From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: [RFC perf,bpf 1/5] perf, bpf: Introduce PERF_RECORD_BPF_EVENT Date: Fri, 9 Nov 2018 10:08:07 -0700 Message-ID: <37d2c7a8-fe99-94bd-9b8f-24e9ca9fa39c@gmail.com> References: <20181106205246.567448-1-songliubraving@fb.com> <20181106205246.567448-2-songliubraving@fb.com> <20181107084057.GG9781@hirez.programming.kicks-ass.net> <31067290-4B66-4AA1-8027-607397BC0264@fb.com> <20181108150028.GU9761@hirez.programming.kicks-ass.net> <050ABAC6-6C3B-4B6B-BB68-727127E00B51@fb.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: Peter Zijlstra , Netdev , lkml , Kernel Team , "ast@kernel.org" , "daniel@iogearbox.net" , "acme@kernel.org" To: Song Liu Return-path: In-Reply-To: <050ABAC6-6C3B-4B6B-BB68-727127E00B51@fb.com> Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On 11/8/18 11:49 AM, Song Liu wrote: > Could you please point me to more information about the use cases you worry > about? I am more than happy to optimize the logic for those use cases. bpf load and unload as just another tracepoint to throw into a set of events that are monitored. As mentioned before auditing the loads and unloads is one example. And that brings up another comment: Why are you adding a PERF_RECORD_* rather than a tracepoint? From what I can see the PERF_RECORD_BPF_EVENT definition does not include the who is loading / unloading a bpf program. That is important information as well.