On Mon, Mar 21, 2022 at 4:24 PM Andrii Nakryiko <andrii.nakryiko@xxxxxxxxx> wrote: > > I remember I brought this up earlier, but I forgot the outcome. What > if don't touch BPF_RAW_TRACEPOINT_OPEN and instead allow to create all > the same links through more universal BPF_LINK_CREATE command. And > only there we add bpf_cookie? There are few advantages: > > 1. We can separate raw_tracepoint and trampoline-based programs more > cleanly in UAPI (it will be two separate structs: link_create.raw_tp > with raw tracepoint name vs link_create.trampoline, or whatever the > name, with cookie and stuff). Remember that raw_tp won't support > bpf_cookie for now, so it would be another advantage not to promise > cookie in UAPI. What would it look like? Technically link_create has prog_fd and perf_event.bpf_cookie already. case BPF_PROG_TYPE_TRACING: ret = tracing_bpf_link_attach(attr, uattr, prog); would just gain a few more checks for prog->expected_attach_type ? Then link_create cmd will be equivalent to raw_tp_open. With and without bpf_cookie. ?