Speaker
Description
The d_path is eBPF tracing helper, that returns string with
full path for given 'struct path' object and was requested
long time ago by many people.
Along the way of implementing it, other features had to be
added to the verifier:
-
compile time BTF IDs resolving
This allows using of kernel objects BTF IDs without resolving
them in runtime and saves few cycles on resolving during kernel
startup and introducing single interface for accessing such IDs -
allow to pass BTF ID + offset as helper argument
This allows to pass an argument to helper, which is defined via parent
BTF object + offset, like for bpf_d_path (added in following changes):
SEC("fentry/filp_close")
int BPF_PROG(prog_close, struct file file, void id)
{
...
ret = bpf_d_path(&file->f_path, ...
In this talk I'll show implementation details of d_path helper
and details of both aforementioned features and why they are
important for d_path helper.
| I agree to abide by the anti-harassment policy | I agree |
|---|
