+PSI_ATTR_RW(cpu_thresh);
+PSI_ATTR_RW(mem_thresh);
+PSI_ATTR_RW(io_thresh);
+PSI_ATTR_RW(monitor_interval_ms);
+PSI_ATTR_RW(rss_weight);
+PSI_ATTR_RW(io_weight);
+PSI_ATTR_RW(cpu_weight);
+
+static struct attribute *psi_attrs[] = {
+ &cpu_thresh_attr.attr,
+ &mem_thresh_attr.attr,
+ &io_thresh_attr.attr,
+ &monitor_interval_ms_attr.attr,
+ &rss_weight_attr.attr,
+ &io_weight_attr.attr,
+ &cpu_weight_attr.attr,
+ NULL,
+};
+
+static const struct attribute_group psi_attr_group = {
+ .attrs = psi_attrs,
+};
+
+static int __init psi_monitor_init(void)
+{
+ int ret;
+
+ INIT_DELAYED_WORK(&psi_work, psi_monitor_fn);
+ queue_delayed_work(system_wq, &psi_work,
+ msecs_to_jiffies(monitor_interval_ms));
+
+ psi_kobj = kobject_create_and_add("psi_monitor", kernel_kobj);
+ if (!psi_kobj)
+ return -ENOMEM;
+
+ ret = sysfs_create_group(psi_kobj, &psi_attr_group);
+ if (ret) {
+ kobject_put(psi_kobj);
+ cancel_delayed_work_sync(&psi_work);
+ return ret;
+ }
+
+ pr_info("psi_monitor: in-kernel PSI auto monitor (weighted + tracepoints) loaded\n");
+ return 0;
+}
+
+static void __exit psi_monitor_exit(void)
+{
+ cancel_delayed_work_sync(&psi_work);
+ if (psi_kobj)
+ kobject_put(psi_kobj);
+ pr_info("psi_monitor: unloaded\n");
+}
+
+module_init(psi_monitor_init);
+module_exit(psi_monitor_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Pintu Kumar Agarwal");
+MODULE_DESCRIPTION("In-kernel PSI automatic monitor with sysfs, weighted scoring and tracepoints");
--
2.34.1
^ permalink raw reply related
* Re: [RFC PATCH 1/1] psi: Introduce in-kernel PSI auto monitor feature
From: K Prateek Nayak @ 2026-07-02 19:51 UTC (permalink / raw)
To: Pintu Kumar Agarwal, linux-kernel, linux-trace-kernel, hannes,
surenb, rostedt, mhiramat, peterz, mathieu.desnoyers, mingo,
juri.lelli, vincent.guittot, dietmar.eggemann, bsegall, mgorman,
vschneid, pintu.ping, nathan, ojeda, nsc, gary, tglx,
thomas.weissschuh, aliceryhl, dianders, linux.amoon, rdunlap,
akpm, shuah
In-Reply-To: <20260702171606.527077-2-pintu.agarwal@oss.qualcomm.com>
Hello Pintu,
On 7/2/2026 10:46 PM, Pintu Kumar Agarwal wrote:
> diff --git a/kernel/sched/build_utility.c b/kernel/sched/build_utility.c
> index e2cf3b08d4e9..30e9800ce947 100644
> --- a/kernel/sched/build_utility.c
> +++ b/kernel/sched/build_utility.c
> @@ -104,3 +104,7 @@
> #ifdef CONFIG_SCHED_AUTOGROUP
> # include "autogroup.c"
> #endif
> +
> +#ifdef CONFIG_PSI_AUTO_MONITOR
> +# include "psi_monitor.c"
> +#endif
Isn't this a module? Why is this being included as a scheduler file?
Based on a quick glance, nothing in this module needs scheduler internal
APIs (and nor it should) so tools/sched/ would probabaly be a better
place to put it in if there is interest for this feature.
> diff --git a/kernel/sched/psi_monitor.c b/kernel/sched/psi_monitor.c
> new file mode 100644
> index 000000000000..e929a0c05494
> --- /dev/null
> +++ b/kernel/sched/psi_monitor.c
> @@ -0,0 +1,307 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * PSI Automatic Monitor with Weighted Task Ranking + Tracepoints
> + *
> + * Periodically samples system PSI (CPU, memory, IO) and, when any
> + * configured threshold is exceeded, ranks tasks using a composite
> + * score based on RSS, I/O activity and CPU time, then logs the
> + * top-N tasks via printk and a tracepoint.
