bpflist: Display processes with running BPF programs and maps

[goldshtn]

This tool displays processes with running BPF programs and maps,
and also optionally kprobes and uprobes. This is a poor-man's version
that snoops BPF file descriptors, as proposed by @brendangregg.

Example:

PID    COMM             TYPE     COUNT
4058   fileslower       prog     4
4058   fileslower       map      2
4106   bashreadline     map      1
4106   bashreadline     prog     1

Resolves #1036.

[goldshtn]

BTW I haven't added the code for listing pinned BPF maps because I don't have an easy sample that uses pinned BPF maps. Do you have something @brendangregg?

[brendangregg]

Thanks! Looks like a good start.

In the future we might want to do a /proc//fd/ walker directly in python, since the "ls -l" may hit a "arglist too long" shell limit.

Can also add a -V at some point for really verbose, where it finishes by printing /sys/kernel/debug/tracing/kprobe_events and uprobe_events. It would be nice to associate that output with the PIDs, but that may need to wait for kernel support.

[goldshtn]

@brendangregg Try -vv :-)

[brendangregg]

Oh, great, thanks, it's already there!