LSFMM BPF Proposal: Using BTF in pahole and perf: Always present type information

LSFMM BPF Proposal: Using BTF in pahole and perf: Always present type information

[Arnaldo Carvalho de Melo]

Using BTF in pahole and perf: Always present type information

The presentation will go through recent developments in making information
about types, function signatures to be always available, for the kernel and for
BPF programs and the various possibilities that brings.

Now pahole, a tool to show all sorts of information about data structures
already used by the kernel community for years, can load DWARF and encode BTF,
and also can read that info, be it converted from DWARF or directly generated
by clang to the BPF target and show it just like it does for DWARF info, but
much faster.

A recent development, the deduplication of DWARF info will be described,
showing how this dramatically reduces the space needed to encode all the
kernel data structures and function signatures.

How this is being used in various tools, including bpftool and 'perf trace',
for instance to pretty print maps, will be showcased.

Further use BTF in debuggers, making the conversion and deduplication of the
kernel types be done as part of a production build, and havong it available in
vmcores are other opportunities to discuss.

With this always present type availability the usage of tools like
pahole become more feasible and automatic detection of non optimal
struct layouts can be done automatically, as part of kernel builds. It
is now much faster due to the much more compact size of the type
information.

The comparision of the types used in BPF bytecode with that for the equivalent
kernel type can be compared and under lots of cases allow for
compile-once-run-anywhere BPF bytecode, with offset adjustments, etc.

The need for kernel headers is diminished, with the possibility of
rebuilding types using a tool like pahole or directly by perf, bcc,
bpftrace, bpftool, etc.

Advanced filtering in 'perf trace' strace-like mode is also facilitated,
as well as the syscall function signatures for automatic pretty-printing
of its arguments.

----- End forwarded message -----

-- 

- Arnaldo