AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/08/04 17:11 flow patch-triage
0m Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and benchmarks in tools/testing/selftests/bpf/. It does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}
1/1 2026/08/04 17:11 action read-patch-diff
0m Args: 
null

Results: 
{
  "PatchDiff": "commit 84ca45de08b6fa5559b5b1a9cf947ef60d1f3f69\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Aug 4 17:11:08 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile\nindex 55d394438705a..e4d8cbd51d714 100644\n--- a/tools/testing/selftests/bpf/Makefile\n+++ b/tools/testing/selftests/bpf/Makefile\n@@ -966,6 +966,7 @@ $(OUTPUT)/bench_ringbufs.o: $(OUTPUT)/ringbuf_bench.skel.h \\\n $(OUTPUT)/bench_bloom_filter_map.o: $(OUTPUT)/bloom_filter_bench.skel.h\n $(OUTPUT)/bench_bpf_loop.o: $(OUTPUT)/bpf_loop_bench.skel.h\n $(OUTPUT)/bench_strncmp.o: $(OUTPUT)/strncmp_bench.skel.h\n+$(OUTPUT)/bench_tracing_multi_attach.o: $(OUTPUT)/tracing_multi_bench.skel.h\n $(OUTPUT)/bench_bpf_hashmap_full_update.o: $(OUTPUT)/bpf_hashmap_full_update_bench.skel.h\n $(OUTPUT)/bench_local_storage.o: $(OUTPUT)/local_storage_bench.skel.h\n $(OUTPUT)/bench_local_storage_rcu_tasks_trace.o: $(OUTPUT)/local_storage_rcu_tasks_trace_bench.skel.h\n@@ -991,6 +992,7 @@ $(OUTPUT)/bench: $(OUTPUT)/bench.o \\\n \t\t $(OUTPUT)/bench_bloom_filter_map.o \\\n \t\t $(OUTPUT)/bench_bpf_loop.o \\\n \t\t $(OUTPUT)/bench_strncmp.o \\\n+\t\t $(OUTPUT)/bench_tracing_multi_attach.o \\\n \t\t $(OUTPUT)/bench_bpf_hashmap_full_update.o \\\n \t\t $(OUTPUT)/bench_local_storage.o \\\n \t\t $(OUTPUT)/bench_local_storage_rcu_tasks_trace.o \\\ndiff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c\nindex 3d9d2cd7764bd..5ce31459835ce 100644\n--- a/tools/testing/selftests/bpf/bench.c\n+++ b/tools/testing/selftests/bpf/bench.c\n@@ -545,6 +545,7 @@ extern const struct bench bench_trig_uprobe_multi_nop5;\n extern const struct bench bench_trig_uretprobe_multi_nop5;\n extern const struct bench bench_trig_usdt_nop;\n extern const struct bench bench_trig_usdt_nop5;\n+extern const struct bench bench_tracing_multi_attach;\n #endif\n \n extern const struct bench bench_rb_libbpf;\n@@ -628,6 +629,7 @@ static const struct bench *benchs[] = {\n \t\u0026bench_trig_uretprobe_multi_nop5,\n \t\u0026bench_trig_usdt_nop,\n \t\u0026bench_trig_usdt_nop5,\n+\t\u0026bench_tracing_multi_attach,\n #endif\n \t/* ringbuf/perfbuf benchmarks */\n \t\u0026bench_rb_libbpf,\ndiff --git a/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c b/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c\nnew file mode 100644\nindex 0000000000000..7389d1742ddcb\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c\n@@ -0,0 +1,177 @@\n+// SPDX-License-Identifier: GPL-2.0\n+#define _GNU_SOURCE\n+#include \u003csearch.h\u003e\n+#include \u003cstdio.