lkml.org 
[lkml]   [2023]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] tracing/user_events: Run BPF program if attached
    Date
    Programs that utilize user_events today only get the event payloads via
    perf or ftrace when writing event data. When BPF programs are attached
    to tracepoints created by user_events the BPF programs do not get run
    even though the attach succeeds. This causes confusion by the users of
    the programs, as they expect the data to be available via BPF programs
    they write. We have several projects that have hit this and requested
    BPF program support when publishing data via user_events from their
    user processes in production.

    Swap out perf_trace_buf_submit() for perf_trace_run_bpf_submit() to
    ensure BPF programs that are attached are run in addition to writing to
    perf or ftrace buffers. This requires no changes to the BPF infrastructure
    and only utilizes the GPL exported function that modules and other
    components may use for the same purpose. This keeps user_events consistent
    with how other kernel, modules, and probes expose tracepoint data to allow
    attachment of a BPF program.

    Cc: Alexei Starovoitov <ast@kernel.org>
    Cc: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Andrii Nakryiko <andrii@kernel.org>
    Cc: bpf@vger.kernel.org
    Signed-off-by: Beau Belgrave <beaub@linux.microsoft.com>
    ---
    kernel/trace/trace_events_user.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
    index b1ecd7677642..838fced40a41 100644
    --- a/kernel/trace/trace_events_user.c
    +++ b/kernel/trace/trace_events_user.c
    @@ -1422,11 +1422,12 @@ static void user_event_ftrace(struct user_event *user, struct iov_iter *i,
    static void user_event_perf(struct user_event *user, struct iov_iter *i,
    void *tpdata, bool *faulted)
    {
    + bool bpf_prog = bpf_prog_array_valid(&user->call);
    struct hlist_head *perf_head;

    perf_head = this_cpu_ptr(user->call.perf_events);

    - if (perf_head && !hlist_empty(perf_head)) {
    + if (perf_head && (!hlist_empty(perf_head) || bpf_prog)) {
    struct trace_entry *perf_entry;
    struct pt_regs *regs;
    size_t size = sizeof(*perf_entry) + i->count;
    @@ -1447,9 +1448,9 @@ static void user_event_perf(struct user_event *user, struct iov_iter *i,
    unlikely(user_event_validate(user, perf_entry, size)))
    goto discard;

    - perf_trace_buf_submit(perf_entry, size, context,
    - user->call.event.type, 1, regs,
    - perf_head, NULL);
    + perf_trace_run_bpf_submit(perf_entry, size, context,
    + &user->call, 1, regs,
    + perf_head, NULL);

    return;
    discard:
    base-commit: 3862f86c1529fa0016de6344eb974877b4cd3838
    --
    2.25.1

    \
     
     \ /
      Last update: 2023-05-08 18:40    [W:6.172 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site