linux-kernel - Re: [PATCH v3 0/6] perf auxtrace: Support AUX pause and resume with BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <fd7c39d2-64b4-480e-8a29-abefcdc7d10a@intel.com>
Date: Mon, 28 Jul 2025 20:02:51 +0300
From: Adrian Hunter <adrian.hunter@...el.com>
To: Leo Yan <leo.yan@....com>, Peter Zijlstra <peterz@...radead.org>, "Ingo
 Molnar" <mingo@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>,
	Namhyung Kim <namhyung@...nel.org>, Jiri Olsa <jolsa@...nel.org>, Ian Rogers
	<irogers@...gle.com>, KP Singh <kpsingh@...nel.org>, Matt Bobrowski
	<mattbobrowski@...gle.com>, Song Liu <song@...nel.org>, Alexei Starovoitov
	<ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko
	<andrii@...nel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, "Eduard
 Zingerman" <eddyz87@...il.com>, Yonghong Song <yonghong.song@...ux.dev>,
	"John Fastabend" <john.fastabend@...il.com>, Stanislav Fomichev
	<sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, Steven Rostedt
	<rostedt@...dmis.org>, "Masami Hiramatsu" <mhiramat@...nel.org>, Mathieu
 Desnoyers <mathieu.desnoyers@...icios.com>, James Clark
	<james.clark@...aro.org>, Suzuki K Poulose <suzuki.poulose@....com>, Mike
 Leach <mike.leach@...aro.org>
CC: <linux-perf-users@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<bpf@...r.kernel.org>, <linux-trace-kernel@...r.kernel.org>
Subject: Re: [PATCH v3 0/6] perf auxtrace: Support AUX pause and resume with
 BPF

On 25/07/2025 12:59, Leo Yan wrote:
> This series extends Perf for fine-grained tracing by using BPF program
> to pause and resume AUX tracing. The BPF program can be attached to
> tracepoints (including ftrace tracepoints and dynamic tracepoints, like
> kprobe, kretprobe, uprobe and uretprobe).

Using eBPF to pause/resume AUX tracing seems like a great idea.

AFAICT with this patch set, there is just support for pause/resume
much like what could be done directly without eBPF, so I wonder if you
could share a bit more on how you see this evolving, and what your
future plans are?

> 
> The first two patches are changes in kernel - it adds a bpf kfunc which
> can be invoked from BPF program.
> 
> The Perf tool implements BPF skeleton program, hooks BPF program into a
> perf record session. This is finished by patches 03 ~ 05.
> 
> The patch 06 updates documentation for usage of the new introduced
> option '--bpf-aux-pause'.
> 
> This series has been tested on Hikey960 platform with commands:
> 
>   perf record -e cs_etm/aux-action=start-paused/ \
>     --bpf-aux-pause="kretprobe:p:__arm64_sys_openat,kprobe:r:__arm64_sys_openat,tp:r:sched:sched_switch" \
>     -a -- ls
> 
>   perf record -e cs_etm/aux-action=start-paused/ \
>     --bpf-aux-pause="kretprobe:p:__arm64_sys_openat,kprobe:r:__arm64_sys_openat,tp:r:sched:sched_switch" \
>     -i -- ls
> 
>   perf record -e cs_etm/aux-action=start-paused/ \
>     --bpf-aux-pause="uretprobe:p:/mnt/sort:bubble_sort,uprobe:r:/mnt/sort:bubble_sort" \
>     --per-thread -- /mnt/sort
> 
> Note, as the AUX pause operation cannot be inherited by child tasks, it
> requires to specify the '-i' option for default mode. Otherwise, the
> tool reports an error to remind user to disable inherited mode:
> 
>   Failed to update BPF map for auxtrace: Operation not supported.
>     Try to disable inherit mode with option '-i'.
> 
> Changes in v3:
> - Added check "map->type" (Eduard)
> - Fixed kfunc with guard(irqsave).
> - Link to v2: https://lore.kernel.org/r/20250718-perf_aux_pause_resume_bpf_rebase-v2-0-992557b8fb16@arm.com
> 
> Changes in v2:
> - Changed to use BPF kfunc and dropped uAPI (Yonghong).
> - Added support uprobe/uretprobe.
> - Refined the syntax for trigger points (mainly for trigger action {p:r}).
> - Fixed a bug in the BPF program with passing wrong flag.
> - Rebased on bpf-next branch.
> - Link to v1: https://lore.kernel.org/linux-perf-users/20241215193436.275278-1-leo.yan@arm.com/T/#m10ea3e66bca7418db07c141a14217934f36e3bc8
> 
> ---
> Leo Yan (6):
>       perf/core: Make perf_event_aux_pause() as external function
>       bpf: Add bpf_perf_event_aux_pause kfunc
>       perf: auxtrace: Control AUX pause and resume with BPF
>       perf: auxtrace: Add BPF userspace program for AUX pause and resume
>       perf record: Support AUX pause and resume with BPF
>       perf docs: Document AUX pause and resume with BPF
> 
>  include/linux/perf_event.h                    |   1 +
>  kernel/events/core.c                          |   2 +-
>  kernel/trace/bpf_trace.c                      |  55 ++++
>  tools/perf/Documentation/perf-record.txt      |  51 ++++
>  tools/perf/Makefile.perf                      |   1 +
>  tools/perf/builtin-record.c                   |  20 +-
>  tools/perf/util/Build                         |   4 +
>  tools/perf/util/auxtrace.h                    |  43 +++
>  tools/perf/util/bpf_auxtrace_pause.c          | 408 ++++++++++++++++++++++++++
>  tools/perf/util/bpf_skel/auxtrace_pause.bpf.c | 156 ++++++++++
>  tools/perf/util/evsel.c                       |   6 +
>  tools/perf/util/record.h                      |   1 +
>  12 files changed, 746 insertions(+), 2 deletions(-)
> ---
> base-commit: 95993dc3039e29dabb9a50d074145d4cb757b08b
> change-id: 20250717-perf_aux_pause_resume_bpf_rebase-174c79b0bab5
> 
> Best regards,