Skip to content

libbpf-tools/offcputime: fix PID filters in PID namespaces #5524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
usamoi wants to merge 1 commit into
base: master
Choose a base branch
from
+51 −9
Open

libbpf-tools/offcputime: fix PID filters in PID namespaces #5524

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions libbpf-tools/offcputime.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@ const volatile __u64 min_block_us = 1;
const volatile bool filter_by_tgid = false;
const volatile bool filter_by_pid = false;
const volatile long state = -1;
const volatile bool use_pidns = false;
const volatile __u64 pidns_dev = 0;
const volatile __u64 pidns_ino = 0;

struct internal_key {
u64 start_ts;
Expand Down Expand Up @@ -56,14 +59,27 @@ struct {
__uint(max_entries, MAX_TID_NR);
} pids SEC(".maps");

static bool allow_record(struct task_struct *t)
static bool allow_record(struct task_struct *t, u32* ns_pid, u32* ns_tgid)
{
u32 tgid = BPF_CORE_READ(t, tgid);
u32 pid = BPF_CORE_READ(t, pid);
s64 id;
struct bpf_pidns_info ns = {};

if (use_pidns && BPF_CORE_READ(t, pid) != 0) {
if (!bpf_get_ns_current_pid_tgid(pidns_dev, pidns_ino, &ns, sizeof(ns))) {

@ekyooo ekyooo Jun 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't kernel thread fail the bpf_get_ns_current_pid_tgid namespace translation?
If so, wouldn't allow_record return false early and completely filter out all kernel threads?

*ns_pid = ns.pid;
*ns_tgid = ns.tgid;
} else {
return false;
}
} else {
id = bpf_get_current_pid_tgid();
*ns_pid = id;
*ns_tgid = id >> 32;
}

if (filter_by_tgid && !bpf_map_lookup_elem(&tgids, &tgid))
if (filter_by_tgid && !bpf_map_lookup_elem(&tgids, ns_tgid))
return false;
if (filter_by_pid && !bpf_map_lookup_elem(&pids, &pid))
if (filter_by_pid && !bpf_map_lookup_elem(&pids, ns_pid))
return false;
if (user_threads_only && (BPF_CORE_READ(t, flags) & PF_KTHREAD))
return false;
Expand All @@ -79,9 +95,9 @@ static int handle_sched_switch(void *ctx, bool preempt, struct task_struct *prev
struct internal_key *i_keyp, i_key;
struct val_t *valp, val;
s64 delta;
u32 pid;
u32 pid, ns_pid, ns_tgid;

if (allow_record(prev)) {
if (allow_record(prev, &ns_pid, &ns_tgid)) {
pid = BPF_CORE_READ(prev, pid);
/* To distinguish idle threads of different cores */
if (!pid)
Expand All @@ -97,6 +113,8 @@ static int handle_sched_switch(void *ctx, bool preempt, struct task_struct *prev
i_key.key.kern_stack_id = bpf_get_stackid(ctx, &stackmap, 0);
bpf_map_update_elem(&start, &pid, &i_key, 0);
bpf_probe_read_kernel_str(&val.comm, sizeof(prev->comm), BPF_CORE_READ(prev, comm));
val.ns_pid = ns_pid;
val.ns_tgid = ns_tgid;
val.delta = 0;
bpf_map_update_elem(&info, &i_key.key, &val, BPF_NOEXIST);
}
Expand Down
26 changes: 24 additions & 2 deletions libbpf-tools/offcputime.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
#include <time.h>
#include <bpf/libbpf.h>
#include <bpf/bpf.h>
#include <sys/stat.h>
#include "offcputime.h"
#include "offcputime.skel.h"
#include "trace_helpers.h"
Expand Down Expand Up @@ -252,7 +253,7 @@ static void print_map(struct ksyms *ksyms, struct syms_cache *syms_cache,
goto skip_ustack;
}

syms = syms_cache__get_syms(syms_cache, next_key.tgid);
syms = syms_cache__get_syms(syms_cache, val.ns_tgid);
if (!syms) {
if (!env.verbose) {
fprintf(stderr, "failed to get syms\n");
Expand Down Expand Up @@ -282,7 +283,7 @@ static void print_map(struct ksyms *ksyms, struct syms_cache *syms_cache,
}

skip_ustack:
printf(" %-16s %s (%d)\n", "-", val.comm, next_key.pid);
printf(" %-16s %s (%d)\n", "-", val.comm, val.ns_pid);
printf(" %lld\n\n", val.delta);
}

Expand Down Expand Up @@ -312,6 +313,23 @@ static bool print_header_threads()
return printed;
}

static int set_pidns(const struct offcputime_bpf *obj)
{
struct stat statbuf;

if (!probe_bpf_ns_current_pid_tgid())
return -EPERM;

if (stat("/proc/self/ns/pid", &statbuf) == -1)
return -errno;

obj->rodata->use_pidns = true;
obj->rodata->pidns_dev = statbuf.st_dev;
obj->rodata->pidns_ino = statbuf.st_ino;

return 0;
}

static void print_headers()
{
printf("Tracing off-CPU time (us) of");
Expand Down Expand Up @@ -381,6 +399,10 @@ int main(int argc, char **argv)
else
bpf_program__set_autoload(obj->progs.sched_switch_raw, false);

err = set_pidns(obj);
if (err && env.verbose)
fprintf(stderr, "failed to translate pidns: %s\n", strerror(-err));

err = offcputime_bpf__load(obj);
if (err) {
fprintf(stderr, "failed to load BPF programs\n");
Expand Down
2 changes: 2 additions & 0 deletions libbpf-tools/offcputime.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ struct key_t {
};

struct val_t {
__u32 ns_pid;
__u32 ns_tgid;
__u64 delta;
char comm[TASK_COMM_LEN];
};
Expand Down