• Andrii Nakryiko's avatar
    tools/bpftool: Show info for processes holding BPF map/prog/link/btf FDs · d53dee3f
    Andrii Nakryiko authored
    Add bpf_iter-based way to find all the processes that hold open FDs against
    BPF object (map, prog, link, btf). bpftool always attempts to discover this,
    but will silently give up if kernel doesn't yet support bpf_iter BPF programs.
    Process name and PID are emitted for each process (task group).
    
    Sample output for each of 4 BPF objects:
    
    $ sudo ./bpftool prog show
    2694: cgroup_device  tag 8c42dee26e8cd4c2  gpl
            loaded_at 2020-06-16T15:34:32-0700  uid 0
            xlated 648B  jited 409B  memlock 4096B
            pids systemd(1)
    2907: cgroup_skb  name egress  tag 9ad187367cf2b9e8  gpl
            loaded_at 2020-06-16T18:06:54-0700  uid 0
            xlated 48B  jited 59B  memlock 4096B  map_ids 2436
            btf_id 1202
            pids test_progs(2238417), test_progs(22384459)
    
    $ sudo ./bpftool map show
    2436: array  name test_cgr.bss  flags 0x400
            key 4B  value 8B  max_entries 1  memlock 8192B
            btf_id 1202
            pids test_progs(2238417), test_progs(22384459)
    2445: array  name pid_iter.rodata  flags 0x480
            key 4B  value 4B  max_entries 1  memlock 8192B
            btf_id 1214  frozen
            pids bpftool(2239612)
    
    $ sudo ./bpftool link show
    61: cgroup  prog 2908
            cgroup_id 375301  attach_type egress
            pids test_progs(2238417), test_progs(22384459)
    62: cgroup  prog 2908
            cgroup_id 375344  attach_type egress
            pids test_progs(2238417), test_progs(22384459)
    
    $ sudo ./bpftool btf show
    1202: size 1527B  prog_ids 2908,2907  map_ids 2436
            pids test_progs(2238417), test_progs(22384459)
    1242: size 34684B
            pids bpftool(2258892)
    Signed-off-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Reviewed-by: default avatarQuentin Monnet <quentin@isovalent.com>
    Link: https://lore.kernel.org/bpf/20200619231703.738941-9-andriin@fb.com
    d53dee3f
pid_iter.bpf.c 1.72 KB