include/linux/fprobe.h | 3 +- kernel/trace/fprobe.c | 151 +++++++----- tools/testing/selftests/bpf/bench.c | 4 + .../selftests/bpf/benchs/bench_trigger.c | 54 ++++ .../selftests/bpf/benchs/run_bench_trigger.sh | 4 +- .../bpf/prog_tests/kprobe_multi_test.c | 220 +---------------- .../selftests/bpf/progs/trigger_bench.c | 12 + tools/testing/selftests/bpf/trace_helpers.c | 233 ++++++++++++++++++ tools/testing/selftests/bpf/trace_helpers.h | 3 + 9 files changed, 398 insertions(+), 286 deletions(-)
For now, the budget of the hash table that is used for fprobe_ip_table is fixed, which is 256, and can cause huge overhead when the hooked functions is a huge quantity. In this series, we use rhltable for fprobe_ip_table to reduce the overhead. Meanwhile, we also add the benchmark testcase "kprobe-multi-all" and, which will hook all the kernel functions during the testing. Before this series, the performance is: usermode-count : 889.269 ± 0.053M/s kernel-count : 437.149 ± 0.501M/s syscall-count : 31.618 ± 0.725M/s fentry : 135.591 ± 0.129M/s fexit : 68.127 ± 0.062M/s fmodret : 71.764 ± 0.098M/s rawtp : 198.375 ± 0.190M/s tp : 79.770 ± 0.064M/s kprobe : 54.590 ± 0.021M/s kprobe-multi : 57.940 ± 0.044M/s kprobe-multi-all: 12.151 ± 0.020M/s kretprobe : 21.945 ± 0.163M/s kretprobe-multi: 28.199 ± 0.018M/s kretprobe-multi-all: 9.667 ± 0.008M/s With this series, the performance is: usermode-count : 888.863 ± 0.378M/s kernel-count : 429.339 ± 0.136M/s syscall-count : 31.215 ± 0.019M/s fentry : 135.604 ± 0.118M/s fexit : 68.470 ± 0.074M/s fmodret : 70.957 ± 0.016M/s rawtp : 202.650 ± 0.304M/s tp : 80.428 ± 0.053M/s kprobe : 55.915 ± 0.074M/s kprobe-multi : 54.015 ± 0.039M/s kprobe-multi-all: 46.381 ± 0.024M/s kretprobe : 22.234 ± 0.050M/s kretprobe-multi: 27.946 ± 0.016M/s kretprobe-multi-all: 24.439 ± 0.016M/s The benchmark of "kprobe-multi-all" increase from 12.151M/s to 46.381M/s. I don't know why, but the benchmark result for "kprobe-multi-all" is much better in this version for the legacy case(without this series). In V2, the benchmark increase from 6.283M/s to 54.487M/s, but it become 12.151M/s to 46.381M/s in this version. Maybe it has some relation with the compiler optimization :/ The result of this version should be more accurate, which is similar to Jiri's result: from 3.565 ± 0.047M/s to 11.553 ± 0.458M/s. Changes since V4: * remove unnecessary rcu_read_lock in fprobe_entry Changes since V3: * replace rhashtable_walk_enter with rhltable_walk_enter in the 1st patch Changes since V2: * some format optimization, and handle the error that returned from rhltable_insert in insert_fprobe_node for the 1st patch * add "kretprobe-multi-all" testcase to the 4th patch * attach a empty kprobe-multi prog to the kernel functions, which don't call incr_count(), to make the result more accurate in the 4th patch Changes Since V1: * use rhltable instead of rhashtable to handle the duplicate key. Menglong Dong (4): fprobe: use rhltable for fprobe_ip_table selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c selftests/bpf: skip recursive functions for kprobe_multi selftests/bpf: add benchmark testing for kprobe-multi-all include/linux/fprobe.h | 3 +- kernel/trace/fprobe.c | 151 +++++++----- tools/testing/selftests/bpf/bench.c | 4 + .../selftests/bpf/benchs/bench_trigger.c | 54 ++++ .../selftests/bpf/benchs/run_bench_trigger.sh | 4 +- .../bpf/prog_tests/kprobe_multi_test.c | 220 +---------------- .../selftests/bpf/progs/trigger_bench.c | 12 + tools/testing/selftests/bpf/trace_helpers.c | 233 ++++++++++++++++++ tools/testing/selftests/bpf/trace_helpers.h | 3 + 9 files changed, 398 insertions(+), 286 deletions(-) -- 2.50.1