> + *
> + * Sysfs interface:
> + * /sys/kernel/psi_monitor/cpu_thresh (percentage)
> + * /sys/kernel/psi_monitor/mem_thresh (percentage)
> + * /sys/kernel/psi_monitor/io_thresh (percentage)
> + * /sys/kernel/psi_monitor/monitor_interval_ms (milliseconds)
> + * /sys/kernel/psi_monitor/rss_weight
> + * /sys/kernel/psi_monitor/io_weight
> + * /sys/kernel/psi_monitor/cpu_weight
> + *
> + * Author: Pintu Kumar Agarwal
> + */
> +
> +#include <linux/init.h>
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/sched.h>
> +#include <linux/sched/signal.h>
> +#include <linux/sched/loadavg.h>
> +#include <linux/mm.h>
> +#include <linux/delay.h>
> +#include <linux/workqueue.h>
> +#include <linux/psi_types.h>
> +#include <linux/kobject.h>
> +#include <linux/sort.h>
> +#include <linux/jiffies.h>
> +#include <linux/time64.h>
> +#include <linux/sched/cputime.h>
> +
> +/* Create tracepoints defined in include/trace/events/psi_monitor.h */
> +#define CREATE_TRACE_POINTS
> +#include <linux/psi.h>
> +#include <trace/events/psi_monitor.h>
> +
> +
> +/* Sysfs tunables */
> +static unsigned int cpu_thresh = 80; /* in percent */
> +static unsigned int mem_thresh = 80; /* in percent */
> +static unsigned int io_thresh = 80; /* in percent */
> +static unsigned int monitor_interval_ms = 10000;
> +
> +/* scoring weights */
> +static unsigned int rss_weight = 2;
> +static unsigned int io_weight = 1;
> +static unsigned int cpu_weight = 5;
Insanely configurable but what makes it easy for developers to know
the right configurations under severe pressure as you put it?
> +
> +static struct delayed_work psi_work;
> +static struct kobject *psi_kobj;
> +
> +#define TOP_N 20
> +
> +struct task_info {
> + struct task_struct *task;
> + unsigned long rss; /* pages */
> + unsigned long io_kb; /* kB */
> + unsigned long cpu_ms; /* ms */
Isn't the suffix selfexplanatory? Do you really need the comments?
> + u64 score;
> +};
> +
> +/*
> + * psi_avg10_percent() - derive a rough integer percentage from avg10
> + * for a given PSI state (e.g. PSI_CPU_SOME, PSI_MEM_SOME, PSI_IO_SOME).
> + *
> + * psi_group.avg[state][0] is the avg10 window in fixed-point notation.
> + * The conversion here is approximate but monotonic, which is sufficient
> + * for thresholding and ranking in this internal monitor.
> + */
> +static unsigned long psi_avg10_percent(int state)
> +{
> + u64 avg10;
> +
> + if (state < 0 || state >= NR_PSI_STATES)
> + return 0;
> +
> + avg10 = READ_ONCE(psi_system.avg[state][0]);
> + if (!avg10)
> + return 0;
> +
> + /* Convert back from loadavg-style fixed-point to an approximate % */
> + /* Just consider the integer value and ignore fraction */
Why two single line comments?
> + return LOAD_INT(avg10);
> +}
> +
> +static int compare_score_desc(const void *a, const void *b)
> +{
> + const struct task_info *ta = a;
> + const struct task_info *tb = b;
> +
> + if (tb->score > ta->score)
> + return 1;
> + if (tb->score < ta->score)
> + return -1;
> + return 0;
> +}
> +
> +static void log_top_tasks(void)
> +{
> + struct task_info tasks[TOP_N];
> + struct task_struct *p, *t;
> + int count = 0;
> + int i;
> +
> + rcu_read_lock();
> + for_each_process_thread(p, t) {
Thats a ton of work every 10s.
> + struct mm_struct *mm;
> + unsigned long rss = 0;
> + unsigned long io_kb = 0;
> + unsigned long cpu_ms = 0;
> + u64 score;
> +
> + /* Ignore tasks that are not on run queue or idle */
> + if (!t->on_rq && !is_idle_task(t))
Condition doesn't match the comment. Tasks off rq that aren't idle will
still go through.
> + continue;
> +
> + mm = get_task_mm(t);
> +
> + /* mm could be NULL for kernel threads */
> + if (mm) {
> + rss = mm ? get_mm_rss(mm) : 0;
> + mmput_async(mm);
> + }
> +
> + /*
> + * Approximate I/O activity: sum of read + write bytes.
> + * This uses the task_io_accounting fields in task_struct.
> + * Values are best-effort and need not be perfectly accurate
> + * for our ranking purpose.
> + */
> + io_kb = (t->ioac.read_bytes + t->ioac.write_bytes) >> 10;
> +
> + /*
> + * Approximate CPU usage via task_sched_runtime(), converted
> + * to milliseconds. This is cumulative since task start, but
> + * is still useful for comparing hotspots at a given point.
> + */
> + cpu_ms = (unsigned long)(task_sched_runtime(t) / NSEC_PER_MSEC);
> +
> + score = (u64)rss_weight * (u64)rss +
> + (u64)io_weight * (u64)io_kb +
> + (u64)cpu_weight * (u64)cpu_ms;
> +
> + if (count < TOP_N) {
> + tasks[count].task = t;
> + tasks[count].rss = rss;
> + tasks[count].io_kb = io_kb;
> + tasks[count].cpu_ms = cpu_ms;
> + tasks[count].score = score;
> + count++;
> + } else {
> + /* Maintain a simple streaming top-N: replace smallest */
> + int min_idx = 0;
> + int j;
> +
> + for (j = 1; j < TOP_N; j++) {
> + if (tasks[j].score < tasks[min_idx].score)
> + min_idx = j;
> + }
Can't you just cache the min_idx and re-compute it when it changes
instead of taking a O(20) iteration for every task?
