drzaeus77

5 ms·

1.
by drzaeus77 9y ago
The function call infra being added doesn't change the current DAG restrictions, meaning that the functions are verified using a whole-program analysis semantic, so it may end up working more as just a code organization tool than somet
2.
by drzaeus77 9y ago
The helpers are in http://elixir.free-electrons.com/linux/v4.15-rc3/source/kern... . See the field gpl_only. For the list of which helpers are available in which hooks, the code needs to be read, to find thing
3.
by drzaeus77 9y ago
The first BPF programs (original tcpdump use case) were always proprietary-compatible. If you think about it, there is nothing linux-specific about networking, and any code the user writes to tweak the data that is traversing their machine
4.
by drzaeus77 9y ago
That's right, although work is being done to improve the situation. The first is the ability to have function calls: https://patchwork.ozlabs.org/cover/848824/ . This won't allow loops, but will allow for
5.
by drzaeus77 11y ago
Hopefully you don't have to wait! We're really hoping that this set of tools has only the minimal requirements, that being the kernel. Since Clang/LLVM can be linked as a static or dynamic library, we only have a build-time d
6.
by drzaeus77 11y ago
Exactly, it is using bpf_probe_read. Internally, BCC uses clang's Rewriter functionality to mangle valid C (but invalid BPF) into valid C with bpf helper functions. The req->rq_disk->disk_name expression would expand into: ({ typ
7.
by drzaeus77 11y ago
Author of BCC here... I hadn't seen shark before, but the mindset does appear similar. A couple comparison points I noticed while briefly investigating shark: C code is passed to clang+llc as external calls, whereas in BCC clang+llvm a