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003cbpf/btf.h\u003e\n+#include \"bench.h\"\n+#include \"testing_helpers.h\"\n+#include \"trace_helpers.h\"\n+#include \"tracing_multi_bench.skel.h\"\n+#include \"bpf/libbpf_internal.h\"\n+\n+static int compare(const void *ppa, const void *ppb)\n+{\n+\tconst char *pa = *(const char **)ppa;\n+\tconst char *pb = *(const char **)ppb;\n+\n+\treturn strcmp(pa, pb);\n+}\n+\n+static void tdestroy_free_nop(void *ptr)\n+{\n+}\n+\n+static void tracing_multi_attach_setup(void)\n+{\n+\tLIBBPF_OPTS(bpf_tracing_multi_opts, opts);\n+\tstruct tracing_multi_bench *skel = NULL;\n+\tlong attach_start_ns, attach_end_ns;\n+\tlong detach_start_ns, detach_end_ns;\n+\tdouble attach_delta, detach_delta;\n+\tstruct bpf_link *link = NULL;\n+\tsize_t i, cap = 0, cnt = 0;\n+\tstruct ksyms *ksyms = NULL;\n+\tvoid *root = NULL;\n+\tvoid *dups = NULL;\n+\t__u32 *ids = NULL;\n+\t__u32 nr, type_id;\n+\tstruct btf *btf;\n+\tint err;\n+\n+\tsetup_libbpf();\n+\n+\tbtf = btf__load_vmlinux_btf();\n+\terr = libbpf_get_error(btf);\n+\tif (err) {\n+\t\tbtf = NULL;\n+\t\tfprintf(stderr, \"failed to load vmlinux BTF: %s\\n\", strerror(-err));\n+\t\tgoto cleanup;\n+\t}\n+\n+\tskel = tracing_multi_bench__open_and_load();\n+\terr = libbpf_get_error(skel);\n+\tif (!skel) {\n+\t\tfprintf(stderr, \"failed to open and load skeleton: %s\\n\", strerror(-err));\n+\t\tgoto cleanup;\n+\t}\n+\n+\terr = bpf_get_ksyms(\u0026ksyms, true);\n+\tif (err) {\n+\t\tfprintf(stderr, \"failed to get kernel symbols: %s\\n\", strerror(-err));\n+\t\tgoto cleanup;\n+\t}\n+\n+\t/* Get all ftrace 'safe' symbols.. */\n+\tfor (i = 0; i \u003c ksyms-\u003efiltered_cnt; i++) {\n+\t\tif (!tsearch(\u0026ksyms-\u003efiltered_syms[i], \u0026root, compare)) {\n+\t\t\terr = -ENOMEM;\n+\t\t\tfprintf(stderr, \"failed to index ftrace symbols\\n\");\n+\t\t\tgoto cleanup;\n+\t\t}\n+\t}\n+\n+\t/*\n+\t * Collect names that are not unique in kallsyms. The kernel resolves a\n+\t * tracing-multi BTF id to an address with kallsyms_lookup_name(), which\n+\t * returns the first symbol of that name. For a duplicate name that may\n+\t * be a different (non-ftrace-able) instance than the ftrace-able one in\n+\t * available_filter_functions, so attaching to it by BTF id fails with\n+\t * -ENOENT (e.g. t_start/t_next/t_stop). ksyms-\u003esyms is sorted by name,\n+\t * so equal names are adjacent.\n+\t */\n+\tfor (i = 1; i \u003c ksyms-\u003esym_cnt; i++) {\n+\t\tif (strcmp(ksyms-\u003esyms[i].name, ksyms-\u003esyms[i - 1].name))\n+\t\t\tcontinue;\n+\t\tif (!tsearch(\u0026ksyms-\u003esyms[i].name, \u0026dups, compare)) {\n+\t\t\terr = -ENOMEM;\n+\t\t\tfprintf(stderr, \"failed to index duplicate kernel symbols\\n\");\n+\t\t\tgoto cleanup;\n+\t\t}\n+\t}\n+\n+\t/* ..and filter them through BTF and btf_type_is_traceable_func. */\n+\tnr = btf__type_cnt(btf);\n+\tfor (type_id = 1; type_id \u003c nr; type_id++) {\n+\t\tconst struct btf_type *type;\n+\t\tconst char *str;\n+\n+\t\ttype = btf__type_by_id(btf, type_id);\n+\t\tif (!type)\n+\t\t\tbreak;\n+\n+\t\tif (BTF_INFO_KIND(type-\u003einfo) != BTF_KIND_FUNC)\n+\t\t\tcontinue;\n+\n+\t\tstr = btf__name_by_offset(btf, type-\u003ename_off);\n+\t\tif (!str)\n+\t\t\tbreak;\n+\n+\t\tif (!tfind(\u0026str, \u0026root, compare))\n+\t\t\tcontinue;\n+\n+\t\t/* Skip names that are not unique in kallsyms, see above. */\n+\t\tif (tfind(\u0026str, \u0026dups, compare))\n+\t\t\tcontinue;\n+\n+\t\tif (!btf_type_is_traceable_func(btf, type))\n+\t\t\tcontinue;\n+\n+\t\terr = libbpf_ensure_mem((void **)\u0026ids, \u0026cap, sizeof(*ids), cnt + 1);\n+\t\tif (err) {\n+\t\t\tfprintf(stderr, \"failed to allocate