On Fri, Feb 6, 2026 at 12:43 AM Jiri Olsa <[email protected]> wrote: > > On Thu, Feb 05, 2026 at 02:45:14PM -0800, Andrii Nakryiko wrote: > > On Thu, Feb 5, 2026 at 12:57 AM Jiri Olsa <[email protected]> wrote: > > > > > > On Wed, Feb 04, 2026 at 11:04:09AM -0800, Andrii Nakryiko wrote: > > > > On Tue, Feb 3, 2026 at 1:39 AM Jiri Olsa <[email protected]> wrote: > > > > > > > > > > Adding btf__find_by_glob_kind function that returns array of > > > > > BTF ids that match given kind and allow/deny patterns. > > > > > > > > > > int btf__find_by_glob_kind(const struct btf *btf, __u32 kind, > > > > > const char *allow_pattern, > > > > > const char *deny_pattern, > > > > > __u32 **__ids); > > > > > > > > > > The __ids array is allocated and needs to be manually freed. > > > > > > > > > > The pattern check is done by glob_match function. > > > > > > > > > > Signed-off-by: Jiri Olsa <[email protected]> > > > > > --- > > > > > tools/lib/bpf/btf.c | 41 +++++++++++++++++++++++++++++++++++++++++ > > > > > tools/lib/bpf/btf.h | 3 +++ > > > > > 2 files changed, 44 insertions(+) > > > > > > > > > > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c > > > > > index 83fe79ffcb8f..64502b3ef38a 100644 > > > > > --- a/tools/lib/bpf/btf.c > > > > > +++ b/tools/lib/bpf/btf.c > > > > > @@ -1010,6 +1010,47 @@ __s32 btf__find_by_name_kind(const struct btf > > > > > *btf, const char *type_name, > > > > > return btf_find_by_name_kind(btf, 1, type_name, kind); > > > > > } > > > > > > > > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind, > > > > > + const char *allow_pattern, const char > > > > > *deny_pattern, > > > > > + __u32 **__ids) > > > > > +{ > > > > > + __u32 i, nr_types = btf__type_cnt(btf); > > > > > + int cnt = 0, alloc = 0; > > > > > + __u32 *ids = NULL; > > > > > + > > > > > + for (i = 1; i < nr_types; i++) { > > > > > + const struct btf_type *t = btf__type_by_id(btf, i); > > > > > + const char *name; > > > > > + __u32 *p; > > > > > + > > > > > + if (btf_kind(t) != kind) > > > > > + continue; > > > > > + name = btf__name_by_offset(btf, t->name_off); > > > > > + if (!name) > > > > > + continue; > > > > > + > > > > > + if (deny_pattern && glob_match(name, deny_pattern)) > > > > > + continue; > > > > > + if (allow_pattern && !glob_match(name, allow_pattern)) > > > > > + continue; > > > > > + > > > > > + if (cnt == alloc) { > > > > > + alloc = max(16, alloc * 3 / 2); > > > > > + p = libbpf_reallocarray(ids, alloc, > > > > > sizeof(__u32)); > > > > > + if (!p) { > > > > > + free(ids); > > > > > + return -ENOMEM; > > > > > + } > > > > > + ids = p; > > > > > + } > > > > > + ids[cnt] = i; > > > > > + cnt++; > > > > > + } > > > > > + > > > > > + *__ids = ids; > > > > > + return cnt; > > > > > +} > > > > > + > > > > > static bool btf_is_modifiable(const struct btf *btf) > > > > > { > > > > > return (void *)btf->hdr != btf->raw_data; > > > > > diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h > > > > > index b30008c267c0..d7b47bb0ba99 100644 > > > > > --- a/tools/lib/bpf/btf.h > > > > > +++ b/tools/lib/bpf/btf.h > > > > > @@ -661,6 +661,9 @@ static inline struct btf_decl_tag > > > > > *btf_decl_tag(const struct btf_type *t) > > > > > return (struct btf_decl_tag *)(t + 1); > > > > > } > > > > > > > > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind, > > > > > + const char *allow_pattern, const char > > > > > *deny_pattern, > > > > > + __u32 **__ids); > > > > > > > > > > > > as AI pointed out, this should be an internal helper, no? Let's also > > > > not use double underscore pattern here, > > > > "collect_btf_ids_by_glob_kind()" perhaps? > > > > > > ok > > > > > > > > > > > Also, you don't seem to be using deny_pattern, where you planning to? > > > > > > the tests are just rudimentary before we agree we want to do it this way > > > > > > but I'm not sure I have a usecase for deny_pattern.. I think we added it > > > just to be complete, I recall we copied that function from somewhere, > > > it's long time ago ;-) > > > > > > > > > > > Also, are there functions that we'll have BTF for, but they won't be > > > > attachable? What if I do SEC("fentry.multi/*")? Will it attach or fail > > > > to attach some functions (and thus fail the overall attachment)? > > > > > > yes, for the benchmark tests I had to add is_allowed_func which mimics > > > btf_distill_func_proto and denies attach for some functions > > > > > > also I had to filter out some core kernel functions like rcu*,trace*,.. > > > which seemed to cause trouble when you attach them > > > > So the question I'm implying here is if libbpf should do what we do > > for kprobes: use libbpf_available_kprobes_parse and intersect? > > right, I think it's good idea.. and in addition (just for patterns) we would > filter out functions that: > > - won't attach (is_allowed_func == false) > - might cause problems (rcu*,trace*), maybe for that we could have > opts config bool
Well, who's going to maintain the "might cause problems" list in libbpf? Let's not try to be too smart. If some functions are not safe to be attached, we should mark them as such in the kernel, IMO. > > jirka
