On Wed, Feb 04, 2026 at 11:04:09AM -0800, Andrii Nakryiko wrote:
> On Tue, Feb 3, 2026 at 1:39 AM Jiri Olsa <[email protected]> wrote:
> >
> > Adding btf__find_by_glob_kind function that returns array of
> > BTF ids that match given kind and allow/deny patterns.
> >
> > int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > const char *allow_pattern,
> > const char *deny_pattern,
> > __u32 **__ids);
> >
> > The __ids array is allocated and needs to be manually freed.
> >
> > The pattern check is done by glob_match function.
> >
> > Signed-off-by: Jiri Olsa <[email protected]>
> > ---
> > tools/lib/bpf/btf.c | 41 +++++++++++++++++++++++++++++++++++++++++
> > tools/lib/bpf/btf.h | 3 +++
> > 2 files changed, 44 insertions(+)
> >
> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > index 83fe79ffcb8f..64502b3ef38a 100644
> > --- a/tools/lib/bpf/btf.c
> > +++ b/tools/lib/bpf/btf.c
> > @@ -1010,6 +1010,47 @@ __s32 btf__find_by_name_kind(const struct btf *btf,
> > const char *type_name,
> > return btf_find_by_name_kind(btf, 1, type_name, kind);
> > }
> >
> > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > + const char *allow_pattern, const char
> > *deny_pattern,
> > + __u32 **__ids)
> > +{
> > + __u32 i, nr_types = btf__type_cnt(btf);
> > + int cnt = 0, alloc = 0;
> > + __u32 *ids = NULL;
> > +
> > + for (i = 1; i < nr_types; i++) {
> > + const struct btf_type *t = btf__type_by_id(btf, i);
> > + const char *name;
> > + __u32 *p;
> > +
> > + if (btf_kind(t) != kind)
> > + continue;
> > + name = btf__name_by_offset(btf, t->name_off);
> > + if (!name)
> > + continue;
> > +
> > + if (deny_pattern && glob_match(name, deny_pattern))
> > + continue;
> > + if (allow_pattern && !glob_match(name, allow_pattern))
> > + continue;
> > +
> > + if (cnt == alloc) {
> > + alloc = max(16, alloc * 3 / 2);
> > + p = libbpf_reallocarray(ids, alloc, sizeof(__u32));
> > + if (!p) {
> > + free(ids);
> > + return -ENOMEM;
> > + }
> > + ids = p;
> > + }
> > + ids[cnt] = i;
> > + cnt++;
> > + }
> > +
> > + *__ids = ids;
> > + return cnt;
> > +}
> > +
> > static bool btf_is_modifiable(const struct btf *btf)
> > {
> > return (void *)btf->hdr != btf->raw_data;
> > diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
> > index b30008c267c0..d7b47bb0ba99 100644
> > --- a/tools/lib/bpf/btf.h
> > +++ b/tools/lib/bpf/btf.h
> > @@ -661,6 +661,9 @@ static inline struct btf_decl_tag *btf_decl_tag(const
> > struct btf_type *t)
> > return (struct btf_decl_tag *)(t + 1);
> > }
> >
> > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > + const char *allow_pattern, const char
> > *deny_pattern,
> > + __u32 **__ids);
>
>
> as AI pointed out, this should be an internal helper, no? Let's also
> not use double underscore pattern here,
> "collect_btf_ids_by_glob_kind()" perhaps?
ok
>
> Also, you don't seem to be using deny_pattern, where you planning to?
the tests are just rudimentary before we agree we want to do it this way
but I'm not sure I have a usecase for deny_pattern.. I think we added it
just to be complete, I recall we copied that function from somewhere,
it's long time ago ;-)
>
> Also, are there functions that we'll have BTF for, but they won't be
> attachable? What if I do SEC("fentry.multi/*")? Will it attach or fail
> to attach some functions (and thus fail the overall attachment)?
yes, for the benchmark tests I had to add is_allowed_func which mimics
btf_distill_func_proto and denies attach for some functions
also I had to filter out some core kernel functions like rcu*,trace*,..
which seemed to cause trouble when you attach them
jirka
