1*387f9dfdSAndroid Build Coastguard WorkerDemonstrations of bpflist. 2*387f9dfdSAndroid Build Coastguard Worker 3*387f9dfdSAndroid Build Coastguard Worker 4*387f9dfdSAndroid Build Coastguard Workerbpflist displays information on running BPF programs and optionally also 5*387f9dfdSAndroid Build Coastguard Workerprints open kprobes and uprobes. It is used to understand which BPF programs 6*387f9dfdSAndroid Build Coastguard Workerare currently running on the system. For example: 7*387f9dfdSAndroid Build Coastguard Worker 8*387f9dfdSAndroid Build Coastguard Worker# bpflist 9*387f9dfdSAndroid Build Coastguard WorkerPID COMM TYPE COUNT 10*387f9dfdSAndroid Build Coastguard Worker4058 fileslower prog 4 11*387f9dfdSAndroid Build Coastguard Worker4058 fileslower map 2 12*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline map 1 13*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline prog 1 14*387f9dfdSAndroid Build Coastguard Worker 15*387f9dfdSAndroid Build Coastguard WorkerFrom the output above, the fileslower and bashreadline tools are running. 16*387f9dfdSAndroid Build Coastguard Workerfileslower has installed 4 BPF programs (functions) and has opened 2 BPF maps 17*387f9dfdSAndroid Build Coastguard Worker(such as hashes, histograms, stack trace tables, and so on). 18*387f9dfdSAndroid Build Coastguard Worker 19*387f9dfdSAndroid Build Coastguard WorkerIn verbose mode, bpflist also counts the number of kprobes and uprobes opened 20*387f9dfdSAndroid Build Coastguard Workerby the process. This information is obtained heuristically: bcc-based tools 21*387f9dfdSAndroid Build Coastguard Workerinclude the process id in the name of the probe. For example: 22*387f9dfdSAndroid Build Coastguard Worker 23*387f9dfdSAndroid Build Coastguard Worker# bpflist -v 24*387f9dfdSAndroid Build Coastguard WorkerPID COMM TYPE COUNT 25*387f9dfdSAndroid Build Coastguard Worker4058 fileslower prog 4 26*387f9dfdSAndroid Build Coastguard Worker4058 fileslower kprobe 4 27*387f9dfdSAndroid Build Coastguard Worker4058 fileslower map 2 28*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline uprobe 1 29*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline prog 1 30*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline map 1 31*387f9dfdSAndroid Build Coastguard Worker 32*387f9dfdSAndroid Build Coastguard WorkerIn double-verbose mode, the probe definitions are also displayed: 33*387f9dfdSAndroid Build Coastguard Worker 34*387f9dfdSAndroid Build Coastguard Worker# bpflist -vv 35*387f9dfdSAndroid Build Coastguard Workeropen kprobes: 36*387f9dfdSAndroid Build Coastguard Workerp:kprobes/p___vfs_read_bcc_4058 __vfs_read 37*387f9dfdSAndroid Build Coastguard Workerr:kprobes/r___vfs_read_bcc_4058 __vfs_read 38*387f9dfdSAndroid Build Coastguard Workerp:kprobes/p___vfs_write_bcc_4058 __vfs_write 39*387f9dfdSAndroid Build Coastguard Workerr:kprobes/r___vfs_write_bcc_4058 __vfs_write 40*387f9dfdSAndroid Build Coastguard Worker 41*387f9dfdSAndroid Build Coastguard Workeropen uprobes: 42*387f9dfdSAndroid Build Coastguard Workerr:uprobes/r__bin_bash_0xa4dd0_bcc_4106 /bin/bash:0x00000000000a4dd0 43*387f9dfdSAndroid Build Coastguard Worker 44*387f9dfdSAndroid Build Coastguard WorkerPID COMM TYPE COUNT 45*387f9dfdSAndroid Build Coastguard Worker4058 fileslower prog 4 46*387f9dfdSAndroid Build Coastguard Worker4058 fileslower kprobe 4 47*387f9dfdSAndroid Build Coastguard Worker4058 fileslower map 2 48*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline uprobe 1 49*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline prog 1 50*387f9dfdSAndroid Build Coastguard Worker4106 bashreadline map 1 51*387f9dfdSAndroid Build Coastguard Worker 52*387f9dfdSAndroid Build Coastguard Worker 53*387f9dfdSAndroid Build Coastguard WorkerUSAGE: 54*387f9dfdSAndroid Build Coastguard Worker# bpflist -h 55*387f9dfdSAndroid Build Coastguard Workerusage: bpflist.py [-h] [-v] 56*387f9dfdSAndroid Build Coastguard Worker 57*387f9dfdSAndroid Build Coastguard WorkerDisplay processes currently using BPF programs and maps 58*387f9dfdSAndroid Build Coastguard Worker 59*387f9dfdSAndroid Build Coastguard Workeroptional arguments: 60*387f9dfdSAndroid Build Coastguard Worker -h, --help show this help message and exit 61*387f9dfdSAndroid Build Coastguard Worker -v, --verbosity count and display kprobes/uprobes as well 62*387f9dfdSAndroid Build Coastguard Worker 63*387f9dfdSAndroid Build Coastguard Workerexamples: 64*387f9dfdSAndroid Build Coastguard Worker bpflist # display all processes currently using BPF 65*387f9dfdSAndroid Build Coastguard Worker bpflist -v # also count kprobes/uprobes 66*387f9dfdSAndroid Build Coastguard Worker bpflist -vv # display kprobes/uprobes and count them 67