> +
> + if (score > tasks[min_idx].score) {
> + tasks[min_idx].task = t;
> + tasks[min_idx].rss = rss;
> + tasks[min_idx].io_kb = io_kb;
> + tasks[min_idx].cpu_ms = cpu_ms;
> + tasks[min_idx].score = score;
> + }
> + }
> + }
> + rcu_read_unlock();
> +
> + sort(tasks, count, sizeof(struct task_info), compare_score_desc, NULL);
> +
> + pr_info("psi_monitor: logging top %d tasks under pressure:\n", count);
> +
> + for (i = 0; i < count; i++) {
> + struct task_struct *ts = tasks[i].task;
> + unsigned long rss_kb = tasks[i].rss << (PAGE_SHIFT - 10);
> + char name[128] = {0,};
> +
> + if (ts->flags & PF_WQ_WORKER)
> + wq_worker_comm(name, sizeof(name), ts);
> + else
> + scnprintf(name, sizeof(name) - 1, ts->comm);
> +
> + trace_psi_monitor_top_task(ts->pid, name,
> + tasks[i].cpu_ms,
> + rss_kb,
> + tasks[i].io_kb,
> + tasks[i].score);
> +
> + pr_info("psi_monitor: pid=%d comm=%s psi_flag=%d oncpu=%d cputime(ms)=%lu rss(kB)=%lu io(kB)=%lu score=%llu\n",
> + ts->pid, name, ts->psi_flags, task_cpu(ts),
> + tasks[i].cpu_ms, rss_kb, tasks[i].io_kb,
> + (unsigned long long)tasks[i].score);
This will unnecessarily dump to dmesg even if you have tracevent
enabled. Why?
> + }
> +}
> +
> +static void psi_monitor_fn(struct work_struct *work)
> +{
> + unsigned long cpu_pct, mem_pct, io_pct;
> + bool trigger = false;
> +
> + cpu_pct = psi_avg10_percent(PSI_CPU_SOME);
> + mem_pct = psi_avg10_percent(PSI_MEM_SOME);
> + io_pct = psi_avg10_percent(PSI_IO_SOME);
> +
> + if (cpu_pct >= cpu_thresh || mem_pct >= mem_thresh ||
> + io_pct >= io_thresh)
> + trigger = true;
> +
> + if (trigger) {
> + pr_info("psi_monitor: pressure high: cpu=%lu%% mem=%lu%% io=%lu%% (thresh cpu=%u mem=%u io=%u)\n",
> + cpu_pct, mem_pct, io_pct,
> + cpu_thresh, mem_thresh, io_thresh);
> + log_top_tasks();
> + }
> +
> + queue_delayed_work(system_wq, &psi_work,
> + msecs_to_jiffies(monitor_interval_ms));
If I set monitor_interval_ms to 6 hours, and then change it back to 10s,
it'll only take effect after this callback has fired 6 hours later.
> +}
> +
> +/* Sysfs helpers */
> +#define PSI_ATTR_RW(_name) \
> +static ssize_t _name##_show(struct kobject *kobj, \
> + struct kobj_attribute *attr, char *buf) \
> +{ \
> + return sysfs_emit(buf, "%u\n", _name); \
> +} \
> +static ssize_t _name##_store(struct kobject *kobj, \
> + struct kobj_attribute *attr, \
> + const char *buf, size_t count) \
> +{ \
> + unsigned int val; \
> + if (kstrtouint(buf, 10, &val)) \
> + return -EINVAL; \
> + _name = val; \
> + return count; \
> +} \
> +static struct kobj_attribute _name##_attr = __ATTR_RW(_name)
> +
> +PSI_ATTR_RW(cpu_thresh);
> +PSI_ATTR_RW(mem_thresh);
> +PSI_ATTR_RW(io_thresh);
> +PSI_ATTR_RW(monitor_interval_ms);
> +PSI_ATTR_RW(rss_weight);
> +PSI_ATTR_RW(io_weight);
> +PSI_ATTR_RW(cpu_weight);
> +
> +static struct attribute *psi_attrs[] = {
> + &cpu_thresh_attr.attr,
> + &mem_thresh_attr.attr,
> + &io_thresh_attr.attr,
> + &monitor_interval_ms_attr.attr,
> + &rss_weight_attr.attr,
> + &io_weight_attr.attr,
> + &cpu_weight_attr.attr,
> + NULL,
> +};
> +
> +static const struct attribute_group psi_attr_group = {
> + .attrs = psi_attrs,
> +};
> +
> +static int __init psi_monitor_init(void)
> +{
> + int ret;
> +
> + INIT_DELAYED_WORK(&psi_work, psi_monitor_fn);
> + queue_delayed_work(system_wq, &psi_work,
> + msecs_to_jiffies(monitor_interval_ms));
> +
> + psi_kobj = kobject_create_and_add("psi_monitor", kernel_kobj);
> + if (!psi_kobj)
> + return -ENOMEM;
> +
> + ret = sysfs_create_group(psi_kobj, &psi_attr_group);
> + if (ret) {
> + kobject_put(psi_kobj);
> + cancel_delayed_work_sync(&psi_work);
> + return ret;
> + }
> +
> + pr_info("psi_monitor: in-kernel PSI auto monitor (weighted + tracepoints) loaded\n");
> + return 0;
> +}
> +
> +static void __exit psi_monitor_exit(void)
> +{
> + cancel_delayed_work_sync(&psi_work);
> + if (psi_kobj)
> + kobject_put(psi_kobj);
> + pr_info("psi_monitor: unloaded\n");
> +}
> +
> +module_init(psi_monitor_init);
> +module_exit(psi_monitor_exit);
There is nothing here that warrants putting this in kernel/sched.
