linux-kernel - [PATCH v1 7/7] perf docs: Document AUX pause with BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241215193436.275278-8-leo.yan@arm.com>
Date: Sun, 15 Dec 2024 19:34:36 +0000
From: Leo Yan <leo.yan@....com>
To: Arnaldo Carvalho de Melo <acme@...nel.org>,
	Adrian Hunter <adrian.hunter@...el.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Jiri Olsa <jolsa@...nel.org>,
	Ian Rogers <irogers@...gle.com>,
	James Clark <james.clark@...aro.org>,
	"Liang, Kan" <kan.liang@...ux.intel.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>,
	Matt Bobrowski <mattbobrowski@...gle.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	linux-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	bpf@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Mike Leach <mike.leach@...aro.org>
Cc: Leo Yan <leo.yan@....com>
Subject: [PATCH v1 7/7] perf docs: Document AUX pause with BPF

Documents the usage of the --bpf-aux-pause option and provides
examples.

Signed-off-by: Leo Yan <leo.yan@....com>
---
 tools/perf/Documentation/perf-record.txt | 40 ++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 80686d590de2..25cf993b7a50 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -535,6 +535,46 @@ must be an AUX area event. Samples on other events will be created containing
 data from the AUX area. Optionally sample size may be specified, otherwise it
 defaults to 4KiB.
 
+--bpf-aux-pause=[=OPTIONS]::
+Specify trace events for triggering AUX pause with a BPF program. A trace event
+can be a kprobe, kretprobe or tracepoint. This option must be enabled in
+combination with the "aux-action=start-paused" configuration in an AUX event.
+
+For attaching a kprobe or kretprobe event, the format is:
+
+  {kprobe|kretprobe}:function_name:{p|r}
+
+For attaching a tracepoint, the format is:
+
+  {tp|tracepoint}:category:tracepint_name:{p|r}
+
+The first field is for the trace event type. It supports three types: kprobe,
+kretprobe, and tracepoint ('tp' is also supported as an abbreviation for
+"tracepoint"). The last field specifies whether the action is pause ("p") or
+resume ("r").
+
+For kprobe and kretprobe, the "function_name" field is for specifying a kernel
+function name. In the case of a tracepoint, the "category" and "tracepoint_name"
+fields are used together for providing complete tracepoint info.
+
+The '--bpf-aux-pause' option does not support inherit mode.  In the default
+trace mode or per-thread mode, it needs to be combined with the '-i' or
+'--no-inherit' option to disable inherit mode.
+
+The syntax supports multiple trace events, with each separated by a comma (,).
+For example, users can set up AUX pause on a kernel function with kretprobe and
+AUX resume on a tracepoint with the syntax below:
+
+  For default trace mode (with inherit mode disabled):
+  perf record -e cs_etm/aux-action=start-paused/ \
+  --bpf-aux-pause="kretprobe:__arm64_sys_openat:p,tp:sched:sched_switch:r" \
+  -i ...
+
+  For system wide trace mode:
+  perf record -e cs_etm/aux-action=start-paused/ \
+  --bpf-aux-pause="kretprobe:__arm64_sys_openat:p,tp:sched:sched_switch:r" \
+  -a ...
+
 --proc-map-timeout::
 When processing pre-existing threads /proc/XXX/mmap, it may take a long time,
 because the file may be huge. A time out is needed in such cases.
-- 
2.34.1