On 6/24/15 5:31 AM, Wang Nan wrote:
The core stuffs in this series resides in 38/49 - 49/49, which allow users to access kernel data through parameters of eBPF programs. Now it is possible to write eBPF programs like this:SEC("get_superblock=journal_get_superblock journal->j_errno") int get_superblock(struct pt_regs *ctx, int err, int j_errno) { char fmt[] = "j_errno=%lx\n"; bpf_trace_printk(fmt, sizeof(fmt), j_errno); if (j_errno) return 1; return 0; } Where, 'j_errno' in that function will be dereferenced according to dwarf information by prologue generated by perf. 'err' indicates the successfulness of the dereferencing.
Looks great. Very useful addition.
In addition, this series of patches supports setting BPF program to multiple probing points and generate different prologue for all of them if necessary. Using glob matching is also allowed. In the above example, there will be two journal_get_superblock() functions in kernel if we compile both jbd and jbd2. That BPF function tracks both of them.
Sounds ok, but what is the real use case for it? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
