Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Song Liu <songliubraving@fb.com>
To:     David Ahern <dsahern@gmail.com>
CC:     Peter Zijlstra <peterz@infradead.org>,
        Netdev <netdev@vger.kernel.org>,
        lkml <linux-kernel@vger.kernel.org>,
        Kernel Team <Kernel-team@fb.com>,
        "ast@kernel.org" <ast@kernel.org>,
        "daniel@iogearbox.net" <daniel@iogearbox.net>,
        "acme@kernel.org" <acme@kernel.org>
Subject: Re: [RFC perf,bpf 1/5] perf, bpf: Introduce PERF_RECORD_BPF_EVENT
Thread-Topic: [RFC perf,bpf 1/5] perf, bpf: Introduce PERF_RECORD_BPF_EVENT
Thread-Index: AQHUdhLRNu0EDS9AC0KZ+9MuHYh4daVD/w6AgACjMoCAAVksAIAAM3wAgAAF/wCAAAZ1AIABdg+AgAAcTwA=
Date:   Fri, 9 Nov 2018 18:49:27 +0000
Message-ID: <74246BC0-EA66-407E-93E6-0D6E8645F486@fb.com>
References: <20181106205246.567448-1-songliubraving@fb.com>
 <20181106205246.567448-2-songliubraving@fb.com>
 <20181107084057.GG9781@hirez.programming.kicks-ass.net>
 <31067290-4B66-4AA1-8027-607397BC0264@fb.com>
 <20181108150028.GU9761@hirez.programming.kicks-ass.net>
 <C858C862-E523-4CE8-AB39-CC9B27BE2538@fb.com>
 <d5043aae-69b0-fd49-e82a-5a13834a3f32@gmail.com>
 <050ABAC6-6C3B-4B6B-BB68-727127E00B51@fb.com>
 <37d2c7a8-fe99-94bd-9b8f-24e9ca9fa39c@gmail.com>
In-Reply-To: <37d2c7a8-fe99-94bd-9b8f-24e9ca9fa39c@gmail.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <970D132C03C0654D874540EEB6B1A0E9@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 2a55843f-b7b3-4912-17f3-08d64674139a
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Nov 2018 18:49:27.7389
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1199
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-11-09_06:,,
 signatures=0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Nov 9, 2018, at 9:08 AM, David Ahern <dsahern@gmail.com> wrote:
>=20
> On 11/8/18 11:49 AM, Song Liu wrote:
>> Could you please point me to more information about the use cases you wo=
rry=20
>> about? I am more than happy to optimize the logic for those use cases.=20
>=20
> bpf load and unload as just another tracepoint to throw into a set of
> events that are monitored. As mentioned before auditing the loads and
> unloads is one example.

For the tracepoint approach, we need similar synchronous logic in perf to=20
process BPF load/unload events. If we agree this is the right direction,=20
I will modify the set with tracepoints.=20

>=20
> And that brings up another comment: Why are you adding a PERF_RECORD_*
> rather than a tracepoint? From what I can see the PERF_RECORD_BPF_EVENT
> definition does not include the who is loading / unloading a bpf
> program. That is important information as well.

bpf_prog_info has "__u32 created_by_uid;" in it, so it is not really needed
in current version.=20

Thanks,
Song=