linux-kernel - Re: [PATCH v1 0/2] Add procfs based memory and network tool events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAP-5=fW0QQj08_S+nn5+kos1mzMbeNg9EBeKPKm03Gfqj80v+A@mail.gmail.com>
Date: Mon, 12 Jan 2026 10:08:20 -0800
From: Ian Rogers <irogers@...gle.com>
To: Andi Kleen <ak@...ux.intel.com>
Cc: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, 
	Arnaldo Carvalho de Melo <acme@...nel.org>, Namhyung Kim <namhyung@...nel.org>, Jiri Olsa <jolsa@...nel.org>, 
	Adrian Hunter <adrian.hunter@...el.com>, James Clark <james.clark@...aro.org>, 
	Thomas Falcon <thomas.falcon@...el.com>, Thomas Richter <tmricht@...ux.ibm.com>, 
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 0/2] Add procfs based memory and network tool events

On Mon, Jan 12, 2026 at 8:51 AM Andi Kleen <ak@...ux.intel.com> wrote:
>
> Ian Rogers <irogers@...gle.com> writes:
>
> > Add events for memory use and network activity based on data readily
> > available in /prod/pid/statm, /proc/pid/smaps_rollup and
> > /proc/pid/net/dev. For example the network usage of chrome processes
> > on a system may be gathered with:
> > ```
> > $ perf stat -e
> > net_rx_bytes,net_rx_compressed,net_rx_drop,net_rx_errors,net_rx_fifo,net_rx_frame,net_rx_multicast,net_rx_packets,net_tx_bytes,net_tx_carrier,net_tx_colls,net_tx_compressed,net_tx_drop,net_tx_errors,net_tx_fifo,net_tx_packets
> > -p $(pidof -d, chrome) -I 1000
>
> But AFAIK that's for the complete network name space, not just the
> process, thus highly misleading in perf context because the scope
> is incompatible.

Yeah, we can point this out in the event descriptions or just not have
the events and try to do some per process BPF type thing. Given we
don't have the BPF thing it is still tempting to have these counters
as-is for the system-wide case.

Thanks,
Ian