linux-kernel - Re: [PATCH v3 0/6] perf auxtrace: Support AUX pause and resume with BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250730182623.GE143191@e132581.arm.com>
Date: Wed, 30 Jul 2025 19:26:23 +0100
From: Leo Yan <leo.yan@....com>
To: Adrian Hunter <adrian.hunter@...el.com>
Cc: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Namhyung Kim <namhyung@...nel.org>, Jiri Olsa <jolsa@...nel.org>,
	Ian Rogers <irogers@...gle.com>, KP Singh <kpsingh@...nel.org>,
	Matt Bobrowski <mattbobrowski@...gle.com>,
	Song Liu <song@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	James Clark <james.clark@...aro.org>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Mike Leach <mike.leach@...aro.org>,
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH v3 0/6] perf auxtrace: Support AUX pause and resume with
 BPF

Hi Adrian,

On Mon, Jul 28, 2025 at 08:02:51PM +0300, Adrian Hunter wrote:
> On 25/07/2025 12:59, Leo Yan wrote:
> > This series extends Perf for fine-grained tracing by using BPF program
> > to pause and resume AUX tracing. The BPF program can be attached to
> > tracepoints (including ftrace tracepoints and dynamic tracepoints, like
> > kprobe, kretprobe, uprobe and uretprobe).
> 
> Using eBPF to pause/resume AUX tracing seems like a great idea.
> 
> AFAICT with this patch set, there is just support for pause/resume
> much like what could be done directly without eBPF, so I wonder if you
> could share a bit more on how you see this evolving, and what your
> future plans are?

IIUC, here you mean the tool can use `perf probe` to firstly create
probes, then enable tracepoints as PMU event for AUX pause and resume.

I would say a benefit from this series is users can use a single
command to create probes and bind eBPF program for AUX pause and
resume in one go.

To be honest, at current stage, I don't have clear idea for expanding
this feature. But a clear requirement is: AUX trace data usually is
quite huge, after initial analysis, developers might want to focus
on specific function profiling (based on function entry and exit) or
specific period (E.g., start tracing when hit a tracepoing and stop when
hit another tracepoint).

eBPF program is powerful. Basically, we can extend it in two different
dimensions. One direction is we can easily attach the eBPF program to more
kernel modules, like networking, storage, etc. Another direction is to
improve the eBPF program itself as a filter for better fine-grained
tracing, so far we only support limited filtering based on CPU ID or PID,
we also can extend the filtering based on time, event types, etc.

Thanks,
Leo