linux-kernel - Re: [PATCH v3 4/7] rtla/tests: Test BPF action program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <u4jf3ut26njnm63qgyfhq5xik7zhioecjzffok2h6jmd5utd7g@2ptjrmuvbehq>
Date: Mon, 3 Nov 2025 12:10:39 -0300
From: Wander Lairson Costa <wander@...hat.com>
To: Tomas Glozar <tglozar@...hat.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, 
	LKML <linux-kernel@...r.kernel.org>, Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, 
	John Kacur <jkacur@...hat.com>, Luis Goncalves <lgoncalv@...hat.com>, 
	Costa Shulyupin <costa.shul@...hat.com>, Crystal Wood <crwood@...hat.com>, 
	Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH v3 4/7] rtla/tests: Test BPF action program

On Mon, Oct 27, 2025 at 04:33:58PM +0100, Tomas Glozar wrote:
> Add a test that implements a BPF program writing to a test map, which
> is attached to RTLA via --bpf-action to be executed on theshold
> overflow.
> 
> A combination of --on-threshold shell with bpftool (which is always
> present if BPF support is enabled) is used to check whether the BPF
> program has executed successfully.
> 
> Suggested-by: Crystal Wood <crwood@...hat.com>
> Signed-off-by: Tomas Glozar <tglozar@...hat.com>
> ---
>  tools/tracing/rtla/Makefile                   | 10 ++++++--
>  tools/tracing/rtla/tests/bpf/bpf_action_map.c | 25 +++++++++++++++++++
>  tools/tracing/rtla/tests/timerlat.t           | 15 +++++++++++
>  3 files changed, 48 insertions(+), 2 deletions(-)
>  create mode 100644 tools/tracing/rtla/tests/bpf/bpf_action_map.c
> 
> diff --git a/tools/tracing/rtla/Makefile b/tools/tracing/rtla/Makefile
> index 5f1529ce3693..aef814b639b7 100644
> --- a/tools/tracing/rtla/Makefile
> +++ b/tools/tracing/rtla/Makefile
> @@ -76,12 +76,18 @@ src/timerlat.skel.h: src/timerlat.bpf.o
>  
>  example/timerlat_bpf_action.o: example/timerlat_bpf_action.c
>  	$(QUIET_CLANG)$(CLANG) -g -O2 -target bpf -c $(filter %.c,$^) -o $@

I didn't understand why the filter function is needed. $< or $^ seems
enough.

> +
> +tests/bpf/bpf_action_map.o: tests/bpf/bpf_action_map.c
> +	$(QUIET_CLANG)$(CLANG) -g -O2 -target bpf -c $(filter %.c,$^) -o $@
>  else
>  src/timerlat.skel.h:
>  	$(Q)echo '/* BPF skeleton is disabled */' > src/timerlat.skel.h
>  
>  example/timerlat_bpf_action.o: example/timerlat_bpf_action.c
>  	$(Q)echo "BPF skeleton support is disabled, skipping example/timerlat_bpf_action.o"
> +
> +tests/bpf/bpf_action_map.o: tests/bpf/bpf_action_map.c
> +	$(Q)echo "BPF skeleton support is disabled, skipping tests/bpf/bpf_action_map.o"

Why not just not creating the targets if BPF is not enabled?

>  endif
>  
>  $(RTLA): $(RTLA_IN)
> @@ -103,7 +109,7 @@ clean: doc_clean fixdep-clean
>  	$(Q)rm -f rtla rtla-static fixdep FEATURE-DUMP rtla-*
>  	$(Q)rm -rf feature
>  	$(Q)rm -f src/timerlat.bpf.o src/timerlat.skel.h example/timerlat_bpf_action.o
> -check: $(RTLA)
> -	RTLA=$(RTLA) prove -o -f tests/
> +check: $(RTLA) tests/bpf/bpf_action_map.o

Will this work if BPF is disabled?

> +	RTLA=$(RTLA) BPFTOOL=$(SYSTEM_BPFTOOL) prove -o -f tests/
>  examples: example/timerlat_bpf_action.o
>  .PHONY: FORCE clean check
> diff --git a/tools/tracing/rtla/tests/bpf/bpf_action_map.c b/tools/tracing/rtla/tests/bpf/bpf_action_map.c
> new file mode 100644
> index 000000000000..1686e0b858e6
> --- /dev/null
> +++ b/tools/tracing/rtla/tests/bpf/bpf_action_map.c
> @@ -0,0 +1,25 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/bpf.h>
> +#include <bpf/bpf_tracing.h>
> +
> +char LICENSE[] SEC("license") = "GPL";
> +
> +struct {
> +	__uint(type, BPF_MAP_TYPE_ARRAY);
> +	__uint(max_entries, 1);
> +	__type(key, unsigned int);
> +	__type(value, unsigned long long);
> +} rtla_test_map SEC(".maps");
> +
> +struct trace_event_raw_timerlat_sample;
> +
> +SEC("tp/timerlat_action")
> +int action_handler(struct trace_event_raw_timerlat_sample *tp_args)
> +{
> +	unsigned int key = 0;
> +	unsigned long long value = 42;
> +
> +	bpf_map_update_elem(&rtla_test_map, &key, &value, BPF_ANY);
> +
> +	return 0;
> +}
> diff --git a/tools/tracing/rtla/tests/timerlat.t b/tools/tracing/rtla/tests/timerlat.t
> index b5d1e7260a9b..89e28cc6df82 100644
> --- a/tools/tracing/rtla/tests/timerlat.t
> +++ b/tools/tracing/rtla/tests/timerlat.t
> @@ -67,6 +67,21 @@ check "hist with trace output at end" \
>  	"timerlat hist -d 1s --on-end trace" 0 "^  Saving trace to timerlat_trace.txt$"
>  check "top with trace output at end" \
>  	"timerlat top -d 1s --on-end trace" 0 "^  Saving trace to timerlat_trace.txt$"
> +
> +# BPF action program tests
> +if [ "$option" -eq 0 ]
> +then
> +	# Test BPF action program properly in BPF mode
> +	[ -z "$BPFTOOL" ] && BPFTOOL=bpftool
> +	check "hist with BPF action program (BPF mode)" \
> +		"timerlat hist -T 2 --bpf-action tests/bpf/bpf_action_map.o --on-threshold shell,command='$BPFTOOL map dump name rtla_test_map'" \
> +		2 '"value": 42'
> +else
> +	# Test BPF action program failure in non-BPF mode
> +	check "hist with BPF action program (non-BPF mode)" \
> +		"timerlat hist -T 2 --bpf-action tests/bpf/bpf_action_map.o" \
> +		1 "BPF actions are not supported in tracefs-only mode"
> +fi
>  done
>  
>  test_end
> -- 
> 2.51.0
>