linux-kernel - Re: [PATCH v3 1/7] rtla/timerlat: Support tail call from BPF program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ijizcoufpxwtrutqpurumsx7zls2dixyanlcn6oshvhpon5osd@aeuzrsmkidrz>
Date: Mon, 3 Nov 2025 11:23:57 -0300
From: Wander Lairson Costa <wander@...hat.com>
To: Tomas Glozar <tglozar@...hat.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, 
	LKML <linux-kernel@...r.kernel.org>, Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, 
	John Kacur <jkacur@...hat.com>, Luis Goncalves <lgoncalv@...hat.com>, 
	Costa Shulyupin <costa.shul@...hat.com>, Crystal Wood <crwood@...hat.com>, 
	Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH v3 1/7] rtla/timerlat: Support tail call from BPF program

On Mon, Oct 27, 2025 at 04:33:55PM +0100, Tomas Glozar wrote:
> Add a map to the rtla-timerlat BPF program that holds a file descriptor
> of another BPF program, to be executed on threshold overflow.
> 
> timerlat_bpf_set_action() is added as an interface to set the program.
> 
> Signed-off-by: Tomas Glozar <tglozar@...hat.com>
> ---
>  tools/tracing/rtla/src/timerlat.bpf.c | 23 ++++++++++++++++++++---
>  tools/tracing/rtla/src/timerlat_bpf.c | 13 +++++++++++++
>  tools/tracing/rtla/src/timerlat_bpf.h |  1 +
>  3 files changed, 34 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/tracing/rtla/src/timerlat.bpf.c b/tools/tracing/rtla/src/timerlat.bpf.c
> index 084cd10c21fc..19ccd9abf8d4 100644
> --- a/tools/tracing/rtla/src/timerlat.bpf.c
> +++ b/tools/tracing/rtla/src/timerlat.bpf.c
> @@ -40,6 +40,17 @@ struct {
>  	__uint(max_entries, 1);
>  } signal_stop_tracing SEC(".maps");
>  
> +struct {
> +	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
> +	__uint(key_size, sizeof(unsigned int));
> +	__uint(max_entries, 1);
> +	__array(values, unsigned int (void *));
> +} bpf_action SEC(".maps") = {
> +	.values = {
> +		[0] = 0
> +	},
> +};
> +
>  /* Params to be set by rtla */
>  const volatile int bucket_size = 1;
>  const volatile int output_divisor = 1000;
> @@ -109,7 +120,7 @@ nosubprog void update_summary(void *map,
>  	map_set(map, SUMMARY_SUM, map_get(map, SUMMARY_SUM) + latency);
>  }
>  
> -nosubprog void set_stop_tracing(void)
> +nosubprog void set_stop_tracing(struct trace_event_raw_timerlat_sample *tp_args)
>  {
>  	int value = 0;
>  
> @@ -118,6 +129,12 @@ nosubprog void set_stop_tracing(void)
>  
>  	/* Signal to userspace */
>  	bpf_ringbuf_output(&signal_stop_tracing, &value, sizeof(value), 0);
> +
> +	/*
> +	 * Call into BPF action program, if attached.
> +	 * Otherwise, just silently fail.
> +	 */
> +	bpf_tail_call(tp_args, &bpf_action, 0);
>  }
>  
>  SEC("tp/osnoise/timerlat_sample")
> @@ -138,13 +155,13 @@ int handle_timerlat_sample(struct trace_event_raw_timerlat_sample *tp_args)
>  		update_summary(&summary_irq, latency, bucket);
>  
>  		if (irq_threshold != 0 && latency_us >= irq_threshold)
> -			set_stop_tracing();
> +			set_stop_tracing(tp_args);
>  	} else if (tp_args->context == 1) {
>  		update_main_hist(&hist_thread, bucket);
>  		update_summary(&summary_thread, latency, bucket);
>  
>  		if (thread_threshold != 0 && latency_us >= thread_threshold)
> -			set_stop_tracing();
> +			set_stop_tracing(tp_args);
>  	} else {
>  		update_main_hist(&hist_user, bucket);
>  		update_summary(&summary_user, latency, bucket);
> diff --git a/tools/tracing/rtla/src/timerlat_bpf.c b/tools/tracing/rtla/src/timerlat_bpf.c
> index e97d16646bcd..1d619e502c65 100644
> --- a/tools/tracing/rtla/src/timerlat_bpf.c
> +++ b/tools/tracing/rtla/src/timerlat_bpf.c
> @@ -59,6 +59,19 @@ int timerlat_bpf_init(struct timerlat_params *params)
>  	return 0;
>  }
>  
> +/*
> + * timerlat_bpf_set_action - set action on threshold executed on BPF side
> + */
> +static int timerlat_bpf_set_action(struct bpf_program *prog)
> +{
> +	unsigned int key = 0, value = bpf_program__fd(prog);
> +
> +	return bpf_map__update_elem(bpf->maps.bpf_action,
> +				    &key, sizeof(key),
> +				    &value, sizeof(value),
> +				    BPF_ANY);
> +}
> +

I believe it makes more sense to add the definition of this function to
the patch where it is called.

>  /*
>   * timerlat_bpf_attach - attach BPF program to collect timerlat data
>   */
> diff --git a/tools/tracing/rtla/src/timerlat_bpf.h b/tools/tracing/rtla/src/timerlat_bpf.h
> index 118487436d30..b5009092c7a3 100644
> --- a/tools/tracing/rtla/src/timerlat_bpf.h
> +++ b/tools/tracing/rtla/src/timerlat_bpf.h
> @@ -12,6 +12,7 @@ enum summary_field {
>  };
>  
>  #ifndef __bpf__
> +#include <bpf/libbpf.h>
>  #ifdef HAVE_BPF_SKEL
>  int timerlat_bpf_init(struct timerlat_params *params);
>  int timerlat_bpf_attach(void);
> -- 
> 2.51.0
>