Messages in this thread | | | From | Song Liu <> | Subject | Re: [RFC perf,bpf 1/5] perf, bpf: Introduce PERF_RECORD_BPF_EVENT | Date | Fri, 9 Nov 2018 18:49:27 +0000 |
| |
> On Nov 9, 2018, at 9:08 AM, David Ahern <dsahern@gmail.com> wrote: > > On 11/8/18 11:49 AM, Song Liu wrote: >> Could you please point me to more information about the use cases you worry >> about? I am more than happy to optimize the logic for those use cases. > > bpf load and unload as just another tracepoint to throw into a set of > events that are monitored. As mentioned before auditing the loads and > unloads is one example.
For the tracepoint approach, we need similar synchronous logic in perf to process BPF load/unload events. If we agree this is the right direction, I will modify the set with tracepoints.
> > And that brings up another comment: Why are you adding a PERF_RECORD_* > rather than a tracepoint? From what I can see the PERF_RECORD_BPF_EVENT > definition does not include the who is loading / unloading a bpf > program. That is important information as well.
bpf_prog_info has "__u32 created_by_uid;" in it, so it is not really needed in current version.
Thanks, Song
| |