linux-kernel - [PATCH 4/4] Documentation/rtla: Document --bpf-action option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251017144650.663238-5-tglozar@redhat.com>
Date: Fri, 17 Oct 2025 16:46:50 +0200
From: Tomas Glozar <tglozar@...hat.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: LKML <linux-kernel@...r.kernel.org>,
	Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>,
	John Kacur <jkacur@...hat.com>,
	Luis Goncalves <lgoncalv@...hat.com>,
	Costa Shulyupin <costa.shul@...hat.com>,
	Crystal Wood <crwood@...hat.com>,
	Wander Lairson Costa <wander@...hat.com>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Tomas Glozar <tglozar@...hat.com>
Subject: [PATCH 4/4] Documentation/rtla: Document --bpf-action option

Add new option --bpf-action into common_timerlat_options.txt, including
the format in which it takes the BPF program, and a reference to an
example.

Signed-off-by: Tomas Glozar <tglozar@...hat.com>
---
 .../tools/rtla/common_timerlat_options.rst     | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/Documentation/tools/rtla/common_timerlat_options.rst b/Documentation/tools/rtla/common_timerlat_options.rst
index 1f5d024b53aa..1b7293ebc897 100644
--- a/Documentation/tools/rtla/common_timerlat_options.rst
+++ b/Documentation/tools/rtla/common_timerlat_options.rst
@@ -65,3 +65,21 @@
         Set timerlat to run without workload, waiting for the user to dispatch a per-cpu
         task that waits for a new period on the tracing/osnoise/per_cpu/cpu$ID/timerlat_fd.
         See linux/tools/rtla/sample/timerlat_load.py for an example of user-load code.
+
+**--bpf-action** *bpf-program*
+
+        Loads a BPF program from an ELF file and executes it when a latency threshold is exceeded.
+
+        The BPF program must be a valid ELF file loadable with libbpf. The program must contain
+        a function named ``action_handler``, declared with ``SEC("tp/timerlat_action")`` for libbpf
+        to correctly detect the program type.
+
+        The program receives a ``struct trace_event_raw_timerlat_sample`` parameter
+        containing timerlat sample data.
+
+        A sample BPF action program is provided in ``tools/tracing/rtla/sample/timerlat_bpf_action.c``.
+        This example demonstrates how to create a BPF program that prints latency information when
+        thresholds are exceeded.
+
+        **Note**: BPF actions require BPF support to be available. If BPF is not available or disabled,
+        the tool will fall back to tracefs mode and BPF actions will not be supported.
-- 
2.51.0