Messages in this thread | | | From | Song Liu <> | Subject | Re: [PATCH v6 perf, bpf-next 1/7] perf, bpf: Introduce PERF_RECORD_KSYMBOL | Date | Thu, 10 Jan 2019 19:45:09 +0000 |
| |
> On Jan 10, 2019, at 11:30 AM, Song Liu <songliubraving@fb.com> wrote: > > > >> On Jan 10, 2019, at 10:55 AM, Arnaldo Carvalho de Melo <acme@kernel.org> wrote: >> >> Em Thu, Jan 10, 2019 at 06:40:37PM +0000, Song Liu escreveu: >>> >>> >>>> On Jan 10, 2019, at 10:24 AM, Arnaldo Carvalho de Melo <acme@kernel.org> wrote: >>>> >>>> Em Wed, Jan 09, 2019 at 11:21:05AM -0800, Song Liu escreveu: >>>>> For better performance analysis of dynamically JITed and loaded kernel >>>>> functions, such as BPF programs, this patch introduces >>>>> PERF_RECORD_KSYMBOL, a new perf_event_type that exposes kernel symbol >>>>> register/unregister information to user space. >>>>> >>>>> The following data structure is used for PERF_RECORD_KSYMBOL. >>>>> >>>>> /* >>>>> * struct { >>>>> * struct perf_event_header header; >>>>> * u64 addr; >>>>> * u32 len; >>>>> * u16 ksym_type; >>>>> * u16 flags; >>>>> * char name[]; >>>>> * struct sample_id sample_id; >>>>> * }; >>>>> */ >>>> >>>> So, I couldn't find where this gets used, the intention here is just to >>>> add the interfaces and afterwards is that you will wire this up? I would >>>> like to test the whole shebang to see it working. >>> >>> I guess you meant PERF_RECORD_BPF_EVENT not being used? >>> >>> PERF_RECORD_KSYMBOL is used by BPF in 3/7 and 5/7. I tested >> >> Oops, I didn't look at 3/7, just read its cset summary line and as it >> says: >> >> Subject: [PATCH v6 perf, bpf-next 3/7] perf, bpf: introduce PERF_RECORD_BPF_EVENT >> >> I didn't thought it was related, perhaps break it down into one that >> states that it is wiring up PERF_RECORD_KSYMBOL, and at that point we >> could just test it, getting the notifications for new kallsyms related >> to BPF? > > Good idea! I will split it into two patches as: > > [3/8] perf, bpf: generate PERF_RECORD_KSYMBOL for BPF program > [4/8] perf, bpf: introduce PERF_RECORD_BPF_EVENT > >> >>> PERF_RECORD_BPF_EVENT with dump_trace. As we separate RECORD_KSYMBOL from >>> RECORD_BPF_EVENT, user space won't use BPF_EVENT until annotation support. >> >> Right, so why not just introduce PERF_RECORD_KSYMBOL, make it be used by >> tooling, etc, then move on to PERF_RECORD_BPF_EVENT? > > I'd like to make sure we all agree on the new ABI for RECORD_KSYMBOL and > RECORD_BPF_EVENT. Multiple user space tools dependent on RECORD_BPF_EVENT, > for example, bcc and auditing. Finalizing RECORD_BPF_EVENT will unblock the > development of these tools. On perf side, it will take us quite some time > to finish annotation. Ideally, I don't want to block the development of > other tools for so long. > > Thanks, > Song
+ DavidA
Hi David,
Could you please share your feedback on PERF_RECORD_BPF_EVENT for auditing use cases?
Thanks, Song
| |