tracing: run USDT tests without BPF privileges #36627

The USDT functional tests currently use BCC to attach eBPF programs to Bitcoin Core’s tracepoints. This requires BCC, matching kernel headers, and elevated BPF permissions, making the tests awkward to run locally and requiring a privileged container in CI.

Replace the BCC consumers with GDB. Each tested node runs as a debugger child, allowing the tests to enable the real USDT probes and inspect their arguments when execution reaches the probe location. This continues to test the parts of the USDT interface provided by Bitcoin Core:

• the probe metadata is present and understood;
• the probes can be enabled and are reached in the expected scenarios; and
• their arguments have the expected values, sizes, and lifetimes.

All five tests can run with GDB and binutils, without BCC or matching kernel headers. The ASan CI job no longer needs a privileged container and uses SYS_PTRACE instead. This also removes the embedded BPF programs from the tests, reducing their size and maintenance burden. Overall, the change removes roughly 660 lines of test and CI code.

Tradeoffs

• These tests no longer exercise the consumer-side eBPF path, including BCC compilation, kernel BPF verification and loading, uprobe attachment, BPF-side argument decoding, and perf-buffer delivery. Problems confined to those components would no longer be detected here.
• LeakSanitizer is disabled for nodes run under GDB because it cannot operate under ptrace. Other sanitizer checks remain enabled.

The remaining coverage is focused on Bitcoin Core’s side of the USDT interface. Testing the general BCC, eBPF, and kernel uprobe is left to those consumers and the kernel.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

External sites

• Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36627
• Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36627.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36627#author-ralph

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process.

If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

<!--174a7506f384e20aa4161008e828411d-->

Conflicts

Reviewers, this pull request conflicts with the following ones:

• #36540 _{<img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36540.svg">} (mempool: remove time-based transaction expiry by ismaelsadeeq)
• #36257 _{<img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36257.svg">} (qa: assert_equals -> assert_true/assert_false by hodlinator)
• #34405 _{<img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/34405.svg">} (wallet: skip APS when no partial spend exists by 8144225309)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

LLM Linter (✨ experimental)

Possible places where comparison-specific test macros should replace generic comparisons:

• test/functional/interface_usdt_utxocache.py: assert event.memory > 0 → Prefer assert_greater_than(event.memory, 0).
• test/functional/interface_usdt_utxocache.py: assert event.duration > 0 → Prefer assert_greater_than(event.duration, 0).

^{2026-11-05 15:31:11}

Concept ACK

cc @0xB10C

I beefed up the tradeoffs section here as I think it may have been undersold in its previous form.

Concept ACK.

Nice, I didn't know this was possible. I think it's a nice simplification and agree that we should test our interface, and not bcc which might or might not break from time to time. I plan to review this in more detail.

Does this also make the tests work aarch64 ref #35142 (comment)?

How does this fit into the large picture in #35142 ?

How does this fit into the large picture in #35142 ?

Sorry meant to reply here sooner but got distracted.

Of course the value to us of this patchset depends somewhat on whether we opt to keep tracing in-repo (vs as an external patchset). If we want to drop it, then this change is moot.

With b10c and the FIBRE team both using tracing actively it seems both would (naturally) prefer to keep it in-tree if possible. This seems fine to me, and I see this patchset as reducing the maintenance burden (to us) of keeping it here in its current form as it:

• removes BCC, root, and host-kernel requirements from functional testing
• preserves the USDT probes and existing production eBPF consumers.

Pushed to take one ralph finding.

The other suggestion does highlight a possible limitation, but I don't think it affects anything. The current binary has one site per probe name, so the fallback selects the correct layout.

Concept ACK