Re: [PATCH v4 2/7] perf bpf-filter: Support BPF sample filters on tracepoint events

[Namhyung Kim]

On Tue, Oct 20, 2026 at 08:30:26AM -0700, Ian Rogers wrote:
> On Mon, Oct 19, 2026 at 10:41 PM Namhyung Kim <namhyung@xxxxxxxxxx> wrote:
> >
> > On Mon, Oct 19, 2026 at 03:09:10PM -0700, Ian Rogers wrote:
> > > Commit 466db4275edd ("perf parse-events: Add parse_uid_filter helper")
> > > updated set_filter() to route non-tracepoint filter terms (such as uid
> > > and gid) on PERF_TYPE_TRACEPOINT events to evsel->bpf_filters instead
> > > of the ftrace tracepoint predicate filter.
> > >
> > > However, in the kernel's __perf_event_set_bpf_prog()
> > > (kernel/events/core.c), attaching a BPF program to a perf_event fd
> > > branches on perf_event_is_tracing(event):
> > > - Non-tracing events (hardware PMU, software events, breakpoints) call
> > >   perf_event_set_bpf_handler(), which requires BPF_PROG_TYPE_PERF_EVENT
> > >   (SEC("perf_event")).
> > > - Tracepoint events (event->pmu == &perf_tracepoint) reject
> > >   BPF_PROG_TYPE_PERF_EVENT with -EINVAL and instead require
> > >   BPF_PROG_TYPE_TRACEPOINT (SEC("tracepoint")), which is attached to
> > >   event->tp_event->prog_array and executed in
> > >   perf_trace_run_bpf_submit() before perf_tp_event(), dropping the
> > >   sample if the BPF program returns 0. Furthermore, the
> > >   bpf_cast_to_kern_ctx() kfunc is only permitted in
> > >   BPF_PROG_TYPE_PERF_EVENT programs.
> > >
> > > Add SEC("tracepoint") int perf_tp_sample_filter(void *ctx) in
> > > sample_filter.bpf.c to evaluate context-independent filter terms (uid,
> > > gid, tid, cpu, time, cgroup) using BPF helpers without calling
> > > bpf_cast_to_kern_ctx(). When preparing a BPF filter on a
> > > PERF_TYPE_TRACEPOINT evsel, autoload perf_tp_sample_filter instead of
> > > perf_sample_filter and attach it once to the shared trace_event_call.
> > >
> > > Before:
> > >   # perf record -e kmem:mm_page_alloc --filter 'uid == 0' -- true
> > >   libbpf: prog 'perf_sample_filter': failed to attach to perf_event FD 3: Invalid argument
> > >   Failed to attach perf sample-filter program
> > >   failed to set filter "BPF" on event kmem:mm_page_alloc with 22 (Invalid argument)
> > >
> > > After:
> > >   # perf record -e kmem:mm_page_alloc --filter 'uid == 0' -- true
> > >   [ perf record: Woken up 1 times to write data ]
> > >   [ perf record: Captured and wrote 0.024 MB perf.data (42 samples) ]
> > >
> > > Fixes: 466db4275edd ("perf parse-events: Add parse_uid_filter helper")
> > > Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
> > > ---
[SNIP]
> > > @@ -674,7 +761,7 @@ int perf_bpf_filter__pin(void)
> > >               goto err;
> > >       }
> > >
> > > -     ret = bpf_object__pin(skel->obj, path);
> > > +     ret = pin_filter_object(skel, path);
> >
> > Why is this change needed?
> 
> Before this patch, sample_filter.bpf.c only contained a single BPF
> program (perf_sample_filter), which was always loaded. This patch adds
> a second program (perf_tp_sample_filter) to the same skeleton (and
> patch 4 adds the lock-tracking programs to it as well), and uses
> bpf_program__set_autoload() before loading the skeleton so we can
> select only the program(s) needed for a given event.
> 
> In perf_bpf_filter__pin() and perf_bpf_filter__unpin() (for 'perf
> record --setup-filter pin|unpin'), only perf_sample_filter is used,
> because the pinned filter mechanism shares a single program across
> privileged sessions by looking up kctx->event->id via
> bpf_cast_to_kern_ctx(), which is only available to SEC("perf_event")
> programs. So autoload is disabled for perf_tp_sample_filter (and in
> patch 4, for the lock-tracking programs) when pinning and unpinning.
> 
> A consequence of disabling autoload on any program in the skeleton is
> that libbpf's bpf_object__pin() and bpf_object__unpin() fail:
>   - bpf_object__pin() calls bpf_object__pin_maps() and
> bpf_object__pin_programs().
>   - While bpf_object__pin_maps() skips maps that have autocreate
> disabled, bpf_object__pin_programs() and bpf_object__unpin_programs()
> iterate over every program in skel->obj without checking whether
> autoload was enabled.

Looks like it needs a fix in the libbpf.


>   - When bpf_program__pin() or bpf_program__unpin() is called on a
> program that wasn't loaded (prog->fd < 0), libbpf returns -EINVAL
> ("prog 'perf_tp_sample_filter': can't pin/unpin program that wasn't
> loaded").
> 
> pin_filter_object() and unpin_filter_object() avoid this by calling
> bpf_object__pin_maps() / bpf_object__unpin_maps() for the maps and
> explicitly pinning/unpinning only the loaded perf_sample_filter
> program.

Thanks for the explanation.  It'd be nice if we can have it in a comment.

Thanks,
Namhyung