Re: [PATCH v6 perf, bpf-next 1/7] perf, bpf: Introduce PERF_RECORD_KSYMBOL

On Jan 10, 2019, at 11:30 AM, Song Liu [off-list ref] wrote:

quoted

On Jan 10, 2019, at 10:55 AM, Arnaldo Carvalho de Melo [off-list ref] wrote:

Em Thu, Jan 10, 2019 at 06:40:37PM +0000, Song Liu escreveu:

quoted

quoted

On Jan 10, 2019, at 10:24 AM, Arnaldo Carvalho de Melo [off-list ref] wrote:

Em Wed, Jan 09, 2019 at 11:21:05AM -0800, Song Liu escreveu:

quoted

For better performance analysis of dynamically JITed and loaded kernel
functions, such as BPF programs, this patch introduces
PERF_RECORD_KSYMBOL, a new perf_event_type that exposes kernel symbol
register/unregister information to user space.

The following data structure is used for PERF_RECORD_KSYMBOL.

 /*
  * struct {
  *      struct perf_event_header        header;
  *      u64                             addr;
  *      u32                             len;
  *      u16                             ksym_type;
  *      u16                             flags;
  *      char                            name[];
  *      struct sample_id                sample_id;
  * };
  */

So, I couldn't find where this gets used, the intention here is just to
add the interfaces and afterwards is that you will wire this up? I would
like to test the whole shebang to see it working.

I guess you meant PERF_RECORD_BPF_EVENT not being used? 

PERF_RECORD_KSYMBOL is used by BPF in 3/7 and 5/7. I tested 

Oops, I didn't look at 3/7, just read its cset summary line and as it
says:

Subject: [PATCH v6 perf, bpf-next 3/7] perf, bpf: introduce PERF_RECORD_BPF_EVENT

I didn't thought it was related, perhaps break it down into one that
states that it is wiring up PERF_RECORD_KSYMBOL, and at that point we
could just test it, getting the notifications for new kallsyms related
to BPF?

Good idea! I will split it into two patches as:

[3/8] perf, bpf: generate PERF_RECORD_KSYMBOL for BPF program 
[4/8] perf, bpf: introduce PERF_RECORD_BPF_EVENT

quoted

quoted

PERF_RECORD_BPF_EVENT with dump_trace. As we separate RECORD_KSYMBOL from
RECORD_BPF_EVENT, user space won't use BPF_EVENT until annotation support.  

Right, so why not just introduce PERF_RECORD_KSYMBOL, make it be used by
tooling, etc, then move on to PERF_RECORD_BPF_EVENT?

I'd like to make sure we all agree on the new ABI for RECORD_KSYMBOL and 
RECORD_BPF_EVENT. Multiple user space tools dependent on RECORD_BPF_EVENT,
for example, bcc and auditing. Finalizing RECORD_BPF_EVENT will unblock the 
development of these tools. On perf side, it will take us quite some time 
to finish annotation. Ideally, I don't want to block the development of 
other tools for so long. 

Thanks,
Song

+ DavidA

Hi David, 

Could you please share your feedback on PERF_RECORD_BPF_EVENT for auditing
use cases?

Thanks,
Song