BTF ID array: %s\\n\",\n+\t\t\t\tstrerror(-err));\n+\t\t\tgoto cleanup;\n+\t\t}\n+\n+\t\tids[cnt++] = type_id;\n+\t}\n+\n+\topts.ids = ids;\n+\topts.cnt = cnt;\n+\n+\tattach_start_ns = get_time_ns();\n+\tlink = bpf_program__attach_tracing_multi(skel-\u003eprogs.bench, NULL, \u0026opts);\n+\tattach_end_ns = get_time_ns();\n+\n+\terr = libbpf_get_error(link);\n+\tif (err) {\n+\t\tlink = NULL;\n+\t\tfprintf(stderr, \"failed to attach tracing multi link: %s\\n\",\n+\t\t\tstrerror(-err));\n+\t\tgoto cleanup;\n+\t}\n+\n+\tdetach_start_ns = get_time_ns();\n+\terr = bpf_link__destroy(link);\n+\tdetach_end_ns = get_time_ns();\n+\tlink = NULL;\n+\tif (err) {\n+\t\tfprintf(stderr, \"failed to detach tracing multi link: %s\\n\",\n+\t\t\tstrerror(-err));\n+\t\tgoto cleanup;\n+\t}\n+\n+\tattach_delta = (attach_end_ns - attach_start_ns) / 1000000000.0;\n+\tdetach_delta = (detach_end_ns - detach_start_ns) / 1000000000.0;\n+\n+\tprintf(\"%s: found %zu functions\\n\", bench-\u003ename, cnt);\n+\tprintf(\"%s: attached in %7.3lfs\\n\", bench-\u003ename, attach_delta);\n+\tprintf(\"%s: detached in %7.3lfs\\n\", bench-\u003ename, detach_delta);\n+\n+cleanup:\n+\tbpf_link__destroy(link);\n+\ttracing_multi_bench__destroy(skel);\n+\ttdestroy(root, tdestroy_free_nop);\n+\ttdestroy(dups, tdestroy_free_nop);\n+\tfree_kallsyms_local(ksyms);\n+\tfree(ids);\n+\tbtf__free(btf);\n+\n+\texit(err ? 1 : 0);\n+}\n+\n+const struct bench bench_tracing_multi_attach = {\n+\t.name = \"tracing-multi-attach\",\n+\t.setup = tracing_multi_attach_setup,\n+};\ndiff --git a/tools/testing/selftests/bpf/prog_tests/tracing_multi.c b/tools/testing/selftests/bpf/prog_tests/tracing_multi.c\nindex 0aa9532a05cfe..fd4f256d2e0a7 100644\n--- a/tools/testing/selftests/bpf/prog_tests/tracing_multi.c\n+++ b/tools/testing/selftests/bpf/prog_tests/tracing_multi.c\n@@ -3,14 +3,12 @@\n #include \u003ctest_progs.h\u003e\n #include \u003cbpf/btf.h\u003e\n #include \u003csearch.h\u003e\n-#include \"bpf/libbpf_internal.h\"\n #include \"tracing_multi.skel.h\"\n #include \"tracing_multi_module.skel.h\"\n #include \"tracing_multi_intersect.skel.h\"\n #include \"tracing_multi_session.skel.h\"\n #include \"tracing_multi_fail.skel.h\"\n #include \"tracing_multi_verifier.skel.h\"\n-#include \"tracing_multi_bench.skel.h\"\n #include \"tracing_multi_rollback.skel.h\"\n #include \"trace_helpers.h\"\n \n@@ -662,129 +660,6 @@ static void test_attach_api_fails(void)\n \tfree(ids2);\n }\n \n-void serial_test_tracing_multi_bench_attach(void)\n-{\n-\tLIBBPF_OPTS(bpf_tracing_multi_opts, opts);\n-\tstruct tracing_multi_bench *skel = NULL;\n-\tlong attach_start_ns, attach_end_ns;\n-\tlong detach_start_ns, detach_end_ns;\n-\tdouble attach_delta, detach_delta;\n-\tstruct bpf_link *link = NULL;\n-\tsize_t i, cap = 0, cnt = 0;\n-\tstruct ksyms *ksyms = NULL;\n-\tvoid *root = NULL;\n-\tvoid *dups = NULL;\n-\t__u32 *ids = NULL;\n-\t__u32 nr, type_id;\n-\tstruct btf *btf;\n-\tint err;\n-\n-#ifndef __x86_64__\n-\ttest__skip();\n-\treturn;\n-#endif\n-\n-\tbtf = btf__load_vmlinux_btf();\n-\tif (!ASSERT_OK_PTR(btf, \"btf__load_vmlinux_btf\"))\n-\t\treturn;\n-\n-\tskel = tracing_multi_bench__open_and_load();\n-\tif (!ASSERT_OK_PTR(skel, \"tracing_multi_bench__open_and_load\"))\n-\t\tgoto