Re: [RFC PATCH v8 00/49] perf tools: filtering events using eBPF programs

[Alexei Starovoitov <ast@plumgrid.com>]

On 6/24/15 5:31 AM, Wang Nan wrote:
> The core stuffs in this series resides in 38/49 - 49/49, which allow
> users to access kernel data through parameters of eBPF programs. Now
> it is possible to write eBPF programs like this:
>
>   SEC("get_superblock=journal_get_superblock journal->j_errno")
>   int get_superblock(struct pt_regs *ctx, int err, int j_errno)
>   {
>           char fmt[] = "j_errno=%lx\n";
>           bpf_trace_printk(fmt, sizeof(fmt), j_errno);
> 	 if (j_errno)
>                   return 1;
> 	 return 0;
>   }
>
> Where, 'j_errno' in that function will be dereferenced according to
> dwarf information by prologue generated by perf. 'err' indicates the
> successfulness of the dereferencing.

Looks great. Very useful addition.

> In addition, this series of patches supports setting BPF program to
> multiple probing points and generate different prologue for all of them
> if necessary. Using glob matching is also allowed. In the above
> example, there will be two journal_get_superblock() functions in kernel
> if we compile both jbd and jbd2. That BPF function tracks both of them.

Sounds ok, but what is the real use case for it?