On Fri, Jul 7, 2023 at 9:08 PM Leon Hwang <hffilwlqm@xxxxxxxxx> wrote: > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h > index 34fa334938ba5..8a458cfcd91bd 100644 > --- a/include/uapi/linux/bpf.h > +++ b/include/uapi/linux/bpf.h > @@ -1549,7 +1549,6 @@ union bpf_attr { > }; > __u32 attach_type; /* attach type */ > __u32 flags; /* extra flags */ > - struct bpf_generic_user_log log; /* user log */ > union { > __u32 target_btf_id; /* btf_id of target to attach to */ > struct { > @@ -1585,6 +1584,9 @@ union bpf_attr { > __s32 priority; > __u32 flags; > } netfilter; > + struct { > + struct bpf_generic_user_log ulog; /* user log */ > + } xdp; 1. You cannot break api in patch 1 and fix it in patch 2. 2. libbpf side is missing. 3. selftest is missing. 4. bpf_vlog_finalize() should be used and error propagated back through link_create. Same api must be used: log_level, log_size, log_buf, log_true_size. But considering all that I agree with Daniel Xu that tracepoint would be better here.