cleanup;\n-\n-\tif (!ASSERT_OK(bpf_get_ksyms(\u0026ksyms, true), \"get_syms\"))\n-\t\tgoto cleanup;\n-\n-\t/* Get all ftrace 'safe' symbols.. */\n-\tfor (i = 0; i \u003c ksyms-\u003efiltered_cnt; i++) {\n-\t\tif (!tsearch(\u0026ksyms-\u003efiltered_syms[i], \u0026root, compare)) {\n-\t\t\tASSERT_FAIL(\"tsearch failed\");\n-\t\t\tgoto cleanup;\n-\t\t}\n-\t}\n-\n-\t/*\n-\t * Collect names that are not unique in kallsyms. The kernel resolves a\n-\t * tracing-multi BTF id to an address with kallsyms_lookup_name(), which\n-\t * returns the first symbol of that name. For a duplicate name that may\n-\t * be a different (non-ftrace-able) instance than the ftrace-able one in\n-\t * available_filter_functions, so attaching to it by BTF id fails with\n-\t * -ENOENT (e.g. t_start/t_next/t_stop). ksyms-\u003esyms is sorted by name,\n-\t * so equal names are adjacent.\n-\t */\n-\tfor (i = 1; i \u003c ksyms-\u003esym_cnt; i++) {\n-\t\tif (strcmp(ksyms-\u003esyms[i].name, ksyms-\u003esyms[i - 1].name))\n-\t\t\tcontinue;\n-\t\tif (!tsearch(\u0026ksyms-\u003esyms[i].name, \u0026dups, compare)) {\n-\t\t\tASSERT_FAIL(\"tsearch failed\");\n-\t\t\tgoto cleanup;\n-\t\t}\n-\t}\n-\n-\t/* ..and filter them through BTF and btf_type_is_traceable_func. */\n-\tnr = btf__type_cnt(btf);\n-\tfor (type_id = 1; type_id \u003c nr; type_id++) {\n-\t\tconst struct btf_type *type;\n-\t\tconst char *str;\n-\n-\t\ttype = btf__type_by_id(btf, type_id);\n-\t\tif (!type)\n-\t\t\tbreak;\n-\n-\t\tif (BTF_INFO_KIND(type-\u003einfo) != BTF_KIND_FUNC)\n-\t\t\tcontinue;\n-\n-\t\tstr = btf__name_by_offset(btf, type-\u003ename_off);\n-\t\tif (!str)\n-\t\t\tbreak;\n-\n-\t\tif (!tfind(\u0026str, \u0026root, compare))\n-\t\t\tcontinue;\n-\n-\t\t/* Skip names that are not unique in kallsyms, see above. */\n-\t\tif (tfind(\u0026str, \u0026dups, compare))\n-\t\t\tcontinue;\n-\n-\t\tif (!btf_type_is_traceable_func(btf, type))\n-\t\t\tcontinue;\n-\n-\t\terr = libbpf_ensure_mem((void **) \u0026ids, \u0026cap, sizeof(*ids), cnt + 1);\n-\t\tif (err)\n-\t\t\tgoto cleanup;\n-\n-\t\tids[cnt++] = type_id;\n-\t}\n-\n-\topts.ids = ids;\n-\topts.cnt = cnt;\n-\n-\tattach_start_ns = get_time_ns();\n-\tlink = bpf_program__attach_tracing_multi(skel-\u003eprogs.bench, NULL, \u0026opts);\n-\tattach_end_ns = get_time_ns();\n-\n-\tif (!ASSERT_OK_PTR(link, \"bpf_program__attach_tracing_multi\"))\n-\t\tgoto cleanup;\n-\n-\tdetach_start_ns = get_time_ns();\n-\tbpf_link__destroy(link);\n-\tdetach_end_ns = get_time_ns();\n-\n-\tattach_delta = (attach_end_ns - attach_start_ns) / 1000000000.0;\n-\tdetach_delta = (detach_end_ns - detach_start_ns) / 1000000000.0;\n-\n-\tprintf(\"%s: found %lu functions\\n\", __func__, cnt);\n-\tprintf(\"%s: attached in %7.3lfs\\n\", __func__, attach_delta);\n-\tprintf(\"%s: detached in %7.3lfs\\n\", __func__, detach_delta);\n-\n-cleanup:\n-\ttracing_multi_bench__destroy(skel);\n-\ttdestroy(root, tdestroy_free_nop);\n-\ttdestroy(dups, tdestroy_free_nop);\n-\tfree_kallsyms_local(ksyms);\n-\tfree(ids);\n-\tbtf__free(btf);\n-}\n-\n static void tracing_multi_rollback_run(struct tracing_multi_rollback *skel)\n {\n \tLIBBPF_OPTS(bpf_test_run_opts, topts);\n"
}
2/1 2026/08/04 17:11 agent patch-evaluator
0m Model: 
best-expensive

