Skip to content

Add support for executing a program and tracing it#5362

Merged
yonghong-song merged 1 commit intoiovisor:masterfrom
xingfeng2510:enhance
Jul 14, 2025
Merged

Add support for executing a program and tracing it#5362
yonghong-song merged 1 commit intoiovisor:masterfrom
xingfeng2510:enhance

Conversation

@xingfeng2510
Copy link
Contributor

@xingfeng2510 xingfeng2510 commented Jul 12, 2025

For short-lived processes, specify '-p pid' is difficult to trace. Add support for executing a program and tracing it. When the newly child process exits, tool itself exists subsequently.

Added to syscount/opensnoop tools this time, other tools as needed.

For example:
./syscount.py -i 1 --exec ls -l /tmp

@yonghong-song Please take a look, thanks.

@xingfeng2510
Copy link
Contributor Author

Merging is blocked. You're not authorized to push to this branch.

What should I do?

@yonghong-song
Copy link
Collaborator

Merging is blocked. You're not authorized to push to this branch.

What should I do?

I will double check and if good will merge.

yonghong-song pushed a commit that referenced this pull request Jul 13, 2025
When testing #5362,
I found the following verification failure for fentry progs:

  ...
  44: (b7) r0 = 0                       ; R0_w=0 refs=3
  45: (95) exit
  Unreleased reference id=3 alloc_insn=10

The reason is missing `ringbuf_discard` for certain conditionals
for fentry progs since it used `ringbuf_reserve`. Adding
`ringbuf_discard` in proper places can fix verification failure.
yonghong-song added a commit that referenced this pull request Jul 13, 2025
When testing #5362,
I found the following verification failure for fentry progs:

  ...
  44: (b7) r0 = 0                       ; R0_w=0 refs=3
  45: (95) exit
  Unreleased reference id=3 alloc_insn=10

The reason is missing `ringbuf_discard` for certain conditionals
for fentry progs since it used `ringbuf_reserve`. Adding
`ringbuf_discard` in proper places can fix verification failure.
@yonghong-song
Copy link
Collaborator

Please rebase on top of master. See #5364.

@xingfeng2510
Copy link
Contributor Author

Rebased, thanks.

@yonghong-song yonghong-song merged commit 78423e1 into iovisor:master Jul 14, 2025
1 of 12 checks passed
ekyooo added a commit to ekyooo/bcc that referenced this pull request Jan 23, 2026
  * Support for kernel up to 6.18

  * New Tools
    tools/softirqslower: New tool to trace slow software interrupt handlers (iovisor#5356)

  * Enhanced Functionality
    libbpf-tools/opensnoop: Added full-path support with `-F` option (iovisor#5323, iovisor#5333)
    libbpf-tools/filelife: Added full-path support (iovisor#5347, ab8e061)
    libbpf-tools: Introduced path helpers (ab8e061)
    libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
    libbpf-tools/filetop: Added directory filter capability (iovisor#5300)
    libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
    libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (iovisor#5342)
    libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
    libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
    tools/opensnoop: Added full-path support with `-F` option (iovisor#5334, iovisor#5339)
    tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
    tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
    Python uprobe API: Added functionality to detach all uprobes for a binary (iovisor#5325)
    Python API: Added support for executing a program and tracing it (iovisor#5362)

  * Bug Fixes
    libbpf-tools/filelife: Fixed wrong full-path handling (iovisor#5347)
    libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
    libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
    libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (iovisor#5327, d507a53)
    libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
    libbpf-tools/ksnoop: Fixed two invalid access to map value (iovisor#5361)
    libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (iovisor#5359)
    libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
    libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
    tools/tcpaccept: Fixed on recent kernels (c208d0e)
    tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (iovisor#5382)
    tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
    tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (iovisor#5366)
    Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
    CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
    Python TCP: Added state2str() and applied to tools (bfa05d2)
    s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)

  * Build & Test Fixes
    Fixed build failure with clang21 (iovisor#5369)
    Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (iovisor#5401)
    ci: Make version.cmake handle shallow clone (2232b7e)
    ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
    tests: Added coverage for versioned SONAME resolution (c351210)
    Removed luajit options to ensure no errors (26eaf13)

  * Doc update, other bug fixes and tools improvement
ekyooo added a commit that referenced this pull request Jan 26, 2026
  * Support for kernel up to 6.18

  * New Tools
    tools/softirqslower: New tool to trace slow software interrupt handlers (#5356)

  * Enhanced Functionality
    libbpf-tools/opensnoop: Added full-path support with `-F` option (#5323, #5333)
    libbpf-tools/filelife: Added full-path support (#5347, ab8e061)
    libbpf-tools: Introduced path helpers (ab8e061)
    libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
    libbpf-tools/filetop: Added directory filter capability (#5300)
    libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
    libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (#5342)
    libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
    libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
    tools/opensnoop: Added full-path support with `-F` option (#5334, #5339)
    tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
    tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
    Python uprobe API: Added functionality to detach all uprobes for a binary (#5325)
    Python API: Added support for executing a program and tracing it (#5362)

  * Bug Fixes
    libbpf-tools/filelife: Fixed wrong full-path handling (#5347)
    libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
    libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
    libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (#5327, d507a53)
    libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
    libbpf-tools/ksnoop: Fixed two invalid access to map value (#5361)
    libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (#5359)
    libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
    libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
    tools/tcpaccept: Fixed on recent kernels (c208d0e)
    tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (#5382)
    tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
    tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (#5366)
    Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
    CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
    Python TCP: Added state2str() and applied to tools (bfa05d2)
    s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)

  * Build & Test Fixes
    Fixed build failure with clang21 (#5369)
    Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (#5401)
    ci: Make version.cmake handle shallow clone (2232b7e)
    ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
    tests: Added coverage for versioned SONAME resolution (c351210)
    Removed luajit options to ensure no errors (26eaf13)

  * Doc update, other bug fixes and tools improvement
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants