On Thu, Feb 05, 2026 at 02:45:14PM -0800, Andrii Nakryiko wrote:
> On Thu, Feb 5, 2026 at 12:57 AM Jiri Olsa <[email protected]> wrote:
> >
> > On Wed, Feb 04, 2026 at 11:04:09AM -0800, Andrii Nakryiko wrote:
> > > On Tue, Feb 3, 2026 at 1:39 AM Jiri Olsa <[email protected]> wrote:
> > > >
> > > > Adding btf__find_by_glob_kind function that returns array of
> > > > BTF ids that match given kind and allow/deny patterns.
> > > >
> > > > int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > > const char *allow_pattern,
> > > > const char *deny_pattern,
> > > > __u32 **__ids);
> > > >
> > > > The __ids array is allocated and needs to be manually freed.
> > > >
> > > > The pattern check is done by glob_match function.
> > > >
> > > > Signed-off-by: Jiri Olsa <[email protected]>
> > > > ---
> > > > tools/lib/bpf/btf.c | 41 +++++++++++++++++++++++++++++++++++++++++
> > > > tools/lib/bpf/btf.h | 3 +++
> > > > 2 files changed, 44 insertions(+)
> > > >
> > > > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > > > index 83fe79ffcb8f..64502b3ef38a 100644
> > > > --- a/tools/lib/bpf/btf.c
> > > > +++ b/tools/lib/bpf/btf.c
> > > > @@ -1010,6 +1010,47 @@ __s32 btf__find_by_name_kind(const struct btf
> > > > *btf, const char *type_name,
> > > > return btf_find_by_name_kind(btf, 1, type_name, kind);
> > > > }
> > > >
> > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > > + const char *allow_pattern, const char
> > > > *deny_pattern,
> > > > + __u32 **__ids)
> > > > +{
> > > > + __u32 i, nr_types = btf__type_cnt(btf);
> > > > + int cnt = 0, alloc = 0;
> > > > + __u32 *ids = NULL;
> > > > +
> > > > + for (i = 1; i < nr_types; i++) {
> > > > + const struct btf_type *t = btf__type_by_id(btf, i);
> > > > + const char *name;
> > > > + __u32 *p;
> > > > +
> > > > + if (btf_kind(t) != kind)
> > > > + continue;
> > > > + name = btf__name_by_offset(btf, t->name_off);
> > > > + if (!name)
> > > > + continue;
> > > > +
> > > > + if (deny_pattern && glob_match(name, deny_pattern))
> > > > + continue;
> > > > + if (allow_pattern && !glob_match(name, allow_pattern))
> > > > + continue;
> > > > +
> > > > + if (cnt == alloc) {
> > > > + alloc = max(16, alloc * 3 / 2);
> > > > + p = libbpf_reallocarray(ids, alloc,
> > > > sizeof(__u32));
> > > > + if (!p) {
> > > > + free(ids);
> > > > + return -ENOMEM;
> > > > + }
> > > > + ids = p;
> > > > + }
> > > > + ids[cnt] = i;
> > > > + cnt++;
> > > > + }
> > > > +
> > > > + *__ids = ids;
> > > > + return cnt;
> > > > +}
> > > > +
> > > > static bool btf_is_modifiable(const struct btf *btf)
> > > > {
> > > > return (void *)btf->hdr != btf->raw_data;
> > > > diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
> > > > index b30008c267c0..d7b47bb0ba99 100644
> > > > --- a/tools/lib/bpf/btf.h
> > > > +++ b/tools/lib/bpf/btf.h
> > > > @@ -661,6 +661,9 @@ static inline struct btf_decl_tag
> > > > *btf_decl_tag(const struct btf_type *t)
> > > > return (struct btf_decl_tag *)(t + 1);
> > > > }
> > > >
> > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > > + const char *allow_pattern, const char
> > > > *deny_pattern,
> > > > + __u32 **__ids);
> > >
> > >
> > > as AI pointed out, this should be an internal helper, no? Let's also
> > > not use double underscore pattern here,
> > > "collect_btf_ids_by_glob_kind()" perhaps?
> >
> > ok
> >
> > >
> > > Also, you don't seem to be using deny_pattern, where you planning to?
> >
> > the tests are just rudimentary before we agree we want to do it this way
> >
> > but I'm not sure I have a usecase for deny_pattern.. I think we added it
> > just to be complete, I recall we copied that function from somewhere,
> > it's long time ago ;-)
> >
> > >
> > > Also, are there functions that we'll have BTF for, but they won't be
> > > attachable? What if I do SEC("fentry.multi/*")? Will it attach or fail
> > > to attach some functions (and thus fail the overall attachment)?
> >
> > yes, for the benchmark tests I had to add is_allowed_func which mimics
> > btf_distill_func_proto and denies attach for some functions
> >
> > also I had to filter out some core kernel functions like rcu*,trace*,..
> > which seemed to cause trouble when you attach them
>
> So the question I'm implying here is if libbpf should do what we do
> for kprobes: use libbpf_available_kprobes_parse and intersect?
right, I think it's good idea.. and in addition (just for patterns) we would
filter out functions that:
- won't attach (is_allowed_func == false)
- might cause problems (rcu*,trace*), maybe for that we could have
opts config bool
jirka