Args: 
null

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and benchmarks in tools/testing/selftests/bpf/. It does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}

Instruction: 
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt: 
For your convenience, here is the diff of the changes:
commit 84ca45de08b6fa5559b5b1a9cf947ef60d1f3f69
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 4 17:11:08 2026 +0000

    syz-cluster: applied patch under review

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 55d394438705a..e4d8cbd51d714 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -966,6 +966,7 @@ $(OUTPUT)/bench_ringbufs.o: $(OUTPUT)/ringbuf_bench.skel.h \
 $(OUTPUT)/bench_bloom_filter_map.o: $(OUTPUT)/bloom_filter_bench.skel.h
 $(OUTPUT)/bench_bpf_loop.o: $(OUTPUT)/bpf_loop_bench.skel.h
 $(OUTPUT)/bench_strncmp.o: $(OUTPUT)/strncmp_bench.skel.h
+$(OUTPUT)/bench_tracing_multi_attach.o: $(OUTPUT)/tracing_multi_bench.skel.h
 $(OUTPUT)/bench_bpf_hashmap_full_update.o: $(OUTPUT)/bpf_hashmap_full_update_bench.skel.h
 $(OUTPUT)/bench_local_storage.o: $(OUTPUT)/local_storage_bench.skel.h
 $(OUTPUT)/bench_local_storage_rcu_tasks_trace.o: $(OUTPUT)/local_storage_rcu_tasks_trace_bench.skel.h
@@ -991,6 +992,7 @@ $(OUTPUT)/bench: $(OUTPUT)/bench.o \
 		 $(OUTPUT)/bench_bloom_filter_map.o \
 		 $(OUTPUT)/bench_bpf_loop.o \
 		 $(OUTPUT)/bench_strncmp.o \
+		 $(OUTPUT)/bench_tracing_multi_attach.o \
 		 $(OUTPUT)/bench_bpf_hashmap_full_update.o \
 		 $(OUTPUT)/bench_local_storage.o \
 		 $(OUTPUT)/bench_local_storage_rcu_tasks_trace.o \
diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c
index 3d9d2cd7764bd..5ce31459835ce 100644
--- a/tools/testing/selftests/bpf/bench.c
+++ b/tools/testing/selftests/bpf/bench.c
@@ -545,6 +545,7 @@ extern const struct bench bench_trig_uprobe_multi_nop5;
 extern const struct bench bench_trig_uretprobe_multi_nop5;
 extern const struct bench bench_trig_usdt_nop;
 extern const struct bench bench_trig_usdt_nop5;
+extern const struct bench bench_tracing_multi_attach;
 #endif
 