Also this gets included by default when config is enabled and starts
dumping a bunch of stats to dmesg without anyone asking. No?
Afaict, almost all of the detail used here is also available from
procfs and people can easily put together a userspace tool if they
need it. Why do we need an in-kernel module?
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Pintu Kumar Agarwal");
> +MODULE_DESCRIPTION("In-kernel PSI automatic monitor with sysfs, weighted scoring and tracepoints");
> --
> 2.34.1
>
--
Thanks and Regards,
Prateek
^ permalink raw reply
* Re: [PATCH] tracing: Cleanup event_enable_trigger_parse() by using __free()
From: Steven Rostedt @ 2026-07-02 20:53 UTC (permalink / raw)
To: Markus Elfring
Cc: linux-trace-kernel, Masami Hiramatsu, Mathieu Desnoyers, LKML
In-Reply-To: <79106214-b341-46ab-8810-a206ce8fad29@web.de>
On Thu, 2 Jul 2026 11:58:02 +0200
Markus Elfring <Markus.Elfring@web.de> wrote:
> …
> > +++ b/kernel/trace/trace_events_trigger.c
> > @@ -1739,7 +1739,7 @@ int event_enable_trigger_parse(struct event_command *cmd_ops,
> > char *glob, char *cmd, char *param_and_filter)
> > {
> > struct trace_event_file *event_enable_file;
> > - struct enable_trigger_data *enable_data;
> > + struct enable_trigger_data *enable_data __free(kfree) = NULL;
> …
>
> How do you think about to reduce the scope for this local variable?
>
No, it's fine as is.
-- Steve
^ permalink raw reply
* Re: [PATCH v3 2/2] tracing: Remove trace_printk.h from kernel.h
From: Steven Rostedt @ 2026-07-02 20:57 UTC (permalink / raw)
To: Uwe Kleine-König
Cc: linux-kernel, linux-trace-kernel, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Andrew Morton, Linus Torvalds,
Sebastian Andrzej Siewior, John Ogness, Thomas Gleixner,
Peter Zijlstra, Julia Lawall, Yury Norov, regressions
In-Reply-To: <akZpICZ0pGqspV2u@monoceros>
On Thu, 2 Jul 2026 15:43:14 +0200
Uwe Kleine-König <u.kleine-koenig@baylibre.com> wrote:
> This patch became commit 9cbc3d9806d3 ("tracing: Remove trace_printk.h
> from kernel.h") that currently is in next via
>
> https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace/fixes
Thanks for letting me know. I'll remove it and push it up.
I forgot I had it in there :-p
-- Steve
^ permalink raw reply
* Re: [PATCH] tracing: make tracepoint_printk static as not exported
From: Steven Rostedt @ 2026-07-02 22:46 UTC (permalink / raw)
To: Ben Dooks
Cc: Masami Hiramatsu, Mathieu Desnoyers, linux-kernel,
linux-trace-kernel
In-Reply-To: <20260617105822.904164-1-ben.dooks@codethink.co.uk>
On Wed, 17 Jun 2026 11:58:22 +0100
Ben Dooks <ben.dooks@codethink.co.uk> wrote:
> The tracepoint_printk symbol is not exported, so make it
> static to remove the following sparse warning:
>
> kernel/trace/trace.c:90:5: warning: symbol 'tracepoint_printk' was not declared. Should it be static?
>
> Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Thanks, this became only used by this file via commit dd293df6395a2
("tracing: Move trace sysctls into trace.c")
I may add a Fixes tag to that commit.
-- Steve
> ---
> kernel/trace/trace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 6eb4d3097a4d..4c3729c8d5e2 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -87,7 +87,7 @@ void __init disable_tracing_selftest(const char *reason)
>
> /* Pipe tracepoints to printk */
> static struct trace_iterator *tracepoint_print_iter;
> -int tracepoint_printk;
> +static int tracepoint_printk;
> static bool tracepoint_printk_stop_on_boot __initdata;
> static bool traceoff_after_boot __initdata;
> static DEFINE_STATIC_KEY_FALSE(tracepoint_printk_key);
^ permalink raw reply
* Re: [PATCH 1/2] i2c: qcom-geni: trace: Add trace events for Qualcomm GENI I2C
From: Steven Rostedt @ 2026-07-02 23:09 UTC (permalink / raw)
To: Praveen Talari
Cc: Masami Hiramatsu, Mathieu Desnoyers, Mukesh Kumar Savaliya,
Viken Dadhaniya, Andi Shyti, linux-kernel, linux-trace-kernel,
linux-arm-msm, linux-i2c, aniket.randive, chandana.chiluveru
In-Reply-To: <20260630-add-tracepoints-for-qcom-geni-i2c-v1-1-474cd6cdbe27@oss.qualcomm.com>
On Tue, 30 Jun 2026 11:32:45 +0530
Praveen Talari <praveen.talari@oss.qualcomm.com> wrote:
> Add trace event support to the Qualcomm GENI I2C driver to enable
> detailed runtime debugging and analysis.
