Song Liu <songliubraving@xxxxxx> [Wed, 2020-02-26 21:45 -0800]: > > > > On Feb 26, 2020, at 6:32 PM, Andrey Ignatov <rdna@xxxxxx> wrote: > > > > The main use-case bpf.py covers is to show BPF programs attached to > > other BPF programs via freplace/fentry/fexit mechanisms introduced > > recently. There is no user-space API to get this info and e.g. bpftool > > can only show all BPF programs but can't show if program A replaces a > > function in program B. > > IIUC, bpftool misses features to show fireplace/fentry/fexit relations? > I think we should enable that in bpftool. No, the main part in the comment is "there is no user-space API", i.e. to my best knowledge kernel currently can't provide this info, bpftool was just an example of one of the most well known users of BPF API. Specifically everything-trampoline or attach_prog_fd (or corresponding prog id) / attach_btf_id passed at loading time are not available to user-space. I believe there will be many things like this that can be expensive to expose to user space via proper kernel API but are still useful to see in user space. That's the point of this drgn script. > > > > The name bpf.py is not super authentic. I'm open to better options. > > Maybe call it bpftool.py? Or bpfshow.py? bpftool.py may cause confustion with the genuine bpftool so I'd avoid it, but bpfshow.py looks fine. -- Andrey Ignatov
