Calling kfuncs from bpftrace

[jfernandez]

Is it possible to call a kfunc from bpftrace? In particular bpf_task_from_pid.

I'm working on a runqlat program and I need to filter out some tasks based on the info the the task struct. The sched_new and sched_switch hooks only provide the pids.

[jfernandez]

I learned that bpftrace support raw tracepoints, which provide the task structs as params.

rawtracepoint:sched_wakeup,
rawtracepoint:sched_wakeup_new,
{
    $task = (struct task_struct *)arg0;
    printf("Wakeup %d %s\n", $task->pid, $task->comm);
}

I'm still interested in finding out if kfunc calls are supported.

[ajor]

Calling arbitrary kfuncs isn't something that's supported in bpftrace right now, but I can see it being useful functionality to have. I'm not quite sure how we'd expose this in the language yet.

If it's still something you want, would you mind opening a "feature request" issue for it?

[jfernandez]

#3169

[danobi]

The machinery for calling kfuncs is blocked on #2334

Whether or not we want to allow arbitrary calls is interesting but a separate discussion. It sounds awfully like adding support for #2976 (in a good way). Definitely something we can consider.

Historically, we allow-list helpers via implementing bpftrace helpers. But since kfuncs are unstable, it could make sense to offload compat to the user. It's a bit of a tradeoff IMO

[jordalgo]

Do we have the BTF for these kfuncs and does that make it easier to implement this (after #2334 is resolved of course) ?

[danobi]

Yes, we do. Both:

• https://lore.kernel.org/bpf/[email protected]/
• https://lore.kernel.org/bpf/[email protected]/

have been merged. And at some point in the future we will be able to feature probe kfuncs.