On Tue, 5 Jan 2021, Cong Wang wrote: > On Mon, Jan 4, 2021 at 7:29 AM Alan Maguire <alan.maguire@xxxxxxxxxx> wrote: > > > > BPF Type Format (BTF) provides a description of kernel data structures > > and of the types kernel functions utilize as arguments and return values. > > > > A helper was recently added - bpf_snprintf_btf() - that uses that > > description to create a string representation of the data provided, > > using the BTF id of its type. For example to create a string > > representation of a "struct sk_buff", the pointer to the skb > > is provided along with the type id of "struct sk_buff". > > > > Here that functionality is utilized to support tracing kernel > > function entry and return using k[ret]probes. The "struct pt_regs" > > context can be used to derive arguments and return values, and > > when the user supplies a function name we > > > > - look it up in /proc/kallsyms to find its address/module > > - look it up in the BTF kernel data to get types of arguments > > and return value > > - store a map representation of the trace information, keyed by > > instruction pointer > > - on function entry/return we look up the map to retrieve the BTF > > ids of the arguments/return values and can call bpf_snprintf_btf() > > with these argument/return values along with the type ids to store > > a string representation in the map. > > - this is then sent via perf event to userspace where it can be > > displayed. > > > > ksnoop can be used to show function signatures; for example: > > This is definitely quite useful! > > Is it possible to integrate this with bpftrace? That would save people > from learning yet another tool. ;) > I'd imagine (and hope!) other tracing tools will do this, but right now the aim is to make the task of tracing kernel data structures simpler, so having a tool dedicated to just that can hopefully help those discussions. There's a bit more work to be done to simplify that task, for example implementing Alexei's suggestion to support pretty-printing of data structures using BTF in libbpf. My hope is that we can evolve this tool - or something like it - to the point where we can solve that one problem easily, and that other more general tracers can then make use of that solution. I probably should have made all of this clearer in the patch submission, sorry about that. Alan
