linux-kernel - [RFC PATCH bpf-next 0/2] Eliminate IRQ Time from BPF Program Running Duration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <cover.1745250534.git.iecedge@gmail.com>
Date: Tue, 22 Apr 2025 21:47:25 +0800
From: Jianlin Lv <iecedge@...il.com>
To: bpf@...r.kernel.org
Cc: ast@...nel.org,
	daniel@...earbox.net,
	andrii@...nel.org,
	martin.lau@...ux.dev,
	eddyz87@...il.com,
	song@...nel.org,
	yonghong.song@...ux.dev,
	john.fastabend@...il.com,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org,
	mingo@...hat.com,
	peterz@...radead.org,
	juri.lelli@...hat.com,
	vincent.guittot@...aro.org,
	dietmar.eggemann@....com,
	rostedt@...dmis.org,
	bsegall@...gle.com,
	mgorman@...e.de,
	vschneid@...hat.com,
	linux-kernel@...r.kernel.org,
	iecedge@...il.com,
	jianlv@...y.com
Subject: [RFC PATCH  bpf-next 0/2] Eliminate IRQ Time from BPF Program Running Duration

From: Jianlin Lv <iecedge@...il.com>

Motivation:
===========
This proposal aims to enhance the __bpf_prog_run function by eliminating
IRQ time from the BPF program running duration. When a BPF program is
attached to a kernel function running in user context, any interrupts that
occur can lead to the BPF program's execution duration including the time
spent in interrupt handling. This results in an observed increase in CPU
usage attributed to eBPF.

Design:
=======
The elimination of IRQ time is built upon enabling 
CONFIG_IRQ_TIME_ACCOUNTING. Before a BPF program runs in user context,
call irq_time_read to record current total IRQ time for the CPU. After the
BPF program execution, call irq_time_read again to record the total IRQ
time. The difference between these two readings gives the IRQ handling
time for this BPF call. Then subtract the IRQ handling time from the
total BPF processing duration.

Currently, the irq_time_read function is defined as static, preventing its
use by other modules. This proposal suggests exporting irq_time_read for
use by the BPF module.

TODOs:
======
- Support elimination of IRQ time for BPF trampoline.
- Add selftests to validate the functionality.

this mail is mainly to get feedback on the design and implementation
approach. TODO item will be added in subsequent updates once we gather
input on the proposal.

Jianlin Lv (2):
  Enhance BPF execution timing by excluding IRQ time
  Export irq_time_read for BPF module usage

 include/linux/filter.h | 24 ++++++++++++++++++++++--
 include/linux/sched.h  |  4 ++++
 kernel/sched/core.c    | 22 ++++++++++++++++++++++
 kernel/sched/sched.h   | 19 -------------------
 4 files changed, 48 insertions(+), 21 deletions(-)

-- 
2.34.1