* How to make BPF program which is attached to kprobe keep working after process exits?
@ 2021-05-15 6:55 Junyeong Jeong
0 siblings, 0 replies; only message in thread
From: Junyeong Jeong @ 2021-05-15 6:55 UTC (permalink / raw)
To: kernelnewbies
Hello :)
My BPF program is loaded by `bpf_load_program_xattr` of `libbpf` and
then attached to kprobe event using `perf_event_open`,
`ioctl(PERF_EVENT_IOC_SET_BPF)` and `ioctl(PERF_EVENT_IOC_ENABLE)`.
Then the BPF program is working as I expected.
And I wanted to make the BPF program keep working even though the
userspace process exits. So I pinned it using `bpf_obj_pin()`.
But unfortunately the BPF program is never called after the userspace
process exits.
I discovered the cause of the failure. The file descriptor of perf event
is automatically closed when userspace process exits so objects related
to perf event get destroyed.
So I tried to find how to pin the fd of perf event, but I got to know
that only BPF programs, BPF maps and BPF links are subject to pin.
How can I make my BPF program which is attached to kprobe keep working
after userspace process exits?
regards,
Junyeong
_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-05-15 7:00 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-15 6:55 How to make BPF program which is attached to kprobe keep working after process exits? Junyeong Jeong
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).