Re: [RFC bpf-next 08/12] libbpf: Add btf__find_by_glob_kind function

[Jiri Olsa <olsajiri@gmail.com>]

On Thu, Feb 05, 2026 at 02:45:14PM -0800, Andrii Nakryiko wrote:
> On Thu, Feb 5, 2026 at 12:57 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Wed, Feb 04, 2026 at 11:04:09AM -0800, Andrii Nakryiko wrote:
> > > On Tue, Feb 3, 2026 at 1:39 AM Jiri Olsa <jolsa@kernel.org> wrote:
> > > >
> > > > Adding btf__find_by_glob_kind function that returns array of
> > > > BTF ids that match given kind and allow/deny patterns.
> > > >
> > > > int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > >                            const char *allow_pattern,
> > > >                            const char *deny_pattern,
> > > >                            __u32 **__ids);
> > > >
> > > > The __ids array is allocated and needs to be manually freed.
> > > >
> > > > The pattern check is done by glob_match function.
> > > >
> > > > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > > > ---
> > > >  tools/lib/bpf/btf.c | 41 +++++++++++++++++++++++++++++++++++++++++
> > > >  tools/lib/bpf/btf.h |  3 +++
> > > >  2 files changed, 44 insertions(+)
> > > >
> > > > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > > > index 83fe79ffcb8f..64502b3ef38a 100644
> > > > --- a/tools/lib/bpf/btf.c
> > > > +++ b/tools/lib/bpf/btf.c
> > > > @@ -1010,6 +1010,47 @@ __s32 btf__find_by_name_kind(const struct btf *btf, const char *type_name,
> > > >         return btf_find_by_name_kind(btf, 1, type_name, kind);
> > > >  }
> > > >
> > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > > +                          const char *allow_pattern, const char *deny_pattern,
> > > > +                          __u32 **__ids)
> > > > +{
> > > > +       __u32 i, nr_types = btf__type_cnt(btf);
> > > > +       int cnt = 0, alloc = 0;
> > > > +       __u32 *ids = NULL;
> > > > +
> > > > +       for (i = 1; i < nr_types; i++) {
> > > > +               const struct btf_type *t = btf__type_by_id(btf, i);
> > > > +               const char *name;
> > > > +               __u32 *p;
> > > > +
> > > > +               if (btf_kind(t) != kind)
> > > > +                       continue;
> > > > +               name = btf__name_by_offset(btf, t->name_off);
> > > > +               if (!name)
> > > > +                       continue;
> > > > +
> > > > +               if (deny_pattern && glob_match(name, deny_pattern))
> > > > +                       continue;
> > > > +               if (allow_pattern && !glob_match(name, allow_pattern))
> > > > +                       continue;
> > > > +
> > > > +               if (cnt == alloc) {
> > > > +                       alloc = max(16, alloc * 3 / 2);
> > > > +                       p = libbpf_reallocarray(ids, alloc, sizeof(__u32));
> > > > +                       if (!p) {
> > > > +                               free(ids);
> > > > +                               return -ENOMEM;
> > > > +                       }
> > > > +                       ids = p;
> > > > +               }
> > > > +               ids[cnt] = i;
> > > > +               cnt++;
> > > > +       }
> > > > +
> > > > +       *__ids = ids;
> > > > +       return cnt;
> > > > +}
> > > > +
> > > >  static bool btf_is_modifiable(const struct btf *btf)
> > > >  {
> > > >         return (void *)btf->hdr != btf->raw_data;
> > > > diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
> > > > index b30008c267c0..d7b47bb0ba99 100644
> > > > --- a/tools/lib/bpf/btf.h
> > > > +++ b/tools/lib/bpf/btf.h
> > > > @@ -661,6 +661,9 @@ static inline struct btf_decl_tag *btf_decl_tag(const struct btf_type *t)
> > > >         return (struct btf_decl_tag *)(t + 1);
> > > >  }
> > > >
> > > > +int btf__find_by_glob_kind(const struct btf *btf, __u32 kind,
> > > > +                          const char *allow_pattern, const char *deny_pattern,
> > > > +                          __u32 **__ids);
> > >
> > >
> > > as AI pointed out, this should be an internal helper, no? Let's also
> > > not use double underscore pattern here,
> > > "collect_btf_ids_by_glob_kind()" perhaps?
> >
> > ok
> >
> > >
> > > Also, you don't seem to be using deny_pattern, where you planning to?
> >
> > the tests are just rudimentary before we agree we want to do it this way
> >
> > but I'm not sure I have a usecase for deny_pattern.. I think we added it
> > just to be complete, I recall we copied that function from somewhere,
> > it's long time ago ;-)
> >
> > >
> > > Also, are there functions that we'll have BTF for, but they won't be
> > > attachable? What if I do SEC("fentry.multi/*")? Will it attach or fail
> > > to attach some functions (and thus fail the overall attachment)?
> >
> > yes, for the benchmark tests I had to add is_allowed_func which mimics
> > btf_distill_func_proto and denies attach for some functions
> >
> > also I had to filter out some core kernel functions like rcu*,trace*,..
> > which seemed to cause trouble when you attach them
> 
> So the question I'm implying here is if libbpf should do what we do
> for kprobes: use libbpf_available_kprobes_parse and intersect?

right, I think it's good idea.. and in addition (just for patterns) we would
filter out functions that:

  - won't attach (is_allowed_func == false)
  - might cause problems (rcu*,trace*), maybe for that we could have
    opts config bool

jirka