aya: plumb PerfEventScope through probe attach

swananan · swananan · commit 391d0589482a · 2026-04-27T00:42:41.000+08:00
Remove the intermediate Option&lt;u32&gt; pid plumbing from probe
attachment paths and pass PerfEventScope through to the perf_event
helpers directly. This keeps the UProbeScope to PerfEventScope
conversion in UProbe::attach, where both the process scope and
/proc/&lt;pid&gt;/maps lookup semantics are visible.

These kprobe, uprobe, and tracepoint attach paths are backed by
perf_event. For all-processes attachment, perf_event_open requires
an explicit CPU, so use CPU 0 only to open the backing perf event.
Process-scoped uprobes continue to use cpu=-1 through PerfEventScope.
diff --git a/aya/src/programs/kprobe.rs b/aya/src/programs/kprobe.rs
@@ -15,6 +15,7 @@ use crate::{
         ProgramData, ProgramError, ProgramType, define_link_wrapper, impl_try_from_fdlink,
         impl_try_into_fdlink, load_program_without_attach_type,
         perf_attach::{PerfLinkIdInner, PerfLinkInner},
+        perf_event::PerfEventScope,
         probe::{Probe, ProbeKind, attach},
     },
 };
@@ -87,7 +88,9 @@ impl KProbe {
             *kind,
             fn_name.as_ref(),
             offset,
-            None, // pid
+            // For all-processes attachment, perf_event_open requires an explicit
+            // CPU. Use CPU 0 only to open the backing perf event.
+            PerfEventScope::AllProcessesOneCpu { cpu: 0 },
             None, // cookie
         )
     }
diff --git a/aya/src/programs/probe.rs b/aya/src/programs/probe.rs
@@ -12,7 +12,8 @@ use std::{
 use crate::{
     programs::{
         Link, ProgramData, ProgramError, perf_attach, perf_attach::PerfLinkInner,
-        perf_attach_debugfs, trace_point::read_sys_fs_trace_point_id, utils::find_tracefs_path,
+        perf_attach_debugfs, perf_event::PerfEventScope, trace_point::read_sys_fs_trace_point_id,
+        utils::find_tracefs_path,
     },
     sys::{SyscallError, perf_event_open_probe, perf_event_open_trace_point},
     util::KernelVersion,
@@ -145,21 +146,21 @@ pub(crate) fn attach<P: Probe, T: Link + From<PerfLinkInner>>(
     // separate argument.
     fn_name: &OsStr,
     offset: u64,
-    pid: Option<u32>,
+    scope: PerfEventScope,
     cookie: Option<u64>,
 ) -> Result<T::Id, ProgramError> {
     // https://github.com/torvalds/linux/commit/e12f03d7031a977356e3d7b75a68c2185ff8d155
     // Use debugfs to create probe
     let prog_fd = program_data.fd()?;
     let prog_fd = prog_fd.as_fd();
     let link = if KernelVersion::at_least(4, 17, 0) {
-        let perf_fd = create_as_probe::<P>(kind, fn_name, offset, pid)?;
+        let perf_fd = create_as_probe::<P>(kind, fn_name, offset, scope)?;
         perf_attach(prog_fd, perf_fd, cookie)
     } else {
         if cookie.is_some() {
             return Err(ProgramError::AttachCookieNotSupported);
         }
-        let (perf_fd, event) = create_as_trace_point::<P>(kind, fn_name, offset, pid)?;
+        let (perf_fd, event) = create_as_trace_point::<P>(kind, fn_name, offset, scope)?;
         perf_attach_debugfs(prog_fd, perf_fd, event)
     }?;
     program_data.links.insert(T::from(link))
@@ -176,7 +177,7 @@ fn create_as_probe<P: Probe>(
     kind: ProbeKind,
     fn_name: &OsStr,
     offset: u64,
-    pid: Option<u32>,
+    scope: PerfEventScope,
 ) -> Result<crate::MockableFd, ProgramError> {
     let perf_ty = read_sys_fs_perf_type(P::PMU)
         .map_err(|(filename, io_error)| P::file_error(filename, io_error).into())?;
@@ -189,7 +190,7 @@ fn create_as_probe<P: Probe>(
         ProbeKind::Entry => None,
     };
 
-    perf_event_open_probe(perf_ty, ret_bit, fn_name, offset, pid)
+    perf_event_open_probe(perf_ty, ret_bit, fn_name, offset, scope)
         .map_err(|io_error| SyscallError {
             call: "perf_event_open",
             io_error,
@@ -201,7 +202,7 @@ fn create_as_trace_point<P: Probe>(
     kind: ProbeKind,
     name: &OsStr,
     offset: u64,
-    pid: Option<u32>,
+    scope: PerfEventScope,
 ) -> Result<(crate::MockableFd, ProbeEvent), ProgramError> {
     let tracefs = find_tracefs_path()?;
 
