Re: [PATCH RFC net-next 11/14] tracing: allow eBPF programs to be attached to events

On Tue, Jul 1, 2014 at 1:30 AM, Daniel Borkmann [off-list ref] wrote:

On 06/28/2014 02:06 AM, Alexei Starovoitov wrote:

quoted

User interface:
cat bpf_123 > /sys/kernel/debug/tracing/__event__/filter

where 123 is an id of the eBPF program priorly loaded.
__event__ is static tracepoint event.
(kprobe events will be supported in the future patches)

eBPF programs can call in-kernel helper functions to:
- lookup/update/delete elements in maps
- memcmp
- trace_printk
- load_pointer
- dump_stack

Are there plans to let eBPF replace the generic event
filtering framework in tracing?

yes. the other patch that replaces predicate tree walking with
eBPF programs is pending on eBPF split out of networking.