linux-kernel - Re: [PATCH 3/4] rtla/timerlat: Add example for BPF action program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP4=nvR86-pmQWdx8rCksp9Dj1mRvgS4961C6my0sVSj1h01Sg@mail.gmail.com>
Date: Mon, 27 Oct 2025 11:34:36 +0100
From: Tomas Glozar <tglozar@...hat.com>
To: Crystal Wood <crwood@...hat.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, LKML <linux-kernel@...r.kernel.org>, 
	Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, John Kacur <jkacur@...hat.com>, 
	Luis Goncalves <lgoncalv@...hat.com>, Costa Shulyupin <costa.shul@...hat.com>, 
	Wander Lairson Costa <wander@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH 3/4] rtla/timerlat: Add example for BPF action program

pá 24. 10. 2025 v 3:49 odesílatel Crystal Wood <crwood@...hat.com> napsal:
>
> OK, but as far as I can tell there's no way to get the non-BPF "stop
> tracing hit" messages without adding a call to trace_array_init_printk()
> into trace_osnoise.c.
>

I'm not sure what you mean. The --bpf-action functionality is
exclusive for BPF mode, bpf_trace_printk() / bpf_printk(), as Steven
clarified, is a BPF helper that triggers a trace event, defined in
kernel/trace/bpf_trace.c and kernel/trace/bpf_trace.h.

Either way, it seems that the event is not always recorded in the RTLA
trace instance due to a bug. It might have something to do with the
trace instance recording both osnoise:timerlat_sample and
bpf_trace_printk, and failing to record a trace event generated during
the handling of another trace event. So this is not a reliable way to
test the BPF actions feature, and I'll probably have to use my
original idea.

Tomas