On Thu, Aug 14, 2014 at 3:28 PM, Brendan Gregg <brendan.d.gregg@xxxxxxxxx> wrote: > On Wed, Aug 13, 2014 at 12:57 AM, Alexei Starovoitov <ast@xxxxxxxxxxxx> wrote: > [...] >> maps can have different types: hash, bloom filter, radix-tree, etc. >> >> The map is defined by: >> . type >> . max number of elements >> . key size in bytes >> . value size in bytes > > Can values be strings or byte arrays? How would user-level bpf read > them? The two types of uses I'm thinking are: > > A. Constructing a custom string in kernel-context, and using that as > the value. Eg, a truncated filename, or a dotted quad IP address, or > the raw contents of a packet. > B. I have a pointer to an existing buffer or string, eg a filename, > that will likely be around for some time (>1s). Instead of the value > storing the string, it could just be a ptr, so long as user-level bpf > has a way to read it. > > Also, can keys be strings? I'd ask about multiple keys, but if they > can be a string, I can delimit in the key (eg, "PID:filename"). Both map keys and values are opaque byte arrays. eBPF program can decide to store strings in there. Or concatenate multiple strings as long as sizes are bounded. High level scripting languages are dazzling with native strings support, but I'm trying to stay away from it in the kernel. Scripting languages should be able to convert string operations into low level eBPF primitives which are being worked on. So far I've been able to use ids and pointers and concatenations of binary things as keys and values, and have user space interpret them. I agree that having a script that does map[probe_name()]++ is definitely more human readable than storing probe ip into ebpf map and converting addresses to names in userspace. I'm hoping that the urge to make cool scripting language will push somebody to have a dtrace/ktap/stap language compiler into eBPF :) That will also address your concern of embedded setup where full llvm is too big, but dtrace_into_ebpf compiler may be just right. At the same time people who care about last bit of performance will be using C and llvm or ebpf assembler directly. Anyway will share string related ebpf helpers soon (not in V5 though) -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