On Sun, 17 Aug 2025 10:46:01 +0800 Menglong Dong <menglong8.dong@gmail.com> wrote: > For now, the budget of the hash table that is used for fprobe_ip_table is > fixed, which is 256, and can cause huge overhead when the hooked functions > is a huge quantity. > > In this series, we use rhltable for fprobe_ip_table to reduce the > overhead. > > Meanwhile, we also add the benchmark testcase "kprobe-multi-all" and, which > will hook all the kernel functions during the testing. Before this series, > the performance is: > usermode-count : 889.269 ± 0.053M/s > kernel-count : 437.149 ± 0.501M/s > syscall-count : 31.618 ± 0.725M/s > fentry : 135.591 ± 0.129M/s > fexit : 68.127 ± 0.062M/s > fmodret : 71.764 ± 0.098M/s > rawtp : 198.375 ± 0.190M/s > tp : 79.770 ± 0.064M/s > kprobe : 54.590 ± 0.021M/s > kprobe-multi : 57.940 ± 0.044M/s > kprobe-multi-all: 12.151 ± 0.020M/s > kretprobe : 21.945 ± 0.163M/s > kretprobe-multi: 28.199 ± 0.018M/s > kretprobe-multi-all: 9.667 ± 0.008M/s > > With this series, the performance is: > usermode-count : 888.863 ± 0.378M/s > kernel-count : 429.339 ± 0.136M/s > syscall-count : 31.215 ± 0.019M/s > fentry : 135.604 ± 0.118M/s > fexit : 68.470 ± 0.074M/s > fmodret : 70.957 ± 0.016M/s > rawtp : 202.650 ± 0.304M/s > tp : 80.428 ± 0.053M/s > kprobe : 55.915 ± 0.074M/s > kprobe-multi : 54.015 ± 0.039M/s > kprobe-multi-all: 46.381 ± 0.024M/s > kretprobe : 22.234 ± 0.050M/s > kretprobe-multi: 27.946 ± 0.016M/s > kretprobe-multi-all: 24.439 ± 0.016M/s > > The benchmark of "kprobe-multi-all" increase from 12.151M/s to 46.381M/s. > > I don't know why, but the benchmark result for "kprobe-multi-all" is much > better in this version for the legacy case(without this series). In V2, > the benchmark increase from 6.283M/s to 54.487M/s, but it become > 12.151M/s to 46.381M/s in this version. Maybe it has some relation with > the compiler optimization :/ > > The result of this version should be more accurate, which is similar to > Jiri's result: from 3.565 ± 0.047M/s to 11.553 ± 0.458M/s. Hi Menglong, BTW, fprobe itself is maintained in linux-trace tree, not bpf-next. This improvement can be tested via tracefs. echo 'f:allfunc *' >> /sys/kernel/tracing/dynamic_events So, can you split this series in fprobe performance improvement[1/4] for linux-trace and others ([2/4]-[4/4]) for bpf-next? I'll pick the first one. Thank you, > > Changes since V4: > > * remove unnecessary rcu_read_lock in fprobe_entry > > Changes since V3: > > * replace rhashtable_walk_enter with rhltable_walk_enter in the 1st patch > > Changes since V2: > > * some format optimization, and handle the error that returned from > rhltable_insert in insert_fprobe_node for the 1st patch > * add "kretprobe-multi-all" testcase to the 4th patch > * attach a empty kprobe-multi prog to the kernel functions, which don't > call incr_count(), to make the result more accurate in the 4th patch > > Changes Since V1: > > * use rhltable instead of rhashtable to handle the duplicate key. > > Menglong Dong (4): > fprobe: use rhltable for fprobe_ip_table > selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c > selftests/bpf: skip recursive functions for kprobe_multi > selftests/bpf: add benchmark testing for kprobe-multi-all > > include/linux/fprobe.h | 3 +- > kernel/trace/fprobe.c | 151 +++++++----- > tools/testing/selftests/bpf/bench.c | 4 + > .../selftests/bpf/benchs/bench_trigger.c | 54 ++++ > .../selftests/bpf/benchs/run_bench_trigger.sh | 4 +- > .../bpf/prog_tests/kprobe_multi_test.c | 220 +---------------- > .../selftests/bpf/progs/trigger_bench.c | 12 + > tools/testing/selftests/bpf/trace_helpers.c | 233 ++++++++++++++++++ > tools/testing/selftests/bpf/trace_helpers.h | 3 + > 9 files changed, 398 insertions(+), 286 deletions(-) > > -- > 2.50.1 > -- Masami Hiramatsu (Google) <mhiramat@kernel.org>