@@ -214,7 +215,7 @@ fn create_as_trace_point<P: Probe>(
     } = &event;
     let category = format!("{}s", P::PMU);
     let tpid = read_sys_fs_trace_point_id(tracefs, &category, event_alias.as_ref())?;
-    let perf_fd = perf_event_open_trace_point(tpid, pid).map_err(|io_error| SyscallError {
+    let perf_fd = perf_event_open_trace_point(tpid, scope).map_err(|io_error| SyscallError {
         call: "perf_event_open",
         io_error,
     })?;
diff --git a/aya/src/programs/trace_point.rs b/aya/src/programs/trace_point.rs
@@ -13,6 +13,7 @@ use crate::{
         ProgramData, ProgramError, ProgramType, define_link_wrapper, impl_try_from_fdlink,
         impl_try_into_fdlink, load_program_without_attach_type,
         perf_attach::{PerfLinkIdInner, PerfLinkInner, perf_attach},
+        perf_event::PerfEventScope,
         utils::find_tracefs_path,
     },
     sys::{SyscallError, perf_event_open_trace_point},
@@ -80,7 +81,13 @@ impl TracePoint {
         let prog_fd = prog_fd.as_fd();
         let tracefs = find_tracefs_path()?;
         let id = read_sys_fs_trace_point_id(tracefs, category, name.as_ref())?;
-        let perf_fd = perf_event_open_trace_point(id, None).map_err(|io_error| SyscallError {
+        let perf_fd = perf_event_open_trace_point(
+            id,
+            // For all-processes attachment, perf_event_open requires an explicit
+            // CPU. Use CPU 0 only to open the backing perf event.
+            PerfEventScope::AllProcessesOneCpu { cpu: 0 },
+        )
+        .map_err(|io_error| SyscallError {
             call: "perf_event_open_trace_point",
             io_error,
         })?;
diff --git a/aya/src/programs/uprobe.rs b/aya/src/programs/uprobe.rs
@@ -22,6 +22,7 @@ use crate::{
         ProgramData, ProgramError, ProgramType, define_link_wrapper, impl_try_from_fdlink,
         impl_try_into_fdlink, load_program_without_attach_type,
         perf_attach::{PerfLinkIdInner, PerfLinkInner},
+        perf_event::PerfEventScope,
         probe::{OsStringExt as _, Probe, ProbeKind, attach},
     },
     util::MMap,
@@ -144,15 +145,21 @@ impl UProbe {
     ) -> Result<UProbeLinkId, ProgramError> {
         let UProbeAttachPoint { location, cookie } = point.into();
         let target = target.as_ref();
-        let (proc_map_pid, perf_event_pid) = match scope {
-            UProbeScope::AllProcesses => (None, None),
+        let (proc_map_pid, perf_event_scope) = match scope {
+            // For an all-processes uprobe, perf_event_open uses pid=-1 and
+            // requires an explicit CPU. Use CPU 0 only to open the backing
+            // perf event.
+            UProbeScope::AllProcesses => (None, PerfEventScope::AllProcessesOneCpu { cpu: 0 }),
             // /proc/0/maps does not exist, so use the real pid for ProcMap
             // resolution while keeping the kernel's pid=0 sentinel for attach.
-            UProbeScope::CallingProcess => (Some(std::process::id()), Some(0)),
-            UProbeScope::OneProcess(pid) => {
-                let pid = pid.get();
-                (Some(pid), Some(pid))
-            }
+            UProbeScope::CallingProcess => (
+                Some(std::process::id()),
+                PerfEventScope::CallingProcess { cpu: None },
+            ),
+            UProbeScope::OneProcess(pid) => (
+                Some(pid.get()),
+                PerfEventScope::OneProcess { pid, cpu: None },
+            ),
         };
 
         // Keep ProcMap in this scope so resolve_attach_target_basename can return
@@ -187,7 +194,7 @@ impl UProbe {
 
         let Self { data, kind } = self;
         let path = path.as_os_str();
-        attach::<Self, _>(data, *kind, path, offset, perf_event_pid, cookie)
+        attach::<Self, _>(data, *kind, path, offset, perf_event_scope, cookie)
     }
 
     /// Creates a program from a pinned entry on a bpffs.
diff --git a/aya/src/sys/perf_event.rs b/aya/src/sys/perf_event.rs
@@ -1,7 +1,6 @@
 use std::{
     ffi::{CString, OsStr, c_long, c_uint},
     io, mem,
-    num::NonZeroU32,
     os::fd::{BorrowedFd, FromRawFd as _},
 };
 