>
> The trace events capture I2C clock configuration, interrupt status
> and error code and message.
>
> Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
> ---
> include/trace/events/qcom_geni_i2c.h | 82 ++++++++++++++++++++++++++++++++++++
> 1 file changed, 82 insertions(+)
>
> diff --git a/include/trace/events/qcom_geni_i2c.h b/include/trace/events/qcom_geni_i2c.h
> new file mode 100644
> index 000000000000..c7e7984f3620
> --- /dev/null
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
-- Steve
^ permalink raw reply
* Re: [PATCH] tracing: Cleanup event_enable_trigger_parse() by using __free()
From: Markus Elfring @ 2026-07-03 5:00 UTC (permalink / raw)
To: Steven Rostedt, linux-trace-kernel, kernel-janitors
Cc: Masami Hiramatsu, Mathieu Desnoyers, LKML
In-Reply-To: <20260702165346.035f8eef@gandalf.local.home>
>> …
>>> +++ b/kernel/trace/trace_events_trigger.c
>>> @@ -1739,7 +1739,7 @@ int event_enable_trigger_parse(struct event_command *cmd_ops,
>>> char *glob, char *cmd, char *param_and_filter)
>>> {
>>> struct trace_event_file *event_enable_file;
>>> - struct enable_trigger_data *enable_data;
>>> + struct enable_trigger_data *enable_data __free(kfree) = NULL;
>> …
>>
>> How do you think about to reduce the scope for this local variable?
>>
>
> No, it's fine as is.
Does this feedback mean that you disagree to an essential development requirement
according to such a programming interface?
https://elixir.bootlin.com/linux/v7.1.2/source/include/linux/cleanup.h#L142-L153
Regards,
Markus
^ permalink raw reply
* Re: [PATCHv5 00/13] uprobes/x86: Fix red zone issue for optimized uprobes
From: Peter Zijlstra @ 2026-07-03 10:58 UTC (permalink / raw)
To: Andrii Nakryiko
Cc: Jiri Olsa, Oleg Nesterov, Ingo Molnar, Masami Hiramatsu,
Andrii Nakryiko, bpf, linux-trace-kernel
In-Reply-To: <CAEf4BzaDwwW1ebPO+4r5rhmdyXk+XddWTDBzN4iOaCU8qEPZRw@mail.gmail.com>
On Thu, Jul 02, 2026 at 09:20:25AM -0700, Andrii Nakryiko wrote:
> > I failed to release link in test_uprobe_fork_optimized, fix is below
> > I can send new version or separate fix
>
> yeah, please fix the test, adjust comments as pointed out by AI and
> send v6. Seems like Peter wants to pick it up through tip, I don't
> mind.
So I should wait for v6, and not munge the below delta in?
^ permalink raw reply
* Re: [PATCHv5 00/13] uprobes/x86: Fix red zone issue for optimized uprobes
From: Jiri Olsa @ 2026-07-03 11:07 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Andrii Nakryiko, Jiri Olsa, Oleg Nesterov, Ingo Molnar,
Masami Hiramatsu, Andrii Nakryiko, bpf, linux-trace-kernel
In-Reply-To: <20260703105859.GD651302@noisy.programming.kicks-ass.net>
On Fri, Jul 03, 2026 at 12:58:59PM +0200, Peter Zijlstra wrote:
> On Thu, Jul 02, 2026 at 09:20:25AM -0700, Andrii Nakryiko wrote:
>
> > > I failed to release link in test_uprobe_fork_optimized, fix is below
> > > I can send new version or separate fix
> >
> > yeah, please fix the test, adjust comments as pointed out by AI and
> > send v6. Seems like Peter wants to pick it up through tip, I don't
> > mind.
>
> So I should wait for v6, and not munge the below delta in?
yep, I'll send it out later today
thanks,
jirka
^ permalink raw reply
* [PATCHv6 00/13] uprobes/x86: Fix red zone issue for optimized uprobes
From: Jiri Olsa @ 2026-07-03 11:49 UTC (permalink / raw)
To: Oleg Nesterov, Peter Zijlstra, Ingo Molnar, Masami Hiramatsu,
Andrii Nakryiko
Cc: bpf, linux-trace-kernel
hi,
Andrii reported an issue with optimized uprobes [1] that can clobber
redzone area with call instruction storing return address on stack
where user code may keep temporary data without adjusting rsp.
Fixing this by moving the optimized uprobes on top of 10-bytes nop
instruction, so we can squeeze another instruction to escape the
redzone area before doing the call.
