Re: [RFC PATCH v8 00/49] perf tools: filtering events using eBPF programs

From: Alexei Starovoitov
Date: Fri Jun 26 2015 - 04:38:23 EST


On 6/24/15 5:31 AM, Wang Nan wrote:
The core stuffs in this series resides in 38/49 - 49/49, which allow
users to access kernel data through parameters of eBPF programs. Now
it is possible to write eBPF programs like this:

SEC("get_superblock=journal_get_superblock journal->j_errno")
int get_superblock(struct pt_regs *ctx, int err, int j_errno)
{
char fmt[] = "j_errno=%lx\n";
bpf_trace_printk(fmt, sizeof(fmt), j_errno);
if (j_errno)
return 1;
return 0;
}

Where, 'j_errno' in that function will be dereferenced according to
dwarf information by prologue generated by perf. 'err' indicates the
successfulness of the dereferencing.

Looks great. Very useful addition.

In addition, this series of patches supports setting BPF program to
multiple probing points and generate different prologue for all of them
if necessary. Using glob matching is also allowed. In the above
example, there will be two journal_get_superblock() functions in kernel
if we compile both jbd and jbd2. That BPF function tracks both of them.

Sounds ok, but what is the real use case for it?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/