linux-kernel - Re: [PATCH v3 2/7] rtla/timerlat: Add --bpf-action option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAP4=nvS6zDkb-yo+uu0LHk=OBKP+UO-p46tLygGOUG0zkrkbiw@mail.gmail.com>
Date: Tue, 25 Nov 2025 14:48:41 +0100
From: Tomas Glozar <tglozar@...hat.com>
To: Wander Lairson Costa <wander@...hat.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, LKML <linux-kernel@...r.kernel.org>, 
	Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>, John Kacur <jkacur@...hat.com>, 
	Luis Goncalves <lgoncalv@...hat.com>, Costa Shulyupin <costa.shul@...hat.com>, 
	Crystal Wood <crwood@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH v3 2/7] rtla/timerlat: Add --bpf-action option

po 3. 11. 2025 v 15:45 odesílatel Wander Lairson Costa
<wander@...hat.com> napsal:
> >
> > Executing additional BPF code on latency threshold overflow allows doing
> > doing low-latency and in-kernel troubleshooting of the cause of the
>
> typo: double "doing"
>

Thanks, I'll fix that :)

> > --- a/tools/tracing/rtla/src/timerlat.c
> > +++ b/tools/tracing/rtla/src/timerlat.c
> > @@ -48,6 +48,17 @@ timerlat_apply_config(struct osnoise_tool *tool, struct timerlat_params *params)
> >               }
> >       }
> >
> > +     /* Check if BPF action program is requested but BPF is not available */
> > +     if (params->bpf_action_program) {
> > +             if (params->mode == TRACING_MODE_TRACEFS) {
> > +                     err_msg("BPF actions are not supported in tracefs-only mode\n");
>
> I would just emit a warning to the user and proceed ignoring the bpf action argument.
>

I believe if the user explicitly requests BPF actions to be used,
measurement should not proceed without the action. Imagine someone
setting --bpf-action in an automated test, expecting it to report
something. But the action never fires, because they do not notice they
are running an old kernel that does not support this.

The user can always restart/reconfigure RTLA to skip the option.

Tomas