Note we need upstream update first for patch 3 (github.com/libbpf/usdt),
if we decide to take this change.
thanks,
jirka
v1: https://lore.kernel.org/bpf/20260514135342.22130-1-jolsa@kernel.org/
v2: https://lore.kernel.org/bpf/20260518105957.123445-1-jolsa@kernel.org/
v3: https://lore.kernel.org/bpf/20260521124411.31133-1-jolsa@kernel.org/
v4: https://lore.kernel.org/bpf/20260526205840.173790-1-jolsa@kernel.org/
v5: https://lore.kernel.org/bpf/20260701111337.53943-1-jolsa@kernel.org/
v6 changes:
- added upstream commit ref for patch#8
- release link in test_uprobe_fork_optimized [ci/asan]
v5 changes:
- several selftests changes and reviewed-by tags [Jakub]
- add more comments in int3_update_unoptimize [Andrii]
- several other minor changes and acks [Oleg]
- move insn_decode out of uprobe_init_insn to simplify the code
- align uprobe_red_zone_test to 64 to make sure nop10 is not on page boundary
v4 changes:
- do not use 2nd int3 (ont +5 offset) because the call instruction
is allways the same for the given nop10 address [Andrii/Peter]
- unmap unused trampoline vma after unsuccesfull optimization [sashiko]
- small change to patch#2 moved user_64bit_mode earlier in the path
and pass/use mm_struct pointer directly from arch_uprobe_optimize
instead of gettting current->mm
Andrii, keeping your ack, please shout otherwise
v3 changes:
- use nop10 update suggested by Peter in [2]
- remove struct uprobe_trampoline object, use vma objects directly instead
- selftests fixes [sashiko]
- ack from Andrii
v2 changes:
- several selftest fixes [sashiko]
- consolidate is_lea_insn and is_call_insn insto single check [Jakub Sitnicki]
- use proper mm_struct object in __in_uprobe_trampoline check [sashiko]
- allow to copy uprobe trampolines vma objects on fork [sashiko]
- change uprobe syscall detection error from -ENXIO to -EPROTO [Andrii]
- added fork/clone tests
- I kept the selftest changes and nop5->nop10 changes in separate
commits for easier review, we can squash them later if we want to keep
bisect working properly
[1] https://lore.kernel.org/bpf/20260509003146.976844-1-andrii@kernel.org/
[2] https://lore.kernel.org/bpf/20260518104306.GU3102624@noisy.programming.kicks-ass.net/#t
---
Andrii Nakryiko (1):
selftests/bpf: Add tests for uprobe nop10 red zone clobbering
Jiri Olsa (12):
uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
uprobes/x86: Remove struct uprobe_trampoline object
uprobes/x86: Do not leak trampoline vma mapping on optimization failure
uprobes/x86: Allow to copy uprobe trampolines on fork
uprobes/x86: Move optimized uprobe from nop5 to nop10
libbpf: Change has_nop_combo to work on top of nop10
libbpf: Detect uprobe syscall with new error
selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch
selftests/bpf: Change uprobe syscall tests to use nop10
selftests/bpf: Change uprobe/usdt trigger bench code to use nop10
selftests/bpf: Add reattach tests for uprobe syscall
selftests/bpf: Add tests for forked/cloned optimized uprobes
arch/x86/kernel/uprobes.c | 416 +++++++++++++++++++++++++++++++++++++++++++-----------------------------
include/linux/uprobes.h | 5 -
kernel/events/uprobes.c | 10 --
kernel/fork.c | 1 -
tools/lib/bpf/features.c | 4 +-
tools/lib/bpf/usdt.c | 16 +--
tools/testing/selftests/bpf/bench.c | 20 ++--
tools/testing/selftests/bpf/benchs/bench_trigger.c | 38 +++----
tools/testing/selftests/bpf/benchs/run_bench_uprobes.sh | 2 +-
tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c | 325 ++++++++++++++++++++++++++++++++++++++++++++++++++++----
tools/testing/selftests/bpf/prog_tests/usdt.c | 74 +++++++++++--
tools/testing/selftests/bpf/progs/test_usdt.c | 25 +++++
tools/testing/selftests/bpf/usdt.h | 2 +-
tools/testing/selftests/bpf/usdt_2.c | 15 ++-
14 files changed, 697 insertions(+), 256 deletions(-)
^ permalink raw reply
* [PATCHv6 01/13] uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
From: Jiri Olsa @ 2026-07-03 11:49 UTC (permalink / raw)
To: Oleg Nesterov, Peter Zijlstra, Ingo Molnar, Masami Hiramatsu,
Andrii Nakryiko
Cc: bpf, linux-trace-kernel
In-Reply-To: <20260703114917.238144-1-jolsa@kernel.org>
In the unregister path we use __in_uprobe_trampoline check with
current->mm for the VMA lookup, which is wrong, because we are
in the tracer context, not the traced process.
Add mm_struct pointer argument to __in_uprobe_trampoline and
changing related callers to pass proper mm_struct pointer.
