Skip to content
  • Yonghong Song's avatar
    bpf: introduce bpf subcommand BPF_TASK_FD_QUERY · 41bdc4b4
    Yonghong Song authored
    
    
    Currently, suppose a userspace application has loaded a bpf program
    and attached it to a tracepoint/kprobe/uprobe, and a bpf
    introspection tool, e.g., bpftool, wants to show which bpf program
    is attached to which tracepoint/kprobe/uprobe. Such attachment
    information will be really useful to understand the overall bpf
    deployment in the system.
    
    There is a name field (16 bytes) for each program, which could
    be used to encode the attachment point. There are some drawbacks
    for this approaches. First, bpftool user (e.g., an admin) may not
    really understand the association between the name and the
    attachment point. Second, if one program is attached to multiple
    places, encoding a proper name which can imply all these
    attachments becomes difficult.
    
    This patch introduces a new bpf subcommand BPF_TASK_FD_QUERY.
    Given a pid and fd, if the <pid, fd> is associated with a
    tracepoint/kprobe/uprobe perf event, BPF_TASK_FD_QUERY will return
       . prog_id
       . tracepoint name, or
       . k[ret]probe funcname + offset or kernel addr, or
       . u[ret]probe filename + offset
    to the userspace.
    The user can use "bpftool prog" to find more information about
    bpf program itself with prog_id.
    
    Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Signed-off-by: default avatarYonghong Song <yhs@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    41bdc4b4