This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: BPF runtime for systemtap
- From: Brendan Gregg <brendan dot d dot gregg at gmail dot com>
- To: Richard Henderson <rth at redhat dot com>
- Cc: systemtap at sourceware dot org, iovisor-dev at lists dot iovisor dot org, Linux Kernel Mailing List <linux-kernel at vger dot kernel dot org>
- Date: Tue, 14 Jun 2016 16:53:58 -0700
- Subject: Re: BPF runtime for systemtap
- Authentication-results: sourceware.org; auth=none
- References: <72b69807-4cd7-afab-0acd-51af8c76469e at redhat dot com>
On Tue, Jun 14, 2016 at 1:06 PM, Richard Henderson <rth@redhat.com> wrote:
> I'm pleased to be able to announce an initial implementation of an (e)bpf
> backend for systemtap. For the subset of systemtap probes that can use
> kprobes, we can use a bpf filter instead of loading a kernel module.
>
> As this implementation is young, there are a number of limitations. Neither
> string nor stats types are supported. Both require enhancements to the set
> of builtin functions supported in kernel. The stap bpf loader still needs
> improvement with respect to its use of the event subsystem.
>
> We're using the same intermediate file format that is supported by the llvm
> bpf backend. I have some improvements to submit for the llvm bpf backend as
> well.
>
> The code can be reviewed at
>
> git://sourceware.org/git/systemtap.git rth/bpf
Great! Is there a hello world example in there somewhere? I found this:
# ./stapbpf/stapbpf -h
Usage: ./stapbpf/stapbpf [-v][-w][-V][-h] [-o FILE] <bpf-file>
-h, --help Show this help text
-v, --verbose Increase verbosity
-V, --version Show version
-w Suppress warnings
-o FILE Send output to FILE
But I didn't see an explicit BPF example or bpf-file. Is it implicit?
Should I be able to run a stap one-liner with some -v's and see it
switches to using BPF, if I restrain myself to what's supported so
far? Eg, since you mentioned kprobes, how about?:
stap -ve 'probe kprobe.function("vfs_fsync") { println(pointer_arg(2)) }'
Brendan