Fixes: ba2bfc97b462 ("uprobes/x86: Add support to optimize uprobes")
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
arch/x86/kernel/uprobes.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index ebb1baf1eb1d..2be6707e3320 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -761,9 +761,9 @@ void arch_uprobe_clear_state(struct mm_struct *mm)
destroy_uprobe_trampoline(tramp);
}
-static bool __in_uprobe_trampoline(unsigned long ip)
+static bool __in_uprobe_trampoline(struct mm_struct *mm, unsigned long ip)
{
- struct vm_area_struct *vma = vma_lookup(current->mm, ip);
+ struct vm_area_struct *vma = vma_lookup(mm, ip);
return vma && vma_is_special_mapping(vma, &tramp_mapping);
}
@@ -776,14 +776,14 @@ static bool in_uprobe_trampoline(unsigned long ip)
rcu_read_lock();
if (mmap_lock_speculate_try_begin(mm, &seq)) {
- found = __in_uprobe_trampoline(ip);
+ found = __in_uprobe_trampoline(mm, ip);
retry = mmap_lock_speculate_retry(mm, seq);
}
rcu_read_unlock();
if (retry) {
mmap_read_lock(mm);
- found = __in_uprobe_trampoline(ip);
+ found = __in_uprobe_trampoline(mm, ip);
mmap_read_unlock(mm);
}
return found;
@@ -1044,7 +1044,7 @@ static int copy_from_vaddr(struct mm_struct *mm, unsigned long vaddr, void *dst,
return 0;
}
-static bool __is_optimized(uprobe_opcode_t *insn, unsigned long vaddr)
+static bool __is_optimized(struct mm_struct *mm, uprobe_opcode_t *insn, unsigned long vaddr)
{
struct __packed __arch_relative_insn {
u8 op;
@@ -1053,7 +1053,7 @@ static bool __is_optimized(uprobe_opcode_t *insn, unsigned long vaddr)
if (!is_call_insn(insn))
return false;
- return __in_uprobe_trampoline(vaddr + 5 + call->raddr);
+ return __in_uprobe_trampoline(mm, vaddr + 5 + call->raddr);
}
static int is_optimized(struct mm_struct *mm, unsigned long vaddr)
@@ -1064,7 +1064,7 @@ static int is_optimized(struct mm_struct *mm, unsigned long vaddr)
err = copy_from_vaddr(mm, vaddr, &insn, 5);
if (err)
return err;
- return __is_optimized((uprobe_opcode_t *)&insn, vaddr);
+ return __is_optimized(mm, (uprobe_opcode_t *)&insn, vaddr);
}
static bool should_optimize(struct arch_uprobe *auprobe)
--
2.54.0
^ permalink raw reply related
* [PATCHv6 02/13] uprobes/x86: Remove struct uprobe_trampoline object
From: Jiri Olsa @ 2026-07-03 11:49 UTC (permalink / raw)
To: Oleg Nesterov, Peter Zijlstra, Ingo Molnar, Masami Hiramatsu,
Andrii Nakryiko
Cc: bpf, linux-trace-kernel
In-Reply-To: <20260703114917.238144-1-jolsa@kernel.org>
Removing struct uprobe_trampoline object and it's tracking code,
because it's not needed. We can do same thing directly on top of
struct vm_area_struct objects.
This makes the code simpler and allows easy propagation of the
trampoline vma object into child process in following change.
Note the original code called destroy_uprobe_trampoline if the
optimiation failed, but it only freed the struct uprobe_trampoline
object, not the vma. The new vma leak is fixed in following change.
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
arch/x86/kernel/uprobes.c | 106 ++++++++------------------------------
include/linux/uprobes.h | 5 --
kernel/events/uprobes.c | 10 ----
kernel/fork.c | 1 -
4 files changed, 22 insertions(+), 100 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 2be6707e3320..d2933cf77cd3 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -631,11 +631,6 @@ static struct vm_special_mapping tramp_mapping = {
.pages = tramp_mapping_pages,
};
-struct uprobe_trampoline {
- struct hlist_node node;
- unsigned long vaddr;
-};
-
static bool is_reachable_by_call(unsigned long vtramp, unsigned long vaddr)
{
long delta = (long)(vaddr + 5 - vtramp);
@@ -682,83 +677,28 @@ static unsigned long find_nearest_trampoline(unsigned long vaddr)
return high_tramp;
}
-static struct uprobe_trampoline *create_uprobe_trampoline(unsigned long vaddr)
+static struct vm_area_struct *get_uprobe_trampoline(struct mm_struct *mm, unsigned long vaddr)
{
- struct pt_regs *regs = task_pt_regs(current);
- struct mm_struct *mm = current->mm;
- struct uprobe_trampoline *tramp;
+ VMA_ITERATOR(vmi, mm, 0);
struct vm_area_struct *vma;
- if (!user_64bit_mode(regs))
- return NULL;
+ if (vaddr > TASK_SIZE || vaddr < PAGE_SIZE)
+ return ERR_PTR(-EINVAL);
+
+ for_each_vma(vmi, vma) {
+ if (!vma_is_special_mapping(vma, &tramp_mapping))
+ continue;
+ if (is_reachable_by_call(vma->vm_start, vaddr))
+ return vma;
+ }
vaddr = find_nearest_trampoline(vaddr);
if (IS_ERR_VALUE(vaddr))
- return NULL;
+ return ERR_PTR(vaddr);
- tramp = kzalloc_obj(*tramp);
- if (unlikely(!tramp))
- return NULL;
-
- tramp->vaddr = vaddr;
- vma = _install_special_mapping(mm, tramp->vaddr, PAGE_SIZE,
+ return _install_special_mapping(mm, vaddr, PAGE_SIZE,
VM_READ|VM_EXEC|VM_MAYEXEC|VM_MAYREAD|VM_DONTCOPY|VM_IO,
&tramp_mapping);
- if (IS_ERR(vma)) {
- kfree(tramp);
- return NULL;
- }
- return tramp;
-}
-
-static struct uprobe_trampoline *get_uprobe_trampoline(unsigned long vaddr, bool *new)
-{
- struct uprobes_state *state = ¤t->mm->uprobes_state;
- struct uprobe_trampoline *tramp = NULL;
-
- if (vaddr > TASK_SIZE || vaddr < PAGE_SIZE)
- return NULL;
-
- hlist_for_each_entry(tramp, &state->head_tramps, node) {
- if (is_reachable_by_call(tramp->vaddr, vaddr)) {
- *new = false;
- return tramp;
- }
- }
-
- tramp = create_uprobe_trampoline(vaddr);
- if (!tramp)
- return NULL;
-
- *new = true;
- hlist_add_head(&tramp->node, &state->head_tramps);
- return tramp;
-}
-
-static void destroy_uprobe_trampoline(struct uprobe_trampoline *tramp)
-{
- /*
- * We do not unmap and release uprobe trampoline page itself,
- * because there's no easy way to make sure none of the threads
- * is still inside the trampoline.