 extern const struct bench bench_rb_libbpf;
@@ -628,6 +629,7 @@ static const struct bench *benchs[] = {
 	&bench_trig_uretprobe_multi_nop5,
 	&bench_trig_usdt_nop,
 	&bench_trig_usdt_nop5,
+	&bench_tracing_multi_attach,
 #endif
 	/* ringbuf/perfbuf benchmarks */
 	&bench_rb_libbpf,
diff --git a/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c b/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c
new file mode 100644
index 0000000000000..7389d1742ddcb
--- /dev/null
+++ b/tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+#include <search.h>
+#include <stdio.h>
+#include <string.h>
+#include <bpf/btf.h>
+#include "bench.h"
+#include "testing_helpers.h"
+#include "trace_helpers.h"
+#include "tracing_multi_bench.skel.h"
+#include "bpf/libbpf_internal.h"
+
+static int compare(const void *ppa, const void *ppb)
+{
+	const char *pa = *(const char **)ppa;
+	const char *pb = *(const char **)ppb;
+
+	return strcmp(pa, pb);
+}
+
+static void tdestroy_free_nop(void *ptr)
+{
+}
+
+static void tracing_multi_attach_setup(void)
+{
+	LIBBPF_OPTS(bpf_tracing_multi_opts, opts);
+	struct tracing_multi_bench *skel = NULL;
+	long attach_start_ns, attach_end_ns;
+	long detach_start_ns, detach_end_ns;
+	double attach_delta, detach_delta;
+	struct bpf_link *link = NULL;
+	size_t i, cap = 0, cnt = 0;
+	struct ksyms *ksyms = NULL;
+	void *root = NULL;
+	void *dups = NULL;
+	__u32 *ids = NULL;
+	__u32 nr, type_id;
+	struct btf *btf;
+	int err;
+
+	setup_libbpf();
+
+	btf = btf__load_vmlinux_btf();
+	err = libbpf_get_error(btf);
+	if (err) {
+		btf = NULL;
+		fprintf(stderr, "failed to load vmlinux BTF: %s\n", strerror(-err));
+		goto cleanup;
+	}
+
+	skel = tracing_multi_bench__open_and_load();
+	err = libbpf_get_error(skel);
+	if (!skel) {
+		fprintf(stderr, "failed to open and load skeleton: %s\n", strerror(-err));
+		goto cleanup;
+	}
+
+	err = bpf_get_ksyms(&ksyms, true);
+	if (err) {
+		fprintf(stderr, "failed to get kernel symbols: %s\n", strerror(-err));
+		goto cleanup;
+	}
+
+	/* Get all ftrace 'safe' symbols.. */
+	for (i = 0; i < ksyms->filtered_cnt; i++) {
+		if (!tsearch(&ksyms->filtered_syms[i], &root, compare)) {
+			err = -ENOMEM;
+			fprintf(stderr, "failed to index ftrace symbols\n");
+			goto cleanup;
+		}
+	}
+
+	/*
+	 * Collect names that are not unique in kallsyms. The kernel resolves a
+	 * tracing-multi BTF id to an address with kallsyms_lookup_name(), which
+	 * returns the first symbol of that name. For a duplicate name that may
+	 * be a different (non-ftrace-able) instance than the ftrace-able one in
+	 * available_filter_functions, so attaching to it by BTF id fails with
+	 * -ENOENT (e.g. t_start/t_next/t_stop). ksyms->syms is sorted by name,
+	 * so equal names are adjacent.
+	 */
+	for (i = 1; i < ksyms->sym_cnt; i++) {
+		if (strcmp(ksyms->syms[i].name, ksyms->syms[i - 1].name))
+			continue;
+		if (!tsearch(&ksyms->syms[i].name, &dups, compare)) {
+			err = -ENOMEM;
