linux-kernel - Re: [RFC PATCH v3 00/37] perf tools: introduce 'perf bpf' command to load eBPF programs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <555A3FC2.8060805@plumgrid.com>
Date:	Mon, 18 May 2015 12:38:42 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	Wang Nan <wangnan0@...wei.com>, paulus@...ba.org,
	a.p.zijlstra@...llo.nl, mingo@...hat.com, acme@...nel.org,
	namhyung@...nel.org, jolsa@...nel.org, dsahern@...il.com,
	daniel@...earbox.net, brendan.d.gregg@...il.com,
	masami.hiramatsu.pt@...achi.com
CC:	lizefan@...wei.com, linux-kernel@...r.kernel.org, pi3orama@....com
Subject: Re: [RFC PATCH v3 00/37] perf tools: introduce 'perf bpf' command
 to load eBPF programs.

On 5/17/15 3:56 AM, Wang Nan wrote:
> This is the 3rd version of 'perf bpf' patch series, based on
> v4.1-rc3.
>
> The goal of this series of patches is to integrate eBPF with perf.
> After applying these patches, users are allowed to use following
> command to load eBPF program compiled by LLVM into kernel then start
> recording with filters on:
>
>   # perf bpf record --object sample_bpf.o -- -a sleep 4

I think using programs are sophisticated filters is a good start
and are useful already. Let's focus on that at the moment.
I wouldn't grow the patchset any bigger.

> Other than the previous change, v3 patch series drops the '|' event
> syntax introduced in v2, because I realized that in v2 users are
> allowed to pass any bpf fd by using it, like:
>
>   # perf bpf record -- -e sched:sched_switch|100| sleep 1
>
> which may become trouble maker.

passing fd number as a string is an odd interface anyway.
So I think that was the right call. We can improve it later.

>   Are we actually need a 'perf bpf' command? We can get similar result by
>   modifying 'perf record' to make it load eBPF program before recording.
>
>   I suggest to keep 'perf bpf', group all eBPF stuffs together using a
>   uniform entry. Also, eBPF programs can act not only as filters but also
>   data aggregator. It is possible to make something link 'perf bpf run'
>   to simply make it run, and dump result after user hit 'C-c' or timeout.

Though it's tempting to group under 'perf bpf'. I think it's cleaner to
add --object flag to 'perf record'
Since it will avoid unnecessary '--'.
Unless we can drop it? Like
perf bpf record --object sample_bpf.o -a sleep 4
should work?
If not, then the following is better:
perf record --object sample_bpf.o -a sleep 4

Thank you for the hard work!

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/