bpftool: Search for tracefs at /sys/kernel/tracing first

With "bpftool prog tracelog", bpftool prints messages from the trace
pipe. To do so, it first needs to find the tracefs mount point to open
the pipe. Bpftool looks at a few "default" locations, including
/sys/kernel/debug/tracing and /sys/kernel/tracing.

Some of these locations, namely /tracing and /trace, are not standard.
They are in the list because some users used to hardcode the tracing
directory to short names; but we have no compelling reason to look at
these locations. If we fail to find the tracefs at the default
locations, we have an additional step to find it by parsing /proc/mounts
anyway, so it's safe to remove these entries from the list of default
locations to check.

Additionally, Alexei reports that looking for the tracefs at
/sys/kernel/debug/tracing may automatically mount the file system under
that location, and generate a kernel log message telling that
auto-mounting there is deprecated. To avoid this message, let's swap the
order for checking the potential mount points: try /sys/kernel/tracing
first, which should be the standard location nowadays. The kernel log
message may still appear if the tracefs is not mounted on
/sys/kernel/tracing when we run bpftool.

Reported-by: Alexei Starovoitov <ast@kernel.org>
Closes: https://lore.kernel.org/r/CAADnVQLcMi5YQhZKsU4z3S2uVUAGu_62C33G2Zx_ruG3uXa-Ug@mail.gmail.com/
Signed-off-by: Quentin Monnet <qmo@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20250915134209.36568-1-qmo@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/bpf/bpftool/tracelog.c b/tools/bpf/bpftool/tracelog.c
index 31d806e3bdaaa9aedf61124aeec509d0cba87034..573a8d99f009a4f54a16c5bec91c191f2f5f8d37 100644 (file)
--- a/tools/bpf/bpftool/tracelog.c
+++ b/tools/bpf/bpftool/tracelog.c
@@ -57,10 +57,8 @@ find_tracefs_mnt_single(unsigned long magic, char *mnt, const char *mntpt)
 static bool get_tracefs_pipe(char *mnt)
 {
        static const char * const known_mnts[] = {
-               "/sys/kernel/debug/tracing",
                "/sys/kernel/tracing",
-               "/tracing",
-               "/trace",
+               "/sys/kernel/debug/tracing",
        };
        const char *pipe_name = "/trace_pipe";
        const char *fstype = "tracefs";
@@ -95,12 +93,7 @@ static bool get_tracefs_pipe(char *mnt)
                return false;
 
        p_info("could not find tracefs, attempting to mount it now");
-       /* Most of the time, tracefs is automatically mounted by debugfs at
-        * /sys/kernel/debug/tracing when we try to access it. If we could not
-        * find it, it is likely that debugfs is not mounted. Let's give one
-        * attempt at mounting just tracefs at /sys/kernel/tracing.
-        */
-       strcpy(mnt, known_mnts[1]);
+       strcpy(mnt, known_mnts[0]);
        if (mount_tracefs(mnt))
                return false;