- */
- hlist_del(&tramp->node);
- kfree(tramp);
-}
-
-void arch_uprobe_init_state(struct mm_struct *mm)
-{
- INIT_HLIST_HEAD(&mm->uprobes_state.head_tramps);
-}
-
-void arch_uprobe_clear_state(struct mm_struct *mm)
-{
- struct uprobes_state *state = &mm->uprobes_state;
- struct uprobe_trampoline *tramp;
- struct hlist_node *n;
-
- hlist_for_each_entry_safe(tramp, n, &state->head_tramps, node)
- destroy_uprobe_trampoline(tramp);
}
static bool __in_uprobe_trampoline(struct mm_struct *mm, unsigned long ip)
@@ -1111,21 +1051,19 @@ int set_orig_insn(struct arch_uprobe *auprobe, struct vm_area_struct *vma,
static int __arch_uprobe_optimize(struct arch_uprobe *auprobe, struct mm_struct *mm,
unsigned long vaddr)
{
- struct uprobe_trampoline *tramp;
- struct vm_area_struct *vma;
- bool new = false;
- int err = 0;
+ struct pt_regs *regs = task_pt_regs(current);
+ struct vm_area_struct *vma, *tramp;
+ int ret;
+ if (!user_64bit_mode(regs))
+ return -EINVAL;
vma = find_vma(mm, vaddr);
if (!vma)
return -EINVAL;
- tramp = get_uprobe_trampoline(vaddr, &new);
- if (!tramp)
- return -EINVAL;
- err = swbp_optimize(auprobe, vma, vaddr, tramp->vaddr);
- if (WARN_ON_ONCE(err) && new)
- destroy_uprobe_trampoline(tramp);
- return err;
+ tramp = get_uprobe_trampoline(mm, vaddr);
+ if (IS_ERR(tramp))
+ return PTR_ERR(tramp);
+ return WARN_ON_ONCE(swbp_optimize(auprobe, vma, vaddr, tramp->vm_start));
}
void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr)
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index f548fea2adec..18be159bbc34 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -186,9 +186,6 @@ struct xol_area;
struct uprobes_state {
struct xol_area *xol_area;
-#ifdef CONFIG_X86_64
- struct hlist_head head_tramps;
-#endif
};
typedef int (*uprobe_write_verify_t)(struct page *page, unsigned long vaddr,
@@ -238,8 +235,6 @@ extern void uprobe_handle_trampoline(struct pt_regs *regs);
extern void *arch_uretprobe_trampoline(unsigned long *psize);
extern unsigned long uprobe_get_trampoline_vaddr(void);
extern void uprobe_copy_from_page(struct page *page, unsigned long vaddr, void *dst, int len);
-extern void arch_uprobe_clear_state(struct mm_struct *mm);
-extern void arch_uprobe_init_state(struct mm_struct *mm);
extern void handle_syscall_uprobe(struct pt_regs *regs, unsigned long bp_vaddr);
extern void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr);
extern unsigned long arch_uprobe_get_xol_area(void);
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 4084e926e284..b5c516168f84 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1806,14 +1806,6 @@ static struct xol_area *get_xol_area(void)
return area;
}
-void __weak arch_uprobe_clear_state(struct mm_struct *mm)
-{
-}
-
-void __weak arch_uprobe_init_state(struct mm_struct *mm)
-{
-}
-
/*
* uprobe_clear_state - Free the area allocated for slots.
*/
@@ -1825,8 +1817,6 @@ void uprobe_clear_state(struct mm_struct *mm)
delayed_uprobe_remove(NULL, mm);
mutex_unlock(&delayed_uprobe_lock);
- arch_uprobe_clear_state(mm);
-
if (!area)
return;
diff --git a/kernel/fork.c b/kernel/fork.c
index 13e38e89a1f3..00b52c7314d1 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1064,7 +1064,6 @@ static void mm_init_uprobes_state(struct mm_struct *mm)
{
#ifdef CONFIG_UPROBES
mm->uprobes_state.xol_area = NULL;
- arch_uprobe_init_state(mm);
#endif
}
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox