perf trace stops vetoing syscalls for every concurrent tracer

A series from Ian Rogers fixes a long-standing side effect in perf trace’s BPF augmentation: programs attached system-wide to raw_syscalls:sys_enter and raw_syscalls:sys_exit used their return value to decide whether a syscall was interesting. Returning 0 from a tracepoint BPF program does not filter for the installer alone. It tells the kernel to drop the event for every listener on that tracepoint, so a concurrent perf record, another perf trace, or an ftrace session watching the same events could silently lose samples.

That cross-session veto was one reason many perf trace and probe shell tests had to be marked exclusive and serialized. The series stops treating the program return value as a filter. Non-interesting syscalls still return 1 so other listeners keep their events, and selection is done inside BPF hash maps of PIDs and syscalls instead. Unaugmented enter payloads are written into the augmented ring buffer so userspace no longer has to subscribe to both streams and deduplicate.

Related correctness work lands with it. Task lifetime tracking moves off delayed PERF_RECORD_FORK/EXIT userspace updates onto BTF-typed sched_process_fork, exit, and exec programs, so children are registered before their first syscall and PIDs are evicted in do_exit rather than whenever the ring buffer is drained. Argument formatting skips the __data_loc internal fields that sys_enter tracepoints gained in 6.19, and the sys_exit program array no longer tail-calls a sys_enter augmenter that emitted corrupt duplicate enter events.

On the test side, global collisions are scoped: probe cleanup no longer disables every tracepoint on the system, vfs_getname and uprobe names are pid-qualified so they do not pin or delete each other’s probes, and short-lived workload races with BPF summary startup are closed. With those fixed, most of the exclusive tags drop and the suite passes under concurrent repeats.