On Tue, Jun 14, 2016 at 1:06 PM, Richard Henderson <r...@redhat.com> wrote:
> I'm pleased to be able to announce an initial implementation of an (e)bpf
> backend for systemtap. For the subset of systemtap probes that can use
> kprobes, we can use a bpf filter instead of loading a kernel module.
>
> As this implementation is young, there are a number of limitations. Neither
> string nor stats types are supported. Both require enhancements to the set
> of builtin functions supported in kernel. The stap bpf loader still needs
> improvement with respect to its use of the event subsystem.
>
> We're using the same intermediate file format that is supported by the llvm
> bpf backend. I have some improvements to submit for the llvm bpf backend as
> well.
>
> The code can be reviewed at
>
> git://sourceware.org/git/systemtap.git rth/bpf
Great! Is there a hello world example in there somewhere? I found this:
# ./stapbpf/stapbpf -h
Usage: ./stapbpf/stapbpf [-v][-w][-V][-h] [-o FILE] <bpf-file>
-h, --help Show this help text
-v, --verbose Increase verbosity
-V, --version Show version
-w Suppress warnings
-o FILE Send output to FILE
But I didn't see an explicit BPF example or bpf-file. Is it implicit?
Should I be able to run a stap one-liner with some -v's and see it
switches to using BPF, if I restrain myself to what's supported so
far? Eg, since you mentioned kprobes, how about?:
stap -ve 'probe kprobe.function("vfs_fsync") { println(pointer_arg(2)) }'
Brendan
