Re: [PATCH v4 0/2] perf trace: Refactor augmented_raw_syscalls using bpf_for

[Namhyung Kim]

Hello,

On Tue, Jul 07, 2026 at 08:52:45AM +0200, Viktor Malik wrote:
> The loop for processing syscall args in augment_raw_syscalls has a
> history of breaking with Clang updates. In the past, we've seen it break
> (i.e. stop passing the BPF verifier) between Clang 15 and 16 and now a
> similar thing happened between Clang 21 and 22. While the issue is
> mitigated on the main line by a recent verifier update, it remains
> broken on the 6.12 and 6.18 stable branches, effectively breaking
> `perf trace`.
> 
> The reason is that the loop is quite complex and the BPF verifier often
> struggles to prove that it terminates.
> 
> This series fixes the issue by replacing the standard for loop by the
> bpf_for macro, which uses numeric BPF iterator. This should prevent
> future breakages of this kind since the verifier has much easier job
> proving that the loop terminates. Small adjustments were necessary for
> the loop to make it work, see the second commit message for details.
> 
> To keep perf compatible with older kernels, the first commit factors out
> the loop body into a function, which is then called either from bpf_for
> or from a standard for loop, depending on whether BPF numeric iterators
> are available.
> 
> Changes from v3:
> - v3: https://lore.kernel.org/bpf/cover.1783339165.git.vmalik@xxxxxxxxxx/
> - Do not remove any hacks from the BPF program to keep it backwards
>   compatible with older kernels and Clang versions (Sashiko).
> 
> Changes from v2:
> - v2: https://lore.kernel.org/bpf/cover.1783070132.git.vmalik@xxxxxxxxxx/T/
> - Small refactoring suggested by Namhhyung
> - Make `size` in augment_arg() an int (found by Sashiko)
> - Keep the original way of clamping aug_size to TRACE_AUG_MAX_BUF (found
>   by Sashiko)
> 
> Changes from v1:
> - v1: https://lore.kernel.org/bpf/akWqIfWPMCdaGgGg@xxxxxxxxxx/T/
> - Use bpf_for instead of bpf_loop (suggested by Alexei and Andrii)
> - Keep the change backwards compatible with older kernels (required by
>   Namhyung)

Andrii, are you ok with this?

Thanks,
Namhyung

> 
> Viktor Malik (2):
>   perf trace: Factor out BPF loop body
>   perf trace: Refactor augmented_raw_syscalls using bpf_for
> 
>  .../bpf_skel/augmented_raw_syscalls.bpf.c     | 155 +++++++++++-------
>  1 file changed, 98 insertions(+), 57 deletions(-)
> 
> -- 
> 2.54.0
>