+			fprintf(stderr, "failed to index duplicate kernel symbols\n");
+			goto cleanup;
+		}
+	}
+
+	/* ..and filter them through BTF and btf_type_is_traceable_func. */
+	nr = btf__type_cnt(btf);
+	for (type_id = 1; type_id < nr; type_id++) {
+		const struct btf_type *type;
+		const char *str;
+
+		type = btf__type_by_id(btf, type_id);
+		if (!type)
+			break;
+
+		if (BTF_INFO_KIND(type->info) != BTF_KIND_FUNC)
+			continue;
+
+		str = btf__name_by_offset(btf, type->name_off);
+		if (!str)
+			break;
+
+		if (!tfind(&str, &root, compare))
+			continue;
+
+		/* Skip names that are not unique in kallsyms, see above. */
+		if (tfind(&str, &dups, compare))
+			continue;
+
+		if (!btf_type_is_traceable_func(btf, type))
+			continue;
+
+		err = libbpf_ensure_mem((void **)&ids, &cap, sizeof(*ids), cnt + 1);
+		if (err) {
+			fprintf(stderr, "failed to allocate BTF ID array: %s\n",
+				strerror(-err));
+			goto cleanup;
+		}
+
+		ids[cnt++] = type_id;
+	}
+
+	opts.ids = ids;
+	opts.cnt = cnt;
+
+	attach_start_ns = get_time_ns();
+	link = bpf_program__attach_tracing_multi(skel->progs.bench, NULL, &opts);
+	attach_end_ns = get_time_ns();
+
+	err = libbpf_get_error(link);
+	if (err) {
+		link = NULL;
+		fprintf(stderr, "failed to attach tracing multi link: %s\n",
+			strerror(-err));
+		goto cleanup;
+	}
+
+	detach_start_ns = get_time_ns();
+	err = bpf_link__destroy(link);
+	detach_end_ns = get_time_ns();
+	link = NULL;
+	if (err) {
+		fprintf(stderr, "failed to detach tracing multi link: %s\n",
+			strerror(-err));
+		goto cleanup;
+	}
+
+	attach_delta = (attach_end_ns - attach_start_ns) / 1000000000.0;
+	detach_delta = (detach_end_ns - detach_start_ns) / 1000000000.0;
+
+	printf("%s: found %zu functions\n", bench->name, cnt);
+	printf("%s: attached in %7.3lfs\n", bench->name, attach_delta);
+	printf("%s: detached in %7.3lfs\n", bench->name, detach_delta);
+
+cleanup:
+	bpf_link__destroy(link);
+	tracing_multi_bench__destroy(skel);
+	tdestroy(root, tdestroy_free_nop);
+	tdestroy(dups, tdestroy_free_nop);
+	free_kallsyms_local(ksyms);
+	free(ids);
+	btf__free(btf);
+
+	exit(err ? 1 : 0);
+}
+
+const struct bench bench_tracing_multi_attach = {
+	.name = "tracing-multi-attach",
+	.setup = tracing_multi_attach_setup,
+};
diff --git a/tools/testing/selftests/bpf/prog_tests/tracing_multi.c b/tools/testing/selftests/bpf/prog_tests/tracing_multi.c
index 0aa9532a05cfe..fd4f256d2e0a7 100644
--- a/tools/testing/selftests/bpf/prog_tests/tracing_multi.c
+++ b/tools/testing/selftests/bpf/prog_tests/tracing_multi.c
@@ -3,14 +3,12 @@
 #include <test_progs.h>
 #include <bpf/btf.h>
 #include <search.h>
-#include "bpf/libbpf_internal.h"
 #include "tracing_multi.skel.h"
 #include "tracing_multi_module.skel.h"
 #include "tracing_multi_intersect.skel.h"
 #include "tracing_multi_session.skel.h"
 #include "tracing_multi_fail.skel.h"
 #include "tracing_multi_verifier.skel.h"
-#include "tracing_multi_bench.skel.h"
 #include "tracing_multi_rollback.skel.h"
 #include "trace_helpers.h"
 