On Tue, Aug 19, 2025 at 9:48 AM Masami Hiramatsu <mhiramat@kernel.org> wrote: > > On Sun, 17 Aug 2025 10:46:01 +0800 > Menglong Dong <menglong8.dong@gmail.com> wrote: > > > For now, the budget of the hash table that is used for fprobe_ip_table is > > fixed, which is 256, and can cause huge overhead when the hooked functions > > is a huge quantity. > > > > In this series, we use rhltable for fprobe_ip_table to reduce the > > overhead. > > > > Meanwhile, we also add the benchmark testcase "kprobe-multi-all" and, which > > will hook all the kernel functions during the testing. Before this series, > > the performance is: > > usermode-count : 889.269 ± 0.053M/s > > kernel-count : 437.149 ± 0.501M/s > > syscall-count : 31.618 ± 0.725M/s > > fentry : 135.591 ± 0.129M/s > > fexit : 68.127 ± 0.062M/s > > fmodret : 71.764 ± 0.098M/s > > rawtp : 198.375 ± 0.190M/s > > tp : 79.770 ± 0.064M/s > > kprobe : 54.590 ± 0.021M/s > > kprobe-multi : 57.940 ± 0.044M/s > > kprobe-multi-all: 12.151 ± 0.020M/s > > kretprobe : 21.945 ± 0.163M/s > > kretprobe-multi: 28.199 ± 0.018M/s > > kretprobe-multi-all: 9.667 ± 0.008M/s > > > > With this series, the performance is: > > usermode-count : 888.863 ± 0.378M/s > > kernel-count : 429.339 ± 0.136M/s > > syscall-count : 31.215 ± 0.019M/s > > fentry : 135.604 ± 0.118M/s > > fexit : 68.470 ± 0.074M/s > > fmodret : 70.957 ± 0.016M/s > > rawtp : 202.650 ± 0.304M/s > > tp : 80.428 ± 0.053M/s > > kprobe : 55.915 ± 0.074M/s > > kprobe-multi : 54.015 ± 0.039M/s > > kprobe-multi-all: 46.381 ± 0.024M/s > > kretprobe : 22.234 ± 0.050M/s > > kretprobe-multi: 27.946 ± 0.016M/s > > kretprobe-multi-all: 24.439 ± 0.016M/s > > > > The benchmark of "kprobe-multi-all" increase from 12.151M/s to 46.381M/s. > > > > I don't know why, but the benchmark result for "kprobe-multi-all" is much > > better in this version for the legacy case(without this series). In V2, > > the benchmark increase from 6.283M/s to 54.487M/s, but it become > > 12.151M/s to 46.381M/s in this version. Maybe it has some relation with > > the compiler optimization :/ > > > > The result of this version should be more accurate, which is similar to > > Jiri's result: from 3.565 ± 0.047M/s to 11.553 ± 0.458M/s. > > Hi Menglong, > > BTW, fprobe itself is maintained in linux-trace tree, not bpf-next. > This improvement can be tested via tracefs. > > echo 'f:allfunc *' >> /sys/kernel/tracing/dynamic_events > > So, can you split this series in fprobe performance improvement[1/4] for > linux-trace and others ([2/4]-[4/4]) for bpf-next? > > I'll pick the first one. OK! I'll resend the first patch to linux-trace alone, and make 2-4 a series to the bpf-next. > > Thank you, > > > > > Changes since V4: > > > > * remove unnecessary rcu_read_lock in fprobe_entry > > > > Changes since V3: > > > > * replace rhashtable_walk_enter with rhltable_walk_enter in the 1st patch > > > > Changes since V2: > > > > * some format optimization, and handle the error that returned from > > rhltable_insert in insert_fprobe_node for the 1st patch > > * add "kretprobe-multi-all" testcase to the 4th patch > > * attach a empty kprobe-multi prog to the kernel functions, which don't > > call incr_count(), to make the result more accurate in the 4th patch > > > > Changes Since V1: > > > > * use rhltable instead of rhashtable to handle the duplicate key. > > > > Menglong Dong (4): > > fprobe: use rhltable for fprobe_ip_table > > selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c > > selftests/bpf: skip recursive functions for kprobe_multi > > selftests/bpf: add benchmark testing for kprobe-multi-all > > > > include/linux/fprobe.h | 3 +- > > kernel/trace/fprobe.c | 151 +++++++----- > > tools/testing/selftests/bpf/bench.c | 4 + > > .../selftests/bpf/benchs/bench_trigger.c | 54 ++++ > > .../selftests/bpf/benchs/run_bench_trigger.sh | 4 +- > > .../bpf/prog_tests/kprobe_multi_test.c | 220 +---------------- > > .../selftests/bpf/progs/trigger_bench.c | 12 + > > tools/testing/selftests/bpf/trace_helpers.c | 233 ++++++++++++++++++ > > tools/testing/selftests/bpf/trace_helpers.h | 3 + > > 9 files changed, 398 insertions(+), 286 deletions(-) > > > > -- > > 2.50.1 > > > > > -- > Masami Hiramatsu (Google) <mhiramat@kernel.org>
© 2016 - 2025 Red Hat, Inc.