Re: [PATCH perf,bpf 0/5] reveal invisible bpf programs

[Arnaldo Carvalho de Melo]

Em Mon, Nov 26, 2018 at 03:50:04PM +0100, Peter Zijlstra escreveu:
> Now, I'm not saying this patch set is useless; but I'm saying most
> people should not need this, and it is massive overkill for the needs of
> most people.

So, the comparision is sort of with kernel modules, that can come and go
while you're profiling/tracing, if that happens, then samples, in post
processing, are not resolvable, and that is the case for kernel modules
right now. Sure, you're right, that doesn't happen so frequently, so
nobody hollered (thankfully that is now verbotten ;-)) at us so far.

You need to have the load-kernel-bin/unload-kernel-bin events recorded,
and you need to somehow match those addresses to some symtab/src(for
people that want to have src mixed up with assembly) and you need that
jitted code, with timestamps of when it was loaded and it was unloaded.

People doing post processing analysis of weird problems need all those
details.

Now I don't know how frequently those binary blobs gets loaded/unloaded
in the brave new world of eBPF, but for completeness sake, we need those
load/unload events and we need to grab a copy of the raw jitted binary,
etc.

- Arnaldo