@@ -662,129 +660,6 @@ static void test_attach_api_fails(void)
 	free(ids2);
 }
 
-void serial_test_tracing_multi_bench_attach(void)
-{
-	LIBBPF_OPTS(bpf_tracing_multi_opts, opts);
-	struct tracing_multi_bench *skel = NULL;
-	long attach_start_ns, attach_end_ns;
-	long detach_start_ns, detach_end_ns;
-	double attach_delta, detach_delta;
-	struct bpf_link *link = NULL;
-	size_t i, cap = 0, cnt = 0;
-	struct ksyms *ksyms = NULL;
-	void *root = NULL;
-	void *dups = NULL;
-	__u32 *ids = NULL;
-	__u32 nr, type_id;
-	struct btf *btf;
-	int err;
-
-#ifndef __x86_64__
-	test__skip();
-	return;
-#endif
-
-	btf = btf__load_vmlinux_btf();
-	if (!ASSERT_OK_PTR(btf, "btf__load_vmlinux_btf"))
-		return;
-
-	skel = tracing_multi_bench__open_and_load();
-	if (!ASSERT_OK_PTR(skel, "tracing_multi_bench__open_and_load"))
-		goto cleanup;
-
-	if (!ASSERT_OK(bpf_get_ksyms(&ksyms, true), "get_syms"))
-		goto cleanup;
-
-	/* Get all ftrace 'safe' symbols.. */
-	for (i = 0; i < ksyms->filtered_cnt; i++) {
-		if (!tsearch(&ksyms->filtered_syms[i], &root, compare)) {
-			ASSERT_FAIL("tsearch failed");
-			goto cleanup;
-		}
-	}
-
-	/*
-	 * Collect names that are not unique in kallsyms. The kernel resolves a
-	 * tracing-multi BTF id to an address with kallsyms_lookup_name(), which
-	 * returns the first symbol of that name. For a duplicate name that may
-	 * be a different (non-ftrace-able) instance than the ftrace-able one in
-	 * available_filter_functions, so attaching to it by BTF id fails with
-	 * -ENOENT (e.g. t_start/t_next/t_stop). ksyms->syms is sorted by name,
-	 * so equal names are adjacent.
-	 */
-	for (i = 1; i < ksyms->sym_cnt; i++) {
-		if (strcmp(ksyms->syms[i].name, ksyms->syms[i - 1].name))
-			continue;
-		if (!tsearch(&ksyms->syms[i].name, &dups, compare)) {
-			ASSERT_FAIL("tsearch failed");
-			goto cleanup;
-		}
-	}
-
-	/* ..and filter them through BTF and btf_type_is_traceable_func. */
-	nr = btf__type_cnt(btf);
-	for (type_id = 1; type_id < nr; type_id++) {
-		const struct btf_type *type;
-		const char *str;
-
-		type = btf__type_by_id(btf, type_id);
-		if (!type)
-			break;
-
-		if (BTF_INFO_KIND(type->info) != BTF_KIND_FUNC)
-			continue;
-
-		str = btf__name_by_offset(btf, type->name_off);
-		if (!str)
-			break;
-
-		if (!tfind(&str, &root, compare))
-			continue;
-
-		/* Skip names that are not unique in kallsyms, see above. */
-		if (tfind(&str, &dups, compare))
-			continue;
-
-		if (!btf_type_is_traceable_func(btf, type))
-			continue;
-
-		err = libbpf_ensure_mem((void **) &ids, &cap, sizeof(*ids), cnt + 1);
-		if (err)
-			goto cleanup;
-
-		ids[cnt++] = type_id;
-	}
-
-	opts.ids = ids;
-	opts.cnt = cnt;
-
-	attach_start_ns = get_time_ns();
-	link = bpf_program__attach_tracing_multi(skel->progs.bench, NULL, &opts);
-	attach_end_ns = get_time_ns();
-
-	if (!ASSERT_OK_PTR(link, "bpf_program__attach_tracing_multi"))
-		goto cleanup;
-
-	detach_start_ns = get_time_ns();
-	bpf_link__destroy(link);
-	detach_end_ns = get_time_ns();
-
-	attach_delta = (attach_end_ns - attach_start_ns) / 1000000000.0;
-	detach_delta = (detach_end_ns - detach_start_ns) / 1000000000.0;
-
-	printf("%s: found %lu functions\n", __func__, cnt);
-	printf("%s: attached in %7.3lfs\n", __func__, attach_delta);
-	printf("%s: detached in %7.3lfs\n", __func__, detach_delta);
-
-cleanup:
-	tracing_multi_bench__destroy(skel);
-	tdestroy(root, tdestroy_free_nop);
-	tdestroy(dups, tdestroy_free_nop);
-	free_kallsyms_local(ksyms);
-	free(ids);
-	btf__free(btf);
-}
-
 static void tracing_multi_rollback_run(struct tracing_multi_rollback *skel)
 {
 	LIBBPF_OPTS(bpf_test_run_opts, topts);

3/2 2026/08/04 17:11 llm patch-evaluator
0m Model: 
gemini-3.1-pro-preview

Args: 
null

Results: 
null

Tokens: 
							input: 6647
							output: 71
							thoughts: 243

Thoughts: 
**BPF Selftest/Benchmark Refactor - No Fuzzing Needed**

Okay, so this patch is simply refactoring a benchmark test within the BPF self-tests. Specifically, it's moving `tracing_multi.c` from `prog_tests` into a new `benchs` directory and updating the corresponding `Makefile` and `bench.c` files. This is purely a reorganization of the BPF test suite, really, and not touching any core kernel components. It's a clean separation between functional tests and performance benchmarks now.

Let me just double-check that this is indeed the case. I'll quickly look at the diff for:

*   `tools/testing/selftests/bpf/Makefile`
*   `tools/testing/selftests/bpf/bench.c`
*   `tools/testing/selftests/bpf/benchs/bench_tracing_multi_attach.c`
*   `tools/testing/selftests/bpf/prog_tests/tracing_multi.c`

Yep, no actual kernel code is being modified here. This is purely internal to the test and benchmark infrastructure.

Therefore, considering this is only a self-test/benchmark modification and doesn't impact any core kernel logic, drivers, or architectures, I'm going to return `WorthFuzzing=false`. No fuzzing needed for this one.

4/2 2026/08/04 17:11 tool set-results
0m Args: 
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and benchmarks in tools/testing/selftests/bpf/. It does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}

Results: 
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies BPF selftests and benchmarks in tools/testing/selftests/bpf/. It does not make any functional changes to the core kernel, drivers, or architectures.",
  "WorthFuzzing": false
}
LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)