@@ -124,13 +123,7 @@ pub(crate) fn perf_event_open(
         }
     }
 
-    let (pid, cpu) = match scope {
-        PerfEventScope::CallingProcess { cpu } => (0, cpu.map_or(-1, |cpu| cpu as i32)),
-        PerfEventScope::OneProcess { pid, cpu } => {
-            (pid.get() as i32, cpu.map_or(-1, |cpu| cpu as i32))
-        }
-        PerfEventScope::AllProcessesOneCpu { cpu } => (-1, cpu as i32),
-    };
+    let (pid, cpu) = perf_event_scope_pid_cpu(scope);
 
     perf_event_sys(attr, pid, cpu, flags)
 }
@@ -140,7 +133,7 @@ pub(crate) fn perf_event_open_probe(
     ret_bit: Option<u32>,
     name: &OsStr,
     offset: u64,
-    pid: Option<u32>,
+    scope: PerfEventScope,
 ) -> io::Result<crate::MockableFd> {
     use std::os::unix::ffi::OsStrExt as _;
 
@@ -157,23 +150,15 @@ pub(crate) fn perf_event_open_probe(
     attr.__bindgen_anon_3.config1 = c_name.as_ptr() as u64;
     attr.__bindgen_anon_4.config2 = offset;
 
-    let (pid, cpu) = match pid {
-        Some(pid) => (pid as i32, -1),
-        None => (-1, 0),
-    };
+    let (pid, cpu) = perf_event_scope_pid_cpu(scope);
 
     perf_event_sys(attr, pid, cpu, PERF_FLAG_FD_CLOEXEC)
 }
 
 pub(crate) fn perf_event_open_trace_point(
     event_id: u64,
-    pid: Option<u32>,
+    scope: PerfEventScope,
 ) -> io::Result<crate::MockableFd> {
-    let scope = match pid.map(NonZeroU32::new) {
-        None => PerfEventScope::AllProcessesOneCpu { cpu: 0 },
-        Some(None) => PerfEventScope::CallingProcess { cpu: None },
-        Some(Some(pid)) => PerfEventScope::OneProcess { pid, cpu: None },
-    };
     perf_event_open(
         PerfEventConfig::TracePoint { event_id },
         scope,
@@ -184,6 +169,16 @@ pub(crate) fn perf_event_open_trace_point(
     )
 }
 
+fn perf_event_scope_pid_cpu(scope: PerfEventScope) -> (pid_t, i32) {
+    match scope {
+        PerfEventScope::CallingProcess { cpu } => (0, cpu.map_or(-1, |cpu| cpu as i32)),
+        PerfEventScope::OneProcess { pid, cpu } => {
+            (pid.get() as i32, cpu.map_or(-1, |cpu| cpu as i32))
+        }
+        PerfEventScope::AllProcessesOneCpu { cpu } => (-1, cpu as i32),
+    }
+}
+
 pub(crate) fn perf_event_ioctl(
     fd: BorrowedFd<'_>,
     request: PerfEventIoctlRequest<'_>,
@@ -260,21 +255,42 @@ impl TryFrom<u32> for perf_event_type {
 
 #[cfg(test)]
 mod tests {
-    use std::os::fd::AsRawFd as _;
+    use std::{num::NonZeroU32, os::fd::AsRawFd as _};
 
     use libc::pid_t;
     use test_case::test_case;
 
     use super::{PERF_FLAG_FD_CLOEXEC, perf_event_open_trace_point};
-    use crate::sys::{Syscall, override_syscall};
+    use crate::{
+        programs::perf_event::PerfEventScope,
+        sys::{Syscall, override_syscall},
+    };
 
     const EVENT_ID: u64 = 123;
 
-    #[test_case(None, -1, 0; "all_processes")]
-    #[test_case(Some(0), 0, -1; "calling_process")]
-    #[test_case(Some(42), 42, -1; "one_process")]
-    fn perf_event_open_trace_point_maps_pid_scope(
-        pid: Option<u32>,
+    #[test_case(
+        PerfEventScope::AllProcessesOneCpu { cpu: 0 },
+        -1,
+        0;
+        "all_processes"
+    )]
+    #[test_case(
+        PerfEventScope::CallingProcess { cpu: None },
+        0,
+        -1;
+        "calling_process"
+    )]
+    #[test_case(
+        PerfEventScope::OneProcess {
+            pid: NonZeroU32::new(42).unwrap(),
+            cpu: None,
+        },
+        42,
+        -1;
+        "one_process"
+    )]
+    fn perf_event_open_trace_point_maps_scope(
+        scope: PerfEventScope,
         expected_pid: pid_t,
         expected_cpu: i32,
     ) {
@@ -297,7 +313,7 @@ mod tests {
             call => panic!("unexpected syscall: {call:?}"),
         });
 
-        let fd = perf_event_open_trace_point(EVENT_ID, pid).unwrap();
+        let fd = perf_event_open_trace_point(EVENT_ID, scope).unwrap();
         assert_eq!(fd.as_raw_fd(), crate::MockableFd::mock_signed_